| File name: | 0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.docx |
| Full analysis: | https://app.any.run/tasks/afe3938f-fb94-4028-b38f-0559611b3955 |
| Verdict: | Malicious activity |
| Analysis date: | June 28, 2025, 18:45:24 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/msword |
| File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: Mickey, Template: Normal.dotm, Last Saved By: Challenger, Revision Number: 85, Name of Creating Application: Microsoft Office Word, Total Editing Time: 35:00, Create Time/Date: Fri Apr 24 03:18:00 2020, Last Saved Time/Date: Tue Jan 18 07:00:00 2022, Number of Pages: 1, Number of Words: 4, Number of Characters: 29, Security: 0 |
| MD5: | 3F326DA2AFFB0F7F2A4C5C95FFC660CC |
| SHA1: | F38ABB67D47A4F69536AE67AA9C6DF7287C08869 |
| SHA256: | 0D01B24F7666F9BCCF0F16EA97E41E0BC26F4C49CDFB7A4DABCC0A494B44EC9B |
| SSDEEP: | 24576:uguUgXlNGKIZyltJSR3PlRiBwlvQn5tNXw9OSTwbB3UGIpVoR1sLAXI3TYF+PXyC:unUgQWtIBlR7vQN3dBMRUXIDkCyC |
MALICIOUS
Unusual execution from MS Office
- WINWORD.EXE (PID: 3520)
SUSPICIOUS
No suspicious indicators.INFO
Reads security settings of Internet Explorer
- splwow64.exe (PID: 2632)
Creates files in the program directory
- DWWIN.EXE (PID: 6384)
Creates files or folders in the user directory
- DWWIN.EXE (PID: 6384)
Reads Microsoft Office registry keys
- DWWIN.EXE (PID: 6384)
Checks proxy server information
- DWWIN.EXE (PID: 6384)
Reads the software policy settings
- DWWIN.EXE (PID: 6384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .doc | | | Microsoft Word document (54.2) |
|---|---|---|
| .doc | | | Microsoft Word document (old ver.) (32.2) |
EXIF
FlashPix
| Identification: | Word 8.0 |
|---|---|
| LanguageCode: | English (US) |
| DocFlags: | Has picture, 1Table, ExtChar |
| System: | Windows |
| Word97: | No |
| Title: | - |
| Subject: | - |
| Author: | Mickey |
| Keywords: | - |
| Comments: | - |
| Template: | Normal.dotm |
| LastModifiedBy: | Challenger |
| Software: | Microsoft Office Word |
| CreateDate: | 2020:04:24 03:18:00 |
| ModifyDate: | 2022:01:18 07:00:00 |
| Security: | None |
| CodePage: | Windows Latin 1 (Western European) |
| Company: | - |
| CharCountWithSpaces: | 32 |
| AppVersion: | 16 |
| ScaleCrop: | No |
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| TitleOfParts: | - |
| HeadingPairs: |
|
| CompObjUserTypeLen: | 32 |
| CompObjUserType: | Microsoft Word 97-2003 Document |
| LastPrinted: | 0000:00:00 00:00:00 |
| RevisionNumber: | 85 |
| TotalEditTime: | 35 minutes |
| Words: | 4 |
| Characters: | 29 |
| Pages: | 1 |
| Paragraphs: | 1 |
| Lines: | 1 |
Total processes
144
Monitored processes
5
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2468 | "C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "D610037D-4755-4D12-8915-1C4AB36C8827" "17E90F33-672D-441A-BBF0-2CBE372F6749" "3520" | C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64. Exit code: 0 Version: 0.12.2.0 Modules
| |||||||||||||||
| 2632 | C:\WINDOWS\splwow64.exe 8192 | C:\Windows\splwow64.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Print driver host for applications Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3520 | "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\AppData\Local\Temp\0d01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.docx.doc /o "" | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 4 Version: 16.0.16026.20146 Modules
| |||||||||||||||
| 6384 | C:\WINDOWS\system32\dwwin.exe -x -s 4836 | C:\Windows\System32\DWWIN.EXE | WINWORD.EXE | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Error Reporting Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6472 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
16 773
Read events
16 428
Write events
324
Delete events
21
Modification events
| (PID) Process: | (3520) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | |o? |
Value: 7C6F3F00C00D00000400000000000000678327D55CE8DB018C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (3520) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming |
| Operation: | write | Name: | RoamingConfigurableSettings |
Value: DC00000000000000803A0900E907060006001C0012002D002200CA03000000000000000000000000201C0000201C00008051010080510100805101008051010080F4030080F4030080F403002C01000084030000805101000000000084030000805101000A0000001E0000001E000000000000000000000080510100010000000100000000000000000000000000000000000000008D2700008D2700008D2700010000000A000000805101000000300000003000000030000000000084030000805101001E0000008403000080510100050000000500000005000000 | |||
