Windows Analysis Report
https://drive.google.com/file/d/12MKHqJjXiEwnV-TurNrVJ7uG6tw2aa8w/view?usp=drive_web

Overview

General Information

Sample URL:	https://drive.google.com/file/d/12MKHqJjXiEwnV-TurNrVJ7uG6tw2aa8w/view?usp=drive_web
Analysis ID:	1427643

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fdrive.google.com%2Fdrivesharing%2Fclientmodel%3Fid%3D12MKHqJjXiEwnV-TurNrVJ7uG6tw2aa8w%26foreignService%3Dtexmex%26authuser%3D0%26origin%3Dhttps%3A%2F%2Fdrive.google.com&followup=https%3A%2F%2Fdrive.google.com%2Fdrivesharing%2Fclientmodel%3Fid%3D12MKHqJjXiEwnV-TurNrVJ7uG6tw2aa8w%26foreignService%3Dtexmex%26authuser%3D0%26origin%3Dhttps%3A%2F%2Fdrive.google.com&ifkv=ARZ0qKIqP07IgcifochqcYFF6zdcdhQoD9xaAaZEvT_CediGAjXoBjScjZlsHAwgA6ZL_5rHPNeYRg&osid=1&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1124103681%3A1713387692749822&theme=mn&ddm=0

HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.7.35:443 -> 192.168.2.16:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.7.35:443 -> 192.168.2.16:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49860 version: TLS 1.2

Source: winword.exe

Memory has grown: Private usage: 19MB later: 64MB

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	TCP traffic detected without corresponding DNS query: 23.201.212.130
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157

Source: unknown

DNS traffic detected: queries for: drive.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.7.35:443 -> 192.168.2.16:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.7.35:443 -> 192.168.2.16:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49860 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@20/145@28/230

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{1FB8F420-B01F-42DD-8579-F24167DE5A4E} - OProcSessId.dat

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://drive.google.com/file/d/12MKHqJjXiEwnV-TurNrVJ7uG6tw2aa8w/view?usp=drive_web
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1960,i,5469819107424969362,12574675760100082209,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1960,i,5469819107424969362,12574675760100082209,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Downloads\1898 - MNDA redline.docx" /o ""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Downloads\1898 - MNDA redline.docx" /o ""
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.138.113	unknown	United States	15169	GOOGLEUS	false
64.233.176.95	unknown	United States	15169	GOOGLEUS	false
64.233.176.94	unknown	United States	15169	GOOGLEUS	false
23.201.212.130	unknown	United States	5432	PROXIMUS-ISP-ASBE	false
20.42.72.131	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.109.8.36	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
74.125.136.101	unknown	United States	15169	GOOGLEUS	false
142.250.9.95	unknown	United States	15169	GOOGLEUS	false
64.233.177.132	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
64.233.176.113	unknown	United States	15169	GOOGLEUS	false
64.233.185.84	unknown	United States	15169	GOOGLEUS	false
142.250.9.94	unknown	United States	15169	GOOGLEUS	false
64.233.176.138	unknown	United States	15169	GOOGLEUS	false
64.233.176.139	drive.google.com	United States	15169	GOOGLEUS	false
172.217.215.95	unknown	United States	15169	GOOGLEUS	false
64.233.177.94	unknown	United States	15169	GOOGLEUS	false
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.215.132	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
74.125.138.105	www.google.com	United States	15169	GOOGLEUS	false
74.125.136.94	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
74.125.136.95	unknown	United States	15169	GOOGLEUS	false
23.49.5.132	unknown	United States	35994	AKAMAI-ASUS	false
23.62.216.45	unknown	United States	3257	GTT-BACKBONEGTTDE	false
74.125.136.139	plus.l.google.com	United States	15169	GOOGLEUS	false
23.1.33.18	unknown	United States	20940	AKAMAI-ASN1EU	false
173.194.219.101	play.google.com	United States	15169	GOOGLEUS	false
172.253.124.94	unknown	United States	15169	GOOGLEUS	false
52.111.230.26	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.109.52.131	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
64.233.185.95	peoplestackwebexperiments-pa.clients6.google.com	United States	15169	GOOGLEUS	false
108.177.122.95	blobcomments-pa.clients6.google.com	United States	15169	GOOGLEUS	false
64.233.176.106	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
blobcomments-pa.clients6.google.com	108.177.122.95	true
play.google.com	173.194.219.101	true
plus.l.google.com	74.125.136.139	true
drive.google.com	64.233.176.139	true
www.google.com	74.125.138.105	true
drive.usercontent.google.com	172.217.215.132	true
peoplestackwebexperiments-pa.clients6.google.com	64.233.185.95	true
googlehosted.l.googleusercontent.com	64.233.177.132	true
lh3.googleusercontent.com	unknown	unknown
apis.google.com	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://drive.google.com/file/d/12MKHqJjXiEwnV-TurNrVJ7uG6tw2aa8w/view	false	high
https://drive.google.com/auth_warmup	false	high
about:blank	false	low