| (PID) Process: | (3520) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3520 |
| Operation: | write | Name: | 0 |
Value: 0B0E10EA3BDCF7F77A024DAE35736CA6FB32EB230046FBC1C0A7CD8BFAED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DA201C2190000C50E8908C91003783634C511C01BD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300 | |||
| (PID) Process: | (3520) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | ip? |
Value: 69703F00C00D00000200000000000000EB793CD55CE8DB01A000000001000000740000002000000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C0072006F006F0074005C006F0066006600690063006500310036005C00670065006E006B006F002E0064006C006C000000670065006E006B006F002E0063006F006E006E00650063007400310032000000 | |||
| (PID) Process: | (3520) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData |
| Operation: | write | Name: | 1 |
Value: 4D736F3A3A436865636B73756D52656769737472793A3A446174617C75696E7436345F747C2D343039303330323833383531313632333631313B456373436F6E666967526573706F6E7365446174617C7B202256657222203A2022696E7433325F747C30222C2022436F6E6649647322203A20227374643A3A77737472696E677C502D522D313039383135382D312D352C502D522D37363735372D312D322C502D522D32363134362D352D31372C502D442D32393633352D312D312C502D442D32373038372D312D392C502D522D37393638382D312D332C502D582D313035363139362D322D332C502D522D313037353533392D342D362C502D522D313036353130332D342D352C502D522D313034303537342D342D382C502D522D313032313439312D342D342C502D522D313032303733302D322D31302C502D522D313031393539312D342D342C502D522D313030343536312D342D342C64686965643636303A3434383338312C502D582D39383531382D362D392C502D582D313036313437302D322D332C502D582D313032313936352D312D372C502D582D313032313936382D322D332C502D582D37333633392D312D352C502D522D313037383237352D342D372C502D522D313037363531382D342D362C502D522D313036393531352D342D362C502D522D313032353434342D342D352C502D522D33333737342D31382D3235302C626C6F636B6564677261706869637361646170746572353A3437353839392C66653635313636373A3336313635382C37326838623835393A3238343430302C38306562633336353A3237363230352C61696764693533333A3338303137372C502D522D35383634302D312D332C502D582D37343731382D312D392C502D522D313037343034382D362D372C502D522D33353039392D322D342C6175656E613732343A3537373735332C502D522D313038313433312D382D362C502D522D313035333437382D382D352C502D522D33343834332D342D362C502D582D37313237342D312D372C502D522D33333832322D31342D36362C502D522D34353438332D31362D35332C502D522D35303731372D31382D36302C502D522D38373538372D342D342C502D522D37353036392D312D332C502D522D37353030312D312D332C502D522D36383135322D31382D32312C502D522D35323331362D31382D33372C502D522D34393136322D31382D31332C502D522D34393136312D31382D31332C502D522D34303235332D362D31392C502D522D34303235342D362D31382C502D522D33353430312D362D372C502D522D33323130372D32322D32322C636C70726F3130353A3436363736322C502D582D3130393138392D312D352C502D582D313030333535362D312D352C502D582D3130393137362D312D392C502D522D35323331352D31382D32362C502D522D32343938302D382D34382C502D522D31383237392D322D36352C63753637333A3332353936392C63756973663436343A3434363635342C63756973663833383A3333303731382C502D582D313033363930382D312D332C502D522D3131333931352D382D372C502D522D35323938322D31382D33342C502D522D35313134352D322D372C67356234623530373A3238363035352C502D582D313031323533332D312D352C502D522D313036393430352D342D382C502D522D313035303139342D33322D32312C502D522D34313034362D32322D38332C64696173793933323A3237333238302C502D582D313037373139382D322D352C502D582D313034383430382D322D352C502D582D313030343739312D312D332C502D582D38353335392D312D31332C502D582D39353537332D312D392C502D582D38393031322D312D31312C502D522D313036313635312D382D362C502D522D313034323432302D342D332C502D522D313033363136342D342D372C502D522D3131333530382D382D362C502D522D39353631362D382D352C502D522D37393631362D312D332C502D522D37373632312D312D332C502D522D37373230342D312D332C502D522D37363130372D312D332C502D522D37343333342D312D332C502D522D37343433392D312D332C502D522D37333634322D312D332C502D522D36383933382D312D362C502D522D36323837352D322D342C502D522D36303537392D322D322C502D522D36303333332D312D332C502D522D35383130372D322D322C502D522D35353734332D312D332C502D522D35313935382D312D352C502D522D33383038352D31322D392C502D522D33353338392D31382D33382C75736570726570726F63743A3337333738382C7573657632656E64706F696E7474726561746D656E743A3333333939332C646F3938353A3435313134352C6E617469766577696E333272646C3A3138363734342C646F63736C707077696E33323A3430343536382C646F6373686F6D6570616765736561726368656E61626C65616767726567617465646D7275736561726368736F757263653A3137353733392C502D522D313033343136392D31302D372C502D582D313037383537362D322D332C502D582D313035393131312D312D332C502D582D38303734322D312D31312C502D582D39333738372D332D31312C502D582D313035363137372D322D332C502D582D37393936312D312D372C502D582D313033333335362D322D332C502D582D39393034342D312D332C502D582D39363134312D312D332C502D452D32383637372D322D332C502D522D35353132322D382D382C502D522D35303235352D31302D392C502D522D34353331342D31302D31362C37393332313738393A3335353439302C336A6768393438383A3337353232372C6578706F773334343A3337353535352C65787069766F746E6F6E64657374727563746976656175746F67726F75703A3338373137392C69393268333737303A3333363131342C657861766F3833333A3234393839332C736D617274726563616C632D74726561746D656E743A3433313131322C6D6F6465726E62726F777365726F617574686469616C6F673A3230383934332C65786973723434383A3230383933342C502D582D313234303832332D312D332C502D452D33383233312D43312D342C502D522D313234353636322D31352D342C502D522D3130383334322D31342D31372C502D522D39353232352D31342D31372C502D522D39343636312D31342D31332C502D522D39343536302D31342D31322C502D522D39343138392D31342D31332C502D522D39333838322D31342D32362C502D522D36313134372D4331372D322C502D522D35343732382D31362D32332C502D522D35343639382D31362D31362C502D522D35343635382D31382D31392C502D522D34303034392D372D32392C502D522D33383330362D4331372D332C502D522D33343031392D342D332C77696E333264657669636563616E6172793A3534313438332C77696E333264657669636563616E6172793A3534313438332C502D582D313035313539312D312D352C502D582D313034373035372D312D392C502D582D313034363431342D312D372C502D582D313035383536382D312D352C502D582D3131333139312D312D31352C502D582D313034353432362D322D372C502D582D313032373535312D322D372C502D582D313036363637382D332D372C502D582D313035363938332D322D332C502D582D313035343132322D322D372C502D582D313035333332312D312D392C502D582D313030373237342D332D31372C502D582D313030373237352D31332D34352C502D582D38353839362D312D31392C502D582D313033383135362D312D332C502D582D313033373134382D322D332C502D582D313033353837312D312D332C502D582D313032383535342D312D332C502D582D313031343433312D312D372C502D582D313030353434352D312D352C502D582D313031313433352D312D332C502D582D3131363131352D312D392C502D582D3130373539352D312D352C502D582D3131363939302D312D352C502D582D38363238322D312D372C502D582D36313130322D332D31312C502D582D35313236322D312D31312C502D582D35323539312D312D31312C502D582D38383234312D312D352C502D582D39363935362D312D372C502D582D39383636352D312D392C502D582D39383635352D312D352C502D582D38343436342D312D352C502D582D38343633332D312D332C502D582D35343335382D312D372C502D582D36393330312D312D352C502D582D35333937352D332D392C502D582D36393138392D312D372C502D582D35363237342D312D392C502D582D36333133342D312D372C502D582D35383637382D312D352C502D582D35353833322D312D362C502D582D35363134372D312D352C502D582D35363135342D312D352C502D582D35343231322D312D352C502D522D313535343133302D342D352C502D522D313535343132372D342D352C502D522D313535343132322D342D362C502D522D313037343833392D382D352C502D522D313037343430372D382D352C502D522D313037343033302D382D342C502D522D313037323332362D382D362C502D522D313036323835322D382D392C502D522D313035333236392D382D352C502D522D39353038322D382D352C502D522D39333937302D382D342C502D522D36393036352D312D332C502D522D35393139332D312D332C502D522D34353630392D31342D362C502D522D34353137372D31382D32342C502D522D34353139372D322D362C502D522D34303938302D31382D31362C502D522D33393032392D352D31382C502D522D33353136352D322D372C502D522D32393830392D312D372C502D522D32363936382D332D392C502D522D31383432352D382D36322C502D522D31383432362D352D33302C502D522D31383432342D342D33342C502D442D313130393930372D342D31322C686E6C6162656C3A3630333036372C68316135683133323A3334353930312C37343261623432323A3434393633312C646A656366383539743A3336363731382C66696973633834343A3431393233322C66686F70747275653A3434343539352C37313567683537333A3338303334362C67343568623831303A3335333936332C66303366633135743A3334343233392C766563746F72636C6F636B656E61626C65643A3333343933342C64656661756C74746F6F6462666F726E657766696C653A3334383232352C686E656469746F72733A3531383233342C356D696E31306D696E5F31306D696E6772616365706572696F643A3531373738392C66696C69733436363A3733363730322C68617070793038323332322D313A3339383331332C63366567663438343A3333343231392C6D6F7665636C6F636B64617461746F657068656D6572616C73746F7265666F726F63733A3239353138352C68617070793037323132322D313A3335363237332C62657474657262726561646372756D62733A3439303833362C666173617263686976616C3A3333303738332C66697365733932313A3234313639392C6669616C6C3139383A3439383838372C66696261633