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json	JSON data	036628E3E3F0728DAA7D53AC1B3EF8CC	65327D9039335E1BAF9E14639AE355195766C9EC	2CAEC4D00BD356241B8B405B1B74386C677D501A7A23CE6EF916EAF912541544
C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_39.ttf	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_39RegularVersion 4.39;O365	1BE236301B686323302632C0EACCFD6F	7EF18B642DBFA9FB6E8AFABACB50F6CA6BD73BB4	90200D640623BFB0518B18D72C3F9828BC6EDA63EAB2DA90FBC27A08AAD165D7
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1BE34897.jpg	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1000x1000, components 3	C1ABA8535BCB841B2A67F450FD5676AE	2BB3E5ABCA500CD11BB585757C86A74D1E30FEDC	6CADF99D315DF25CC30247324A6545F1DF3E9F3598D96A7FAE3CAC9BFD9F8523
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{639340CD-A8E6-42F5-8D76-A0932A6E2556}.tmp	data	DF3EAE58A4F3125722A1EC6E6C53E2AC	12F11B1B71E7B7EA4B3B5FB73AAEB85B3D213E89	C7797C433F0FEFA2576179EAD50A453A2832C4CEF3B20E8F0CA43B6700D9A1C2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{85636766-210C-4F6B-ABA8-BC4A3912F855}.tmp	data	AEE4AE4F4E9CFF4ACC72208154B5F5B2	680823FFCC430166CAA6599EC47E8C3D64DB583E	14BFD30AFB3A3B74EAC32F9B7DD965146B5085DBF5B851CD2C3E3C40D3187CCF
C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1713387705232626000_1FB8F420-B01F-42DD-8579-F24167DE5A4E.log	ASCII text, with very long lines (1343), with CRLF line terminators	5B6E0FD10CF489F88221C1D66A44932C	AAAC46D28BE2400244E2DFEC2737F31485F1500C	A155107AA83A48B9A473D894269E7410B1B791CEB3D935185D0143C14B79CA94
C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1713387705233184100_1FB8F420-B01F-42DD-8579-F24167DE5A4E.log	data	8F4E33F3DC3E414FF94E5FB6905CBA8C	9674344C90C2F0646F0B78026E127C9B86E3AD77	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
C:\Users\user\AppData\Local\Temp\TCD41C6.tmp\Content.inf	data	333BA58FCE326DEA1E4A9DE67475AA95	F51FAD5385DC08F7D3E11E1165A18F2E8A028C14	66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
C:\Users\user\AppData\Local\Temp\TCD41C6.tmp\mlaseventheditionofficeonline.xsl	XML 1.0 document, ASCII text, with CRLF line terminators	377B3E355414466F3E3861BCE1844976	0B639A3880ACA3FD90FA918197A669CC005E2BA4	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
C:\Users\user\AppData\Local\Temp\TCD41C9.tmp\BracketList.glox	Microsoft OOXML	5D9BAD7ADB88CEE98C5203883261ACA1	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
C:\Users\user\AppData\Local\Temp\TCD41C9.tmp\Content.inf	data	1A314B08BB9194A41E3794EF54017811	D1E70DB69CA737101524C75E634BB72F969464FF	9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
C:\Users\user\AppData\Local\Temp\TCD41CA.tmp\Content.inf	data	877A8A960B2140E3A0A2752550959DB9	FBEC17B332CBC42F2F16A1A08767623C7955DF48	FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
C:\Users\user\AppData\Local\Temp\TCD41CA.tmp\gb.xsl	XML 1.0 document, ASCII text, with CRLF line terminators	51D32EE5BC7AB811041F799652D26E04	412193006AA3EF19E0A57E16ACF86B830993024A	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
C:\Users\user\AppData\Local\Temp\TCD41CD.tmp\turabian.xsl	XML 1.0 document, ASCII text, with CRLF line terminators	F079EC5E2CCB9CD4529673BCDFB90486	FBA6696E6FA918F52997193168867DD3AEBE1AD6	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
C:\Users\user\AppData\Local\Temp\TCD41CF.tmp\architecture.glox	Microsoft OOXML	8109B3C170E6C2C114164B8947F88AA1	FC63956575842219443F4B4C07A8127FBD804C84	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
C:\Users\user\AppData\Local\Temp\TCD41E4.tmp\Content.inf	data	923D406B2170497AD4832F0AD3403168	A77DA08C9CB909206CDE42FE1543B9FE96DF24FB	EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
C:\Users\user\AppData\Local\Temp\TCD41E4.tmp\ConvergingText.glox	Zip archive data, at least v2.0 to extract, compression method=deflate	C9F9364C659E2F0C626AC0D0BB519062	C4036C576074819309D03BB74C188BF902D1AE00	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
C:\Users\user\AppData\Local\Temp\TCD41F4.tmp\Content.inf	data	52BD0762F3DC77334807DDFC60D5F304	5962DA7C58F742046A116DDDA5DC8EA889C4CB0E	30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
C:\Users\user\AppData\Local\Temp\TCD41F4.tmp\RadialPictureList.glox	Microsoft OOXML	CDC1493350011DB9892100E94D5592FE	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
C:\Users\user\AppData\Local\Temp\TCD41F5.tmp\Content.inf	data	9C00979164E78E3B890E56BE2DF00666	1FA3C439D214C34168ADF0FBA5184477084A0E51	21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
C:\Users\user\AppData\Local\Temp\TCD41F5.tmp\iso690nmerical.xsl	XML 1.0 document, ASCII text, with CRLF line terminators	3BF8591E1D808BCCAD8EE2B822CC156B	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
C:\Users\user\AppData\Local\Temp\TCD41F9.tmp\Content.inf	data	16711B951E1130126E240A6E4CC2E382	8095AA79AEE029FD06428244CA2A6F28408448DB	855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
C:\Users\user\AppData\Local\Temp\TCD41F9.tmp\TabbedArc.glox	Zip archive data, at least v2.0 to extract, compression method=deflate	E8308DA3D46D0BC30857243E1B7D330D	C7F8E54A63EB254C194A23137F269185E07F9D10	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