936373A3630383537312C66696F63733230303A3434393439382C66696973773136313A3331373630342C66697465733231373A3136313436382C66697265663334363A33343532352C66696D6F633538393A32383937392C66696361633132343A3230373735372C66697061723833393A3139313036322C6772617068617069666F726F64656E61626C6564726F6C6C6F75743A3339343135362C6F6E656472697665636F6E76657267656E6365656E6C69676874656E6564726F6C6C6F75743A3135393033382C66696F6D693239333A3131383038312C6669736B693232353A3439383837342C6669656E613934373A33303633352C66697368653935373A36343036322C66697374613430373A36313032372C6669656E613930333A36353934342C66696461763236353A35353033352C66696361633834313A34393636342C6669656E613431353A33383738302C6669656E613439303A33343138312C72656D6F74656D6F76656465766963653A34323530302C6669656E613237363A34313030342C6669656E613338313A34393939372C502D582D313032303335332D312D372C502D522D313233363533302D382D322C502D522D313037383537312D31382D382C502D522D313034363334302D31382D31352C502D522D313033333537392D31382D31312C502D522D313033343131382D31382D32302C502D522D313032363335342D31382D32312C502D522D313031383335392D322D322C502D522D36313730372D32382D32322C502D522D35333534352D342D352C502D522D34393733362D362D32322C502D522D33303038352D312D392C502D522D32353135372D382D31342C502D522D32343336332D362D31332C502D522D31393831342D312D36322C502D522D31393031322D312D35372C666C656E613231343A3532363832342C666C656E613231343A3532363832342C502D582D313032343434382D312D332C30356269353338323A3430333333312C502D582D313035363435362D322D31312C502D582D313031383536342D332D392C502D582D313032303539372D312D372C502D582D313035313531322D312D332C502D582D313030393332392D312D372C502D582D313030363237392D312D372C502D582D313031313434322D312D31312C502D582D313031393633322D312D332C502D582D313031353535342D312D352C502D582D313031303331342D312D352C502D582D3130383336342D312D332C502D582D37373734322D312D352C502D582D38313035362D31312D32352C502D582D38363339352D312D352C502D582D38343332312D312D352C502D582D37333633372D312D392C502D582D35303232302D312D332C502D582D34393733302D312D332C502D522D313034333838352D362D362C502D522D313031343435322D382D382C502D522D36343834312D32322D31352C502D522D36333130302D32382D31302C502D522D35323033382D32382D31382C502D522D33363638332D31382D34302C502D522D34303939302D31322D31352C502D522D33353937322D322D352C502D522D33353537322D322D332C502D522D33323734342D31342D31352C502D522D33323734312D33322D31362C502D522D32383735312D322D32302C69693435373531323A3434393137382C6272616B696E67736B703A3338383633312C6772616C743139333A3431313231352C3832626A333335353A3337333930362C6772616C743232323A3334353534372C67726869643532383A3436303939362C67726766783930363A3432333930352C67723233343A3433343331362C6772736B693435353A3537383535332C67723331323A3631333334312C67723337303A3538333038372C677264656C3334373A3132373632382C6772656E613331363A3631393236312C67727376673936303A3435323639302C67727573653434343A3132343039312C6772616C6C3436343A3133343338362C67727573653438383A3537303335382C677269636F3430363A31393737372C502D582D3130353838392D312D352C32346139333336353A3134373734372C502D522D35303432392D31382D382C502D522D33363533392D31302D352C502D522D32343038342D312D31362C502D582D313535393535332D312D332C502D582D313034393232352D312D332C502D582D313033333336302D312D352C502D582D313033333335352D312D332C502D582D313031313137332D312D352C502D522D313537363838342D31332D31342C502D522D313434353932342D382D362C502D522D313130313038312D382D352C502D522D313037373631302D382D352C502D522D313032363534322D382D342C502D522D313032313732352D31382D35302C502D522D35333432312D32382D31342C502D522D34303437352D32382D32382C502D522D33353938352D31342D32332C502D522D33323030342D322D352C37613961633834303A3736333637322C39373935633332303A3335393832302C32646262623537393A3238363232352C69383364613438393A3338383033382C69643539323A3238383731342C502D582D38383033352D312D352C6C616C616E3233313A3134303738312C502D582D313237363530392D312D352C502D582D313035313131312D322D352C502D582D313031393632392D332D31362C502D582D38353734312D312D31372C502D582D313030363733362D332D32312C502D582D3131333530312D322D382C502D582D3130333738362D312D332C502D582D37303037382D32332D34342C502D522D313238303432352D31332D31372C502D522D37303730332D312D352C502D522D36313234382D31382D372C502D522D35313939352D31382D32382C502D522D34323839362D37342D3134312C502D522D34303231322D34322D37332C69306437363937303A3539383638392C68696263313339393A3334343439352C646F63756D656E747461736B756977696E6D61637778703A3533323435372C68617070793036303732312D313A3233323730342C6D756C74696C6576656C6C697374737570706F72743A3331373735382C6C656D69633530353A3230373133372C6C656973753732343A3631303738342C696D616765737570706F72747374616765323A3332323037342C502D582D313034343531342D322D372C502D582D313036313732332D322D352C502D582D313037363235322D312D362C502D582D313034393634392D322D352C502D582D313034373731352D322D372C502D582D313031343139352D342D31392C502D582D313032363133312D322D352C502D582D313032373931332D312D31312C502D582D313031373734352D382D31342C502D582D38303736372D312D33372C502D582D3130383634332D322D372C502D582D313030393034382D312D392C502D582D39353630352D322D332C502D522D313035383637352D382D342C502D522D313033363537362D342D342C502D522D39383131302D342D352C502D522D37393936332D312D322C502D522D36303831362D31302D31392C502D522D35313736342D312D342C502D522D34323339322D322D342C502D522D33393037332D312D352C70697063687962726964743A3333363236352C326766396A3631383A3336323439302C396A6734633839333A3335373434342C34676839653230353A3438333737382C363135316A3631333A3434373631392C67643868383735353A3331373939302C6A6A3035303832373A3234353136322C61306537323236393A3332323039342C37673633363833323A3236383639382C65396268363531353A3234343439392C37366534673937353A3332343937392C6C693533303A3537313939352C67306864303232313A3435303335352C502D522D313132333337362D31302D31342C502D522D313030393835352D31322D31342C502D522D39383835362D31382D34382C502D522D313036313233392D382D362C502D522D34333438392D33302D31352C502D522D33383431302D31322D32332C502D582D313239313234362D322D332C502D582D313232393336302D332D31352C502D582D39323634342D312D392C502D582D37373133362D312D32372C502D582D313032373135362D312D372C502D582D313031323935302D342D372C502D582D313037343533362D312D332C502D582D313036363534362D312D31332C502D582D38393837382D312D352C502D582D313035313633372D322D352C502D582D313035303636352D332D372C502D582D313033303234352D312D352C502D582D313034 | |||
| (PID) Process: | (3520) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData |
| Operation: | write | Name: | ChunkCount |
Value: uint64_t|0 | |||
| (PID) Process: | (3520) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData |
| Operation: | write | Name: | 1.1 |
Value: 313735362D322D352C502D582D313033393334372D322D31312C502D582D313033393537362D322D332C502D582D313031393538312D312D332C502D582D313031343837382D312D392C502D582D313031333031362D312D332C502D582D313030363137342D312D352C502D582D3131383332302D312D352C502D582D38333832342D312D332C502D582D35313735392D312D332C502D522D313536353432382D322D332C502D522D313234393337302D342D352C502D522D313039343131352D342D342C502D522D313038393139322D362D352C502D522D313031373036362D342D352C502D522D3131373934312D342D342C502D522D35393533342D312D332C502D522D35343535372D312D332C502D522D33373630332D332D362C63683337313137393A3630303339362C656E61626C656D616E6966657374786D6C7369676E6174757265766572696669636174696F6E72656C696162696C697479323A3535323631322C656E61626C656D616E6966657374786D6C7369676E6174757265766572696669636174696F6E3A3237343939302C6578706572696D656E746174696F6E7364787072656C6F61643A37373732392C31323568373933353A3335313834372C6F65736574757064656C697665727966616C6C6261636B333A3434353037352C39623864613935353A3434393932342C62656C6F776F70656E646976696465723A3534323535372C6F6575696C3832303A3332363132342C33633867643634383A3436343939302C6F65656E61626C656F73666964656E746974796D616E616765723A3434393931392C34633668643237393A3436333732312C67623038643735323A3239323132322C64336769653536343A3238333835332C39396631643631363A3238333835342C6F656D69633633393A3339373735332C6F653539383A3339313531302C6F65616C6C3431393A3431343537312C6F65616C6C3834333A3337353838372C6F65656E613535353A3432303338362C6F65636F6F3133333A3336313137322C6F656D61633335383A32303530322C502D522D37313336302D31382D31392C502D582D37363535352D312D332C6F6E6D61703336363A38313734302C502D442D313437363534302D312D332C502D442D313234383335302D312D332C502D442D313233363437322D332D342C502D442D313232303436342D372D352C502D442D313033303630312D332D332C502D442D313135373731372D312D332C502D442D313134393433362D312D332C502D442D313133313332392D362D372C502D442D313131303935362D342D332C502D442D313038343536352D332D332C502D442D313037353534332D312D332C502D442D313037333031342D352D332C502D442D313033373534312D372D362C502D442D313033333339312D322D342C502D442D313033313533372D312D332C502D442D313033313533362D312D332C502D442D313033313533342D342D332C502D442D313033313533322D312D332C502D442D313033313532392D312D332C502D442D313033313532372D312D332C502D442D313033313532352D312D332C502D442D313033313532312D322D332C502D442D313033313532302D322D332C502D442D313033313531322D312D332C502D442D313033313531302D312D332C502D442D313033313530392D312D332C502D442D313033313530382D312D332C502D442