C:\Users\user\AppData\Local\Temp\TCD420A.tmp\Content.inf	data	2F7A8FE4E5046175500AFFA228F99576	8A3DE74981D7917E6CE1198A3C8E35C7E2100F43	1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
C:\Users\user\AppData\Local\Temp\TCD420A.tmp\Text Sidebar (Annual Report Red and Black design).docx	Microsoft Word 2007+	5A53F55DD7DA8F10A8C0E711F548B335	035E685927DA2FECB88DE9CAF0BECEC88BC118A7	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
C:\Users\user\AppData\Local\Temp\TCD421B.tmp\Content.inf	data	149948E41627BE5DC454558E12AF2DA4	DB72388C037F0B638FCD007FAB46C916249720A8	1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
C:\Users\user\AppData\Local\Temp\TCD421B.tmp\sist02.xsl	XML 1.0 document, ASCII text, with CRLF line terminators	F883B260A8D67082EA895C14BF56DD56	7954565C1F243D46AD3B1E2F1BAF3281451FC14B	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
C:\Users\user\AppData\Local\Temp\TCD422B.tmp\Content.inf	data	3D52060B74D7D448DC733FFE5B92CB52	3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC	BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
C:\Users\user\AppData\Local\Temp\TCD422B.tmp\ThemePictureAlternatingAccent.glox	Zip archive data, at least v2.0 to extract, compression method=deflate	2F8998AA9CF348F1D6DE16EAB2D92070	85B13499937B4A584BEA0BFE60475FD4C73391B6	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
C:\Users\user\AppData\Local\Temp\TCD422C.tmp\Content.inf	data	A6B2731ECC78E7CED9ED5408AB4F2931	BA15D036D522978409846EA682A1D7778381266F	6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
C:\Users\user\AppData\Local\Temp\TCD422C.tmp\TabList.glox	Zip archive data, at least v2.0 to extract, compression method=deflate	0A4CA91036DC4F3CD8B6DBF18094CF25	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
C:\Users\user\AppData\Local\Temp\TCD427B.tmp\Content.inf	data	4EC6724CBBA516CF202A6BD17226D02C	E412C574D567F0BA68B4A31EDB46A6AB3546EA95	18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
C:\Users\user\AppData\Local\Temp\TCD427B.tmp\harvardanglia2008officeonline.xsl	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators	33A829B4893044E1851725F4DAF20271	DAC368749004C255FB0777E79F6E4426E12E5EC8	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
C:\Users\user\AppData\Local\Temp\TCD427C.tmp\HexagonRadial.glox	Microsoft OOXML	20621E61A4C5B0FFEEC98FFB2B3BCD31	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
C:\Users\user\AppData\Local\Temp\TCD427D.tmp\Content.inf	data	1309D172F10DD53911779C89A06BBF65	274351A1059868E9DEB53ADF01209E6BFBDFADFB	C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
C:\Users\user\AppData\Local\Temp\TCD427D.tmp\InterconnectedBlockProcess.glox	Zip archive data, at least v2.0 to extract, compression method=deflate	08D3A25DD65E5E0D36ADC602AE68C77D	F23B6DDB3DA0015B1D8877796F7001CABA25EA64	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
C:\Users\user\AppData\Local\Temp\TCD427E.tmp\Content.inf	data	4A9A2E8DB82C90608C96008A5B6160EF	A49110814D9546B142C132EBB5B9D8A1EC23E2E6	4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
C:\Users\user\AppData\Local\Temp\TCD427E.tmp\chicago.xsl	XML 1.0 document, ASCII text, with CRLF line terminators	9AC6DE7B629A4A802A41F93DB2C49747	3D6E929AA1330C869D83F2BF8EBEBACD197FB367	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
C:\Users\user\AppData\Local\Temp\TCD427F.tmp\ThemePictureAccent.glox	Zip archive data, at least v2.0 to extract, compression method=deflate	42A840DC06727E42D42C352703EC72AA	21AAAF517AFB76BF1AF4E06134786B1716241D29	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
C:\Users\user\AppData\Local\Temp\TCD4290.tmp\CircleProcess.glox	Zip archive data, at least v2.0 to extract, compression method=deflate	950F3AB11CB67CC651082FEBE523AF63	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
C:\Users\user\AppData\Local\Temp\TCD4290.tmp\Content.inf	data	D04EC08EFE18D1611BDB9A5EC0CC00B1	668FF6DFE64D5306220341FC2C1353199D122932	FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
C:\Users\user\AppData\Local\Temp\TCD42A1.tmp\Content.inf	data	4DD225E2A305B50AF39084CE568B8110	C85173D49FC1522121AA2B0B2E98ADF4BB95B897	6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
C:\Users\user\AppData\Local\Temp\TCD42A1.tmp\chevronaccent.glox	Microsoft OOXML	7BC0A35807CD69C37A949BBD51880FF5	B5870846F44CAD890C6EFF2F272A037DA016F0D8	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
C:\Users\user\AppData\Local\Temp\TCD42A2.tmp\Content.inf	data	F25AC64EC63FA98D9E37782E2E49D6E6	97DD9CFA4A22F5B87F2B53EFA37332A9EF218204	834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
C:\Users\user\AppData\Local\Temp\TCD42A2.tmp\ieee2006officeonline.xsl	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators	0C9731C90DD24ED5CA6AE283741078D0	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
C:\Users\user\AppData\Local\Temp\TCD42C3.tmp\PictureFrame.glox	Microsoft OOXML	D32E93F7782B21785424AE2BEA62B387	1D5589155C319E28383BC01ED722D4C2A05EF593	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
C:\Users\user\AppData\Local\Temp\TCD452C.tmp\Circuit.thmx	Zip archive data, at least v2.0 to extract, compression method=deflate	ACBA78931B156E4AF5C4EF9E4AB3003B	2A1F506749A046ECFB049F23EC43B429530EC489	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