D313033313439332D312D332C502D442D313033313438362D312D332C502D442D313033313438342D312D332C502D442D313033313438322D312D332C502D442D313033313437392D312D332C502D442D313033313436302D312D332C502D442D313033313035302D342D332C502D442D313033313032322D312D332C502D442D313033313031382D312D332C502D442D313033313031322D312D332C502D442D313033303936342D312D332C502D442D313033303936332D312D332C502D442D313033303935362D312D332C502D442D313033303932382D312D332C502D442D313033303932372D312D332C502D442D313033303932362D312D332C502D442D313033303932332D322D332C502D442D313033303932322D322D332C502D442D313033303932302D322D332C502D442D313033303931382D322D332C502D442D313033303931362D322D332C502D442D313033303931342D322D332C502D442D313033303931322D322D332C502D442D313033303931302D322D332C502D442D313033303930382D322D332C502D442D313033303930362D322D332C502D442D313033303930342D322D332C502D442D313033303930322D322D332C502D442D313033303930302D322D332C502D442D313033303839382D322D332C502D442D313033303839362D322D332C502D442D313033303839332D322D332C502D442D313033303839312D322D332C502D442D313033303838392D322D332C502D442D313033303838372D322D332C502D442D313033303838352D322D332C502D442D313033303838332D322D332C502D442D313033303838312D322D332C502D442D313033303837392D322D332C502D442D313033303837372D322D332C502D442D313033303837362D322D332C502D442D313033303837352D322D332C502D442D313033303837332D332D332C502D442D313033303837322D322D332C502D442D313033303837312D322D332C502D442D313033303837302D322D332C502D442D313033303836392D322D332C502D442D313033303836382D322D332C502D442D313033303836372D322D332C502D442D313033303836362D322D332C502D442D313033303836352D322D332C502D442D313033303836342D322D332C502D442D313033303836322D322D332C502D442D313033303836302D322D332C502D442D313033303835382D322D332C502D442D313033303835362D322D332C502D442D313033303835342D322D332C502D442D313033303835322D322D332C502D442D313033303835302D322D332C502D442D313033303834382D322D332C502D442D313033303834372D322D332C502D442D313033303834362D322D332C502D442D313033303834342D322D332C502D442D313033303834322D322D332C502D442D313033303834312D322D332C502D442D313033303834302D322D332C502D442D313033303833382D322D332C502D442D313033303833362D322D332C502D442D313033303833342D322D332C502D442D313033303833322D322D332C502D442D313033303833302D322D332C502D442D313033303832382D322D332C502D442D313033303832362D322D332C502D442D313033303832342D322D332C502D442D313033303832322D322D332C502D442D313033303831392D322D332C502D442D313033303831362D322D332C502D442D313033303831322D322D332C502D442D313033303831312D322D332C502D442D313033303831302D322D332C502D442D313033303830382D322D332C502D442D313033303830362D322D332C502D442D313033303830332D322D332C502D442D313033303830312D322D332C502D442D313033303830302D322D332C502D442D313033303739392D322D332C502D442D313033303739382D322D332C502D442D313033303739372D322D332C502D442D313033303739362D322D332C502D442D313033303739352D322D332C502D442D313033303739342D322D332C502D442D313033303739332D322D332C502D442D313033303739322D322D332C502D442D313033303739312D322D332C502D442D313033303738392D322D332C502D442D313033303738372D322D332C502D442D313033303738362D322D332C502D442D313033303738352D322D332C502D442D313033303738332D322D332C502D442D313033303738312D322D332C502D442D313033303737392D322D332C502D442D313033303737372D322D332C502D442D313033303737352D322D332C502D442D313033303737332D322D332C502D442D313033303737312D322D332C502D442D313033303736392D322D332C502D442D313033303736372D322D332C502D442D313033303736352D322D332C502D442D313033303736332D322D332C502D442D313033303736312D322D332C502D442D313033303736302D322D332C502D442D313033303735392D322D332C502D442D313033303735382D322D332C502D442D313033303735372D322D332C502D442D313033303735362D322D332C502D442D313033303735352D322D332C502D442D313033303735332D322D332C502D442D313033303735312D322D332C502D442D313033303734392D322D332C502D442D313033303734372D322D332C502D442D313033303734352D322D332C502D442D313033303734332D322D332C502D442D313033303734302D332D332C502D442D313033303733382D322D332C502D442D313033303733372D322D332C502D442D313033303733362D322D332C502D442D313033303733342D322D332C502D442D313033303733322D322D332C502D442D313033303733302D322D332C502D442D313033303732382D322D332C502D442D313033303732362D322D332C502D442D313033303732342D322D332C502D442D313033303732322D322D332C502D442D313033303731392D322D332C502D442D313033303731372D322D332C502D442D313033303731352D322D332C502D442D313033303731332D322D332C502D442D313033303731322D322D332C502D442D313033303731312D322D332C502D442D313033303730392D322D332C502D442D313033303730382D322D332C502