C:\Users\user\AppData\Local\Temp\TCD452C.tmp\content.inf	Unicode text, UTF-16, little-endian text, with CRLF line terminators	40FF521ED2BA1B015F17F0B0E5D95068	0F29C084311084B8FDFE67855884D8EB60BDE1A6	CC3575BA195F0F271FFEBA6F6634BC9A2CF5F3BE448F58DBC002907D7C81CBBB
C:\Users\user\AppData\Local\Temp\TCD455D.tmp\Gallery.thmx	Microsoft OOXML	2192871A20313BEC581B277E405C6322	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
C:\Users\user\AppData\Local\Temp\TCD455D.tmp\content.inf	Unicode text, UTF-16, little-endian text, with CRLF line terminators	1C5D58A5ED3B40486BC22B254D17D1DD	69B8BB7B0112B37B9B5F9ADA83D11FBC99FEC80A	EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055
C:\Users\user\AppData\Local\Temp\TCD459E.tmp\Mesh.thmx	Microsoft OOXML	CDF98D6B111CF35576343B962EA5EEC6	D481A70EC9835B82BD6E54316BF27FAD05F13A1C	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
C:\Users\user\AppData\Local\Temp\TCD459E.tmp\content.inf	Unicode text, UTF-16, little-endian text, with CRLF line terminators	8D1E1991838307E4C2197ECB5BA9FA79	4AD8BB98DC9C5060B58899B3E9DCBA6890BC9E93	4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9
C:\Users\user\AppData\Local\Temp\TCD45B0.tmp\Damask.thmx	Microsoft OOXML	EE33FDA08FBF10EF6450B875717F8887	7DFA77B8F4559115A6BF186EDE51727731D7107D	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
C:\Users\user\AppData\Local\Temp\TCD45B0.tmp\content.inf	Unicode text, UTF-16, little-endian text, with CRLF line terminators	06B3DDEFF905F75FA5FA5C5B70DCB938	E441B94F0621D593DC870A27B28AC6BE3842E7DB	72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A
C:\Users\user\AppData\Local\Temp\TCD45D0.tmp\Droplet.thmx	Microsoft OOXML	529795E0B55926752462CBF32C14E738	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
C:\Users\user\AppData\Local\Temp\TCD45D0.tmp\content.inf	Unicode text, UTF-16, little-endian text, with CRLF line terminators	AA7B919B21FD42C457948DE1E2988CB3	19DA49CF5540E5840E95F4E722B54D44F3154E04	5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9
C:\Users\user\AppData\Local\Temp\TCD45F2.tmp\Slate.thmx	Microsoft OOXML	5BDE450A4BD9EFC71C370C731E6CDF43	5B223FB902D06F9FCC70C37217277D1E95C8F39D	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
C:\Users\user\AppData\Local\Temp\TCD45F2.tmp\content.inf	Unicode text, UTF-16, little-endian text, with CRLF line terminators	5402138088A9CF0993C08A0CA81287B8	D734BD7F2FB2E0C7D5DB8F70B897376ECA935C9A	5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137
C:\Users\user\AppData\Local\Temp\TCD4621.tmp\Main_Event.thmx	Microsoft OOXML	5AF1581E9E055B6E323129E4B07B1A45	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
C:\Users\user\AppData\Local\Temp\TCD4621.tmp\content.inf	Unicode text, UTF-16, little-endian text, with CRLF line terminators	C9812793A4E94320C49C7CA054EE6AA4	CC1F88C8F3868B3A9DE7E0E5F928DBD015234ABA	A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC
C:\Users\user\AppData\Local\Temp\TCD4651.tmp\Content.inf	data	55BA5B2974A072B131249FD9FD42EB91	6509F8AC0AA23F9B8F3986217190F10206A691EA	13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7
C:\Users\user\AppData\Local\Temp\TCD4651.tmp\Insight design set.dotx	Microsoft Word 2007+	8BC84DB5A3B2F8AE2940D3FB19B43787	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
C:\Users\user\AppData\Local\Temp\TCD4681.tmp\Vapor_Trail.thmx	Microsoft OOXML	FB88BFB743EEA98506536FC44B053BD0	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
C:\Users\user\AppData\Local\Temp\TCD4681.tmp\content.inf	Unicode text, UTF-16, little-endian text, with CRLF line terminators	0FEA64606C519B78B7A52639FEA11492	FC9A6D5185088318032FD212F6BDCBD1CF2FFE76	60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13
C:\Users\user\AppData\Local\Temp\cab4184.tmp	Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression	E033CCBC7BA787A2F824CE0952E57D44	EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A	D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
C:\Users\user\AppData\Local\Temp\cab4185.tmp	Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	66C5199CF4FB18BD4F9F3F2CCB074007	BA9D8765FFC938549CC19B69B3BF5E6522FB062E	4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
C:\Users\user\AppData\Local\Temp\cab4186.tmp	Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	E3C64173B2F4AA7AB72E1396A9514BD8	774E52F7E74B90E6A520359840B0CA54B3085D88	16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
C:\Users\user\AppData\Local\Temp\cab4187.tmp	Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression	53EE9DA49D0B84357038ECF376838D2E	AB03F46783B2227F312187DD84DC0C517510DE20	9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
C:\Users\user\AppData\Local\Temp\cab4188.tmp	Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	ABBF10CEE9480E41D81277E9538F98CB	F4EA53D180C95E78CC1DA88CD63F4C099BF0512C	557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
C:\Users\user\AppData\Local\Temp\cab4189.tmp	Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression	92A819D434A8AAEA2C65F0CC2F33BB3A	85C3F1801EFFEA1EA10A8429B0875FC30893F2C8	5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
C:\Users\user\AppData\Local\Temp\cab419A.tmp	Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression	1D6F8E73A0662A48D332090A4C8C898F	CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C	8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
C:\Users\user\AppData\Local\Temp\cab419B.tmp	Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	EF9CB8BDFBC08F03BEF519AD66BA642F	D98C275E9402462BF52A4D28FAF57DF0D232AF6B	93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
C:\Users\user\AppData\Local\Temp\cab419C.tmp	Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	7BF88B3CA20EB71ED453A3361908E010	F75F86557051160507397F653D7768836E3B5655	E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
C:\Users\user\AppData\Local\Temp\cab419D.tmp	Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	486CBCB223B873132FFAF4B8AD0AD044	B0EC82CD986C2AB5A51C577644DE32CFE9B12F92	B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
C:\Users\user\AppData\Local\Temp\cab419E.tmp	Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	4EFA48EC307EAF2F9B346A073C67FCFB	76A7E1234FF29A2B18C968F89082A14C9C851A43	3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
C:\Users\user\AppData\Local\Temp\cab419F.tmp	Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	F913DD84915753042D856CEC4E5DABA5	FB1E423C8D09388C3F0B6D44364D94D786E8CF53	AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
C:\Users\user\AppData\Local\Temp\cab41B0.tmp	Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	7C645EC505982FE529D0E5035B378FFC	1488ED81B350938D68A47C7F0BCE8D91FB1673E2	298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
C:\Users\user\AppData\Local\Temp\cab41B1.tmp	Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression	62863124CDCDA135ECC0E722782CB888	2543B8A9D3B2304BB73D2ADBEC60DB040B732055	23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
C:\Users\user\AppData\Local\Temp\cab41B2.tmp	Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression	205AF51604EF96EF1E8E60212541F742	D436FE689F8EF51FBA898454CF509DDB049C1545	DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
C:\Users\user\AppData\Local\Temp\cab41B3.tmp	Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression	51804E255C573176039F4D5B55C12AB2	A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B	3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
C:\Users\user\AppData\Local\Temp\cab41B4.tmp	Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression	69EDB3BF81C99FE8A94BBA03408C5AE1	1AC85B369A976F35244BEEFA9C06787055C869C1	CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
C:\Users\user\AppData\Local\Temp\cab41C4.tmp	Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression	6D787B1E223DB6B91B69238062CCA872	A02F3D847D1F8973E854B89D4558413EA2E349F7	DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
C:\Users\user\AppData\Local\Temp\cab41C7.tmp	Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression	D3C9036E4E1159E832B1B4D2E9D42BF0	966E04B7A8016D7FDAFE2C611957F6E946FAB1B9	434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
C:\Users\user\AppData\Local\Temp\cab41C8.tmp	Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression	C455C4BC4BEC9E0DA67C4D1E53E46D5A	7674600C387114B0F98EC925BE74E811FB25C325	40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
C:\Users\user\AppData\Local\Temp\cab41CB.tmp	Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	C47E3430AF813DF8B02E1CB4829DD94B	35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC	F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
C:\Users\user\AppData\Local\Temp\cab41CC.tmp	Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	89A9818E6658D73A73B642522FF8701F	E66C95E957B74E90B444FF16D9B270ADAB12E0F4	F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
C:\Users\user\AppData\Local\Temp\cab41CE.tmp	Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression	91AADBEC4171CFA8292B618492F5EF34	A47DEB62A21056376DD8F862E1300F1E7DC69D1D	7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
C:\Users\user\AppData\Local\Temp\cab41D0.tmp	Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	E532038762503FFA1371DF03FA2E222D	F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0	5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
C:\Users\user\AppData\Local\Temp\cab41D1.tmp	Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	D30AD26DBB6DECA4FDD294F48EDAD55D	CA767A1B6AF72CF170C9E10438F61797E0F2E8CE	6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
C:\Users\user\AppData\Local\Temp\cab41D2.tmp	Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	8B29FAB506FD65C21C9CD6FE6BBBC146	CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF	773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
C:\Users\user\AppData\Local\Temp\cab41F6.tmp	Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	B9A6FF715719EE9DE16421AB983CA745	6B3F68B224020CD4BF142D7EDAAEC6B471870358	E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
C:\Users\user\AppData\Local\Temp\cab41F8.tmp	Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression	EE0129C7CC1AC92BBC3D6CB0F653FCAE	4ABAA858176B349BDAB826A7C5F9F00AC5499580	345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