D442D313033303730372D322D332C502D442D313033303730362D322D332C502D442D313033303730352D322D332C502D442D313033303730342D322D332C502D442D313033303730332D322D332C502D442D313033303730322D322D332C502D442D313033303730312D322D332C502D442D313033303639392D322D332C502D442D313033303639372D322D332C502D442D313033303639362D322D332C502D442D313033303639352D322D332C502D442D313033303639332D322D332C502D442D313033303639312D322D332C502D442D313033303639302D322D332C502D442D313033303638392D322D332C502D442D313033303638372D322D332C502D442D313033303638352D322D332C502D442D313033303638332D322D332C502D442D313033303638312D322D332C502D442D313033303637392D322D332C502D442D313033303637372D322D332C502D442D313033303637352D322D332C502D442D313033303637332D322D332C502D442D313033303637312D322D332C502D442D313033303636392D322D332C502D442D313033303636382D322D332C502D442D313033303636352D322D332C502D442D313033303636342D322D332C502D442D313033303636332D322D332C502D442D313033303636312D322D332C502D442D313033303635392D322D332C502D442D313033303635362D312D332C502D442D313033303634392D312D332C502D442D313033303634322D31322D382C502D442D313033303633372D372D332C502D442D313033303633362D372D332C502D442D313033303633352D372D332C502D442D313033303633342D312D332C502D442D313033303633332D312D332C502D442D313033303632382D322D342C502D442D313033303539312D312D332C502D442D313033303536312D312D332C502D442D313033303534372D322D342C502D442D313033303534352D312D332C502D442D313033303534322D312D332C502D442D313033303438352D312D332C502D442D313033303231392D332D352C502D442D313033303231382D332D352C502D442D313032393532312D352D342C502D442D313032393531372D312D332C502D442D313032393531352D312D332C502D442D313032393531342D312D332C502D442D313032393531332D312D332C502D442D313032393531322D312D332C502D442D313032393531312D312D332C502D442D313032393531302D312D332C502D442D313032393530392D312D332C502D442D313032393530382D312D332C502D442D313032393530362D312D332C502D442D313032393530352D312D332C502D442D313032393434342D312D332C502D442D313032393433302D312D332C502D442D313032393432382D312D332C502D442D313032393432362D312D332C502D442D313032393431362D312D332C502D442D313032393431342D312D332C502D442D313032393337312D312D332C502D442D313032393333382D312D332C502D442D313032393239332D322D332C502D442D313032393238392D31362D342C502D442D313032393237362D312D332C502D442D313032393237352D312D332C502D442D313032393237322D312D332C502D442D313032393237302D312D332C502D442D313032393236372D362D342C502D442D313032393235302D312D332C502D442D313032393234332D312D332C502D442D313032393233382D312D332C502D442D313032393233372D312D332C502D442D313032393233342D312D332C502D442D313032393230352D312D332C502D442D313032393230332D312D332C502D442D313032393134382D332D342C502D442D313032393133372D312D332C502D442D313032393039372D322D332C502D442D313032393039362D322D332C502D442D313032393039332D322D332C502D442D313032393039322D322D332C502D442D313032393039312D322D332C502D442D313032393039302D322D332C502D442D313032393038362D312D332C502D442D313032393038332D31322D332C502D442D313032393038322D31322D332C502D442D313032393038302D382D352C502D442D313032393037382D312D332C502D442D313032393037372D312D332C502D442D313032393037352D372D342C502D442D313032393036352D312D332C502D442D313032393036332D31322D332C502D442D313032383937372D312D332C502D442D313032383937342D312D332C502D442D313032383935362D332D342C502D442D313032383931342D312D332C502D442D313032383837342D312D332C502D442D313032313733302D322D342C502D442D313032313732392D322D342C502D442D313032313032302D322D342C502D442D313032313031392D322D342C502D442D313032313031372D322D342C502D442D313032313031362D322D342C502D442D313032313031352D352D372C502D442D313032313031342D322D342C502D442D313032313031332D322D342C502D442D313032313031322D322D342C502D442D313032313031312D322D342C502D442D313032313031302D322D342C502D442D313032313030382D322D342C502D582D313034333136302D312D31332C64393467633535363A3439303439302C502D582D313035323931302D312D332C502D582D313032303532392D312D332C502D522D313031363533392D382D352C502D522D38323437332D312D342C502D522D35363631382D312D332C31393167353730353A3433333136302C7065696E703639343A3234363834392C502D582D313030363439392D312D31332C502D582D3130383433372D312D332C502D582D39393534392D312D352C502D582D38323337372D312D332C502D522D33353531332D342D342C502D522D33333639362D312D352C502D522D33333536392D312D392C502D522D33313938372D312D362C7065656E3335333A3430373634392C7065656E613738383A3139333433302C74756C69707376323A3137373838352C656E61626C65616C776179736F6E726566726573683A3232343838382C502D522D33393931322D312D322C502D522D35303338302D31382D31382C502D582D3131353136362D312D332