C:\Users\user\AppData\Local\Temp\cab42B2.tmp	Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression	21A4B7B71631C2CCDA5FBBA63751F0D2	DE65DC641D188062EF9385CC573B070AAA8BDD28	AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
C:\Users\user\AppData\Local\Temp\cab44FB.tmp	Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression	BEB12A0464D096CA33BAEA4352CE800F	F678D650B4A41676BA05C836D462F34BDC5BF648	A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA
C:\Users\user\AppData\Local\Temp\cab451B.tmp	Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression	9C9F49A47222C18025CC25575337A965	E42EDB33471D7C1752DCC42C06DD3F9FDA8B25F0	ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A
C:\Users\user\AppData\Local\Temp\cab454C.tmp	Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression	53C5F45B22E133B28D4BD3B5A350FDBD	D180CFB1438D27F76E1919DA3E84F307CB83434F	8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273
C:\Users\user\AppData\Local\Temp\cab457D.tmp	Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression	828F96031F40BF8EBCB5E52AAEEB7E4C	CACC32738A0A66C8FE51A81ED8E27A6F82E69EB2	640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7
C:\Users\user\AppData\Local\Temp\cab458E.tmp	Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression	749C3615E54C8E6875518CFD84E5A1B2	64D51EB1156E850ECA706B00961C8B101F5AC2FC	F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C
C:\Users\user\AppData\Local\Temp\cab459F.tmp	Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression	F256ACA509B4C6C0144D278C7036B0A8	93F6106D0759AFD0061F73B876AA9CAB05AA8EF6	AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67
C:\Users\user\AppData\Local\Temp\cab45E1.tmp	Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression	8867BDF5FC754DA9DA6F5BA341334595	5067CCE84C6C682B75C1EF3DEA067A8D58D80FA9	42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58
C:\Users\user\AppData\Local\Temp\msoFEDD.tmp	GIF image data, version 89a, 15 x 15	ED3C1C40B68BA4F40DB15529D5443DEC	831AF99BB64A04617E0A42EA898756F9E0E0BCCA	039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl	data	0370E256A3AE54BD6AC5F4056DAC3832	C742199FA0AEE65B6380E40A8B2CD912118664B9	FABBF532CDF55F1E77473B3CDC648E44941513D3CBCC08EFB81AF62E5E2A5752
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\1898 - MNDA redline.LNK	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Apr 17 20:01:44 2024, mtime=Wed Apr 17 20:01:46 2024, atime=Wed Apr 17 20:01:44 2024, length=43673, window=hide	95B492D18B1EAA13011C8DFB2F9C773B	1D8CD35505308BDC4BA23BB6ACBAF2317484546B	4818ABFCF6866F2AE2716C179B9ACB33E6EF869EF2F10E51A91533C39E52844A
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat	Generic INItialization configuration [folders]	F7661D5DE96F05D11C3071B2FBE321DE	969033BE16D313971B798FB706263665B7684510	C3FFEC7230312C71981A9DE73E2BA75FDD57FAB6FECAB2E469A4A2725522D9AA
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)	Microsoft OOXML	CDF98D6B111CF35576343B962EA5EEC6	D481A70EC9835B82BD6E54316BF27FAD05F13A1C	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)	Zip archive data, at least v2.0 to extract, compression method=deflate	ACBA78931B156E4AF5C4EF9E4AB3003B	2A1F506749A046ECFB049F23EC43B429530EC489	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)	Microsoft OOXML	EE33FDA08FBF10EF6450B875717F8887	7DFA77B8F4559115A6BF186EDE51727731D7107D	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)	Microsoft OOXML	529795E0B55926752462CBF32C14E738	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)	Microsoft OOXML	5AF1581E9E055B6E323129E4B07B1A45	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)	Microsoft OOXML	5BDE450A4BD9EFC71C370C731E6CDF43	5B223FB902D06F9FCC70C37217277D1E95C8F39D	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)	Microsoft OOXML	FB88BFB743EEA98506536FC44B053BD0	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)	Microsoft OOXML	2192871A20313BEC581B277E405C6322	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)	Microsoft OOXML	5D9BAD7ADB88CEE98C5203883261ACA1	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)	Microsoft OOXML	7BC0A35807CD69C37A949BBD51880FF5	B5870846F44CAD890C6EFF2F272A037DA016F0D8	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)	Zip archive data, at least v2.0 to extract, compression method=deflate	C9F9364C659E2F0C626AC0D0BB519062	C4036C576074819309D03BB74C188BF902D1AE00	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)	Zip archive data, at least v2.0 to extract, compression method=deflate	08D3A25DD65E5E0D36ADC602AE68C77D	F23B6DDB3DA0015B1D8877796F7001CABA25EA64	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)	Microsoft OOXML	CDC1493350011DB9892100E94D5592FE	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)	Zip archive data, at least v2.0 to extract, compression method=deflate	E8308DA3D46D0BC30857243E1B7D330D	C7F8E54A63EB254C194A23137F269185E07F9D10	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)	XML 1.0 document, ASCII text, with CRLF line terminators	9AC6DE7B629A4A802A41F93DB2C49747	3D6E929AA1330C869D83F2BF8EBEBACD197FB367	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)	XML 1.0 document, ASCII text, with CRLF line terminators	51D32EE5BC7AB811041F799652D26E04	412193006AA3EF19E0A57E16ACF86B830993024A	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators	33A829B4893044E1851725F4DAF20271	DAC368749004C255FB0777E79F6E4426E12E5EC8	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)	XML 1.0 document, ASCII text, with CRLF line terminators	F883B260A8D67082EA895C14BF56DD56	7954565C1F243D46AD3B1E2F1BAF3281451FC14B	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)	Microsoft Word 2007+	5A53F55DD7DA8F10A8C0E711F548B335	035E685927DA2FECB88DE9CAF0BECEC88BC118A7	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)	Microsoft Word 2007+	8BC84DB5A3B2F8AE2940D3FB19B43787	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC	Unicode text, UTF-16, little-endian text, with CRLF line terminators	C5A12EA2F9C2D2A79155C1BC161C350C	75004B4B6C6C4EE37BE7C3FD7EE4AF4A531A1B1A	61EC0DAA23CBC92167446DADEFB919D86E592A31EBBD0AB56E64148EBF82152D
C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex	Unicode text, UTF-16, little-endian text, with no line terminators	F3B25701FE362EC84616A93A45CE9998	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B276Q8R32VB20D0XFSGT.temp	data	E4A1661C2C886EBB688DEC494532431C	A2AE2A7DB83B33DC95396607258F553114C9183C	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms (copy)	data	E4A1661C2C886EBB688DEC494532431C	A2AE2A7DB83B33DC95396607258F553114C9183C	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms~RF22531.TMP (copy)	data	E4A1661C2C886EBB688DEC494532431C	A2AE2A7DB83B33DC95396607258F553114C9183C	B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 17 20:01:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B2D11D79DB4418907E28445493E0D855	F35CDD427A189E55E65B15BEE18A446948F76387	03BE52FBC19A47DE27E5BA2BF39F4A1B4DA60C8C170FB69464C2B795D621F7C1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 17 20:01:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	55B85946020AC8F3D75CDB2E54B49999	2D98F7C0F5DACCAAD7863B518C96F869D5D92030	EFD15DACF2A65FB02D389EAB096F7B4362F0A16936EA1039E383A7855546C26F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E8123E55C134C4CAFA2BC50EF9A41D78	3F021FCE36B88EB0A8B1F474E3ABAB0907A7EA80	9102B3F37EB1E973511097B09D9672BE5FDF09E0D53FDCD7C9CE1146A8266F1A
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 17 20:01:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9643EDA8CDB52A216CFCCDFA33C4B920	835065792E6B0B7013CC90D98DAFC0B3FD1E1C35	D94EE2E79B7876D6A1BEF6E314E2684CFBD349723B9B4A58685619F9CCBED947
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 17 20:01:30 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	56EBA5642D502FA97BFBAE2E389094C4	83BF6CDD58CA790132DA8C69265B18967EF743F9	B17F35E8C5B38706D3432DFCDEAEA83861C3B38D62C3B8EAA61130A3ED9907EB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Apr 17 20:01:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	B9D1C8CBB89F1F8527A359499FAD759C	E262D9A7FC4414480F87BE6A2C584EDF5C43AC44	CC4FE981BD84C06BF1BC34369B6958F7B442F512E067AE91522A05D7CC6C8E18
C:\Users\user\Downloads\1898 - MNDA redline.docx (copy)	Microsoft Word 2007+	5ACE5F83792794C8B5142BB97CBEAEAF	12E2C9048450F2705069B7A8943780DB43DF335B	DFEE5F26B8078A0B8C308B02D352D1C60BBB7A8975673379119B3EC9F3720DCF
C:\Users\user\Downloads\1898 - MNDA redline.docx.crdownload	Microsoft Word 2007+	5ACE5F83792794C8B5142BB97CBEAEAF	12E2C9048450F2705069B7A8943780DB43DF335B	DFEE5F26B8078A0B8C308B02D352D1C60BBB7A8975673379119B3EC9F3720DCF
C:\Users\user\Downloads\9345ab46-40c9-4295-927f-4626982d5f02.tmp	Microsoft Word 2007+	6F2446A0C132D652190E2E105151EBE3	6410A6F2A5EB869B3A7B5873B08CE8FEB98C66F5	BFD8ED88841C7EF267EBCA0822A688C2D2EE03577CAF1574DBAEBA0BD5571AA6
C:\Users\user\Downloads\~$98 - MNDA redline.docx	data	42D5206EAF1A744970A83F3291AF618F	7265DB9188325A70F8F5EC36B2DB61FBBFA4886A	977539914E84560BD68C692DF64B869CDD4B8D983051A8AEC22AF9F050017B32
Chrome Cache Entry: 258	JSON data	83A8719F50F54A04835CF33B68E9DA68	9A5B826814B6AF5960092F0D995E5D9C6317FC49	E4C44B356156B57A483B9B8468946997FDEFFBCD600482C0B362ED9768A071FA
Chrome Cache Entry: 261	PNG image data, 64 x 64, 8-bit/color RGB, non-interlaced	126342F8A41860C7D79C56A464296C3A	5A94AF1697E9DA21CDF778C868D045101486D10F	55DCEB1B06BEC3FCDF857BB94A17BCE13A90ED7C2506CC12C2926015927E0A58
Chrome Cache Entry: 263	ASCII text, with very long lines (1843)	CEDCD87892A37313CD434B5A88B26E12	3CEBCD272C4FC7240CBC501AEEBE9BDA02095EB0	4181ECB6A14DC2939DF146EEA33E8524A7A26D15A49ADFFB30D68E6E89D13DBE
Chrome Cache Entry: 264	ASCII text, with very long lines (2124)	65ABF16FF35D7D829F4F78613063502B	2F640A30F14CA0A643A70E6A717D211B28DC9F38	933E2BE0474963E1C8E5D2FC3FEB2F19192B6696867214584632B71FE2816E1C
Chrome Cache Entry: 266	ASCII text, with very long lines (2054)	7F93E0458EF1A4A7DB3A3C75EF5C8F26	56F6636F85494D2DBB878E5214B95C12F71BA567	C2E9943FB0B73A7D2C5E3F3F4C076367903A0FE813BF652D7EE9AF81EB150AFC
Chrome Cache Entry: 267	ASCII text, with very long lines (2124)	4806664E75D652277FB923C5C84B88EE	A0689B5E6D3638994D02268BB0833C643162EE40	D1172EB8A3B3C8131A86EAD90FBA93723E5452F15AFCFA086CC2EE0FA94A894F
Chrome Cache Entry: 269	GIF image data, version 89a, 1 x 1	FC94FB0C3ED8A8F909DBC7630A0987FF	56D45F8A17F5078A20AF9962C992CA4678450765	2DFE28CBDB83F01C940DE6A88AB86200154FD772D568035AC568664E52068363
Chrome Cache Entry: 271	ASCII text, with very long lines (597)	B2CB2AB9FC37EE971DB0FC895810CD40	FF45C7FA4032D76C117705CD883AA6361189C1F9	60D5C89FA68F9CFE3F0C39DB8ABB92942181778A2C31822B5BB47B43F8DBC4DE
Chrome Cache Entry: 272	ASCII text	087964E8AC859B87529454C53FAE4F73	FFD324F4787D9D80265071B14D0EEA980327555E	8E20748D4F2809DE43DDEC5EBA1D8CBAC192079F996FC4FE88DD3A5C159D31E3
Chrome Cache Entry: 273	ASCII text, with very long lines (2114)	DFB1C20B409BCBEC4DAE300CC3651C6D	4BEA498C43ACE7B538852DC4BD713CECB370B93E	F97BC1115687033194E62AE733FADCE1BF41297F835136C10D7FE4F870643909
Chrome Cache Entry: 274	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	916C9BCCCF19525AD9D3CD1514008746	9CCCE6978D2417927B5150FFAAC22F907FF27B6E	358E814139D3ED8469B36935A071BE6696CCAD7DD9BDBFDB80C052B068AE2A50
Chrome Cache Entry: 276	JSON data	BA6AB51487CFAEF8F7E56133C34AAE37	19DF244D1D07FF43020A7B001A5B27498507CB7D	FB20FC7C1F7CFCF723EFCEE54434C316E05EE614F707502344330828FFC1CC98
Chrome Cache Entry: 279	HTML document, ASCII text	4B76202D125AE209F0E41D96158D955D	8C54E11DD37CD41629B96AE58DA02C49D5DA3092	93BE59138D7DF1C60AA18E81BE97C546C81C75CD9DE4028C67AC6FD904122CEE
Chrome Cache Entry: 280	RIFF (little-endian) data, Web/P image, VP8 encoding, 800x1035, Suserng: [none]x[none], YUV color, decoders should clamp	0E1367B58C4F6881EC483D6FCE599B9B	C2343694D39478AE015C413FB2AB7404AA03533F	BB237FDBC94FAEA6CF8318622F630721ED11883CB8BDEAEECD8E1AC9C6790632
Chrome Cache Entry: 281	ASCII text, with very long lines (65536), with no line terminators	AB9880D4FD24D6C6D2DFA0170D124508	E0161419612B52DCD9C9E91E598F38752094ECD9	2AAF8168EEB5C4271DA5F2ECCB37DCB45DA056F1235C09A4F868DC3C39E83334
Chrome Cache Entry: 282	ASCII text, with very long lines (1293)	6F41EEAB6BFEA86189236145A2ACCEDE	1E36D03AE125B4C5858C1E6BDBDC90B7247D4108	D635106D16AFD0E13D8B564D9644A027CE6C8607A917B5A1623B4E963365FEED
Chrome Cache Entry: 283	ASCII text, with very long lines (3383)	4D95791A35AE95BD11B6F6D7E880FF93	23F70202A367D2B280F2560BBEC29B1C9EEE5E66	15CE60AE9FDB72F42E3C0BAF6010B4B1C55CB5F80F22E430D21BFC1D6886EC7A
Chrome Cache Entry: 284	PNG image data, 150 x 54, 8-bit/color RGBA, non-interlaced	9D73B3AA30BCE9D8F166DE5178AE4338	D0CBC46850D8ED54625A3B2B01A2C31F37977E75	DBEF5E5530003B7233E944856C23D1437902A2D3568CDFD2BEAF2166E9CA9139
Chrome Cache Entry: 285	HTML document, Unicode text, UTF-8 text, with very long lines (1136)	FBE36EB2EECF1B90451A3A72701E49D2	AE56EA57C52D1153CEC33CEF91CF935D2D3AF14D	E8F2DED5D74C0EE5F427A20B6715E65BC79ED5C4FC67FB00D89005515C8EFE63
Chrome Cache Entry: 286	ASCII text, with very long lines (2101)	EBC011C6253382802DC7A2978837C9D4	1CABE77FE19300449F86D579E381335ACB0FBF9F	C12EFE7613336D0C82C25499079538605D1C3D25E3F07E1CD4254FB044B001FB
Chrome Cache Entry: 288	ASCII text, with no line terminators	DC121D9AAFA651E4478E6A7B7F9E6439	BB4A7A0A75261D2BF915C31A8769C60E19F790AD	34C4C1F129E42993347B4F9D091A4E8A912CF7CC6272B668A830FB0FCEC259CB
Chrome Cache Entry: 290	Web Open Font Format (Version 2), TrueType, length 34108, version 1.0	C15D33A9508923BE839D315A999AB9C7	D17F6E786A1464E13D4EC8E842F4EB121B103842	65C99D3B9F1A1B905046E30D00A97F2D4D605E565C32917E7A89A35926E04B98
Chrome Cache Entry: 292	SVG Scalable Vector Graphics image	BA7AB7044D6C6C0240C3917858948CFF	3B840B104CB3D74D5A35FBD193ACA32D27815D3E	0189F7C6ED35A7BE5E51A30366FBC54C9C9E27D2511DB44895D85A1458F83AB5
Chrome Cache Entry: 293	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0	5D4AEB4E5F5EF754E307D7FFAEF688BD	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
Chrome Cache Entry: 295	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced	BD65FC671149C1D4E8564CF15BBA82D2	7EF997ED8DAFEF307669BDE35D63060DC5D13EE1	8B58FA3D0143BCB81F4AB672F852D7061300DD5C1B174C31D31596F57EA3229A
Chrome Cache Entry: 296	ASCII text, with very long lines (825)	E300B6FD2FFA77005586D0CE16025D13	5DD6959A3AAA57CA5917B5ADDCE39512654036EC	2DB66858F602D9409F7A21B89DDCE26BD0AA338F0BD6107E4D17A5A87957657F
Chrome Cache Entry: 297	ASCII text, with no line terminators	66AB9517DCA3300C7D3DB7BAAA5B28E2	256850B49FA5D31FA769AFBF675B6CFE2FBB879D	B53C85B72C2DFED350A88FFF87ED434A4E8420CD1423067FEB31759A53DD08FA
Chrome Cache Entry: 298	JSON data	86853AB9EDF2DF2C1F305AC9AA6FE203	871108F3CFECD0A2747AE139AA30CC69384146C4	2D7A1077C89EC66D68F5B353A5031CF4F80E02C89CB8C64BBFEB989753706339
Chrome Cache Entry: 300	ASCII text, with no line terminators	EC331136E75314D2030EE013B6069921	6B7428B8B15616A67F767D42964AF94FCBE2A803	A7358DF6B7B60280F2A0D7CD5B70A9F1DFA4FCE5C31FB1A24FB2F109AF7EE977

ID:	1427643
Product:	CloudBasic
Start time:	23:01:00
Start date:	17.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://drive.google.com/file/d/12MKHqJjXiEwnV-TurNrVJ7uG6tw2aa8w/view?usp=drive_web

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://drive.google.com/file/d/12MKHqJjXiEwnV-TurNrVJ7uG6tw2aa8w/view?usp=drive_web

Overview

General Information

Detection

Signatures

Classification

Signatures

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://drive.google.com/file/d/12MKHqJjXiEwnV-TurNrVJ7uG6tw2aa8w/view?usp=drive_web