C70753436393A3433343439332C502D582D313037303034312D322D332C502D582D313032373334312D322D352C502D582D313034383034362D312D332C502D582D313034353236392D312D352C502D582D313034313335352D312D352C502D582D313034353035392D312D332C502D582D313034343238362D312D352C502D582D313030303536392D362D31392C502D582D313033383038312D322D352C502D582D313031383131372D312D352C502D582D313030393537362D332D31352C502D582D313032313138372D312D332C502D582D313031353532362D312D352C502D582D3131373734302D312D332C502D522D313533313035352D382D322C502D522D313038383737372D382D352C502D522D313038313636382D382D342C502D522D313037353133352D382D352C502D522D313037343337322D342D352C502D522D313037343037372D342D352C502D522D313036343135392D382D382C502D522D313034303537392D32362D31372C502D522D313033383632392D382D352C502D522D36333333382D31382D31312C502D522D35383235312D31382D31322C502D522D33333733372D312D342C6A663868373136353A3638373839372C6A636765643937303A3336353634322C38663966623737313A3339363938322C38623061313234353A3435343833312C66393935643630373A3334363839312C36366568313330383A3334353931382C33666831623238333A3338333636362C68693536673538353A3336383031332C65303931363830323A3439303739312C6A757374696669636174696F6E6F746865727769746873656375726974797761726E696E673A3435313233342C7365636C703230303A3432303334332C33363832333632363A3532363433392C736566673833383A3334363836392C677261706869637366696C74657265787472616C6F636B646F776E3A3439363034382C502D582D37383534352D312D352C502D582D37313933392D332D31322C502D582D313031373631362D312D372C502D582D313031343232372D312D332C502D582D3131363238362D312D332C502D582D3131363038352D312D332C502D582D3131363037382D312D352C502D582D3131363036352D312D332C502D582D37343233342D312D31312C502D452D32393636322D322D332C502D522D36313335382D4331372D32322C502D522D313034393532362D322D382C502D522D313034393533352D322D382C502D522D32393330332D322D32302C502D522D32393033312D322D32302C502D522D33363331362D362D32302C502D522D33303239302D362D32332C502D522D32383938322D332D31382C502D522D36333934372D31382D322C502D522D36333335372D31382D31392C502D522D36313336312D31382D32362C502D522D36313336302D31382D32312C502D522D34383633342D322D31352C502D522D34373234322D31382D31312C502D522D34353537392D31382D382C502D522D34323531322D312D332C502D522D34303532312D322D31332C502D522D33383730342D342D362C502D522D33383231322D322D31312C502D522D33353934362D362D342C502D522D33353834362D382D342C502D522D33353430372D342D332C502D522D33333133342D322D31372C502D522D33303239322D342D392C502D522D32383634342D312D342C502D522D32343033372D312D372C502D522D32333434352D332D372C502D522D32333337302D322D392C502D522D32333433342D332D372C502D522D31383531332D312D33302C502D442D33343630392D312D332C502D442D33343235302D312D332C73686175743539363A3639383734352C73686564693835393A3534303336382C7368776F723635333A3334393437312C736176656173706466616C7474657874736D6172746172743A3639373830332C73686772613439383A32 | |||
| (PID) Process: | (3520) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData |
| Operation: | write | Name: | ChunkCount |
Value: uint64_t|1 | |||
| (PID) Process: | (3520) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData |
| Operation: | write | Name: | 1.2 |
Value: 32373730372C73686772613630313A3138343038302C73686772613335353A3230383034392C73686772613530323A3138393932342C73686772613734373A38363637372C502D582D313130373037302D322D332C502D582D313038333432372D322D352C502D582D313034313336382D332D31302C502D582D313034323339332D332D372C502D582D313032343737362D322D372C502D582D313032343034372D312D362C502D582D313030303332322D312D372C502D522D36353031312D312D332C502D522D35303534312D322D372C66366562623730383A3433343833322C6A683861623434373A3338303633332C65386A69683932303A3434323136302C6C697374656E696E676F6E6465766963653A3332343439342C61686938323431313A3434323139322C38356863643939303A3432353033352C73683335303A3332393432382C502D582D37313536382D312D352C502D522D36393233322D33382D31322C502D522D32363434322D312D382C502D522D32333638312D322D372C502D442D33323530322D322D332C502D442D33323530312D322D332C502D442D33323431352D322D332C7461656E613537363A39303236352C502D582D313032373136332D322D31312C502D582D313033383432302D322D352C502D582D3130393636322D312D31372C502D582D3130373131392D312D332C502D582D38303033382D312D352C502D522D36343531332D31382D31312C502D522D35313931362D38342D33312C502D442D313136303234302D312D362C502D442D313136303134312D312D342C6F74656C657564623A3332363832362C38686262343533383A3338363637302C74656172693335323A3233333737342C74657072693632383A3433393731302C74656576653835303A3132303534302C502D522D313631363239302D312D332C502D522D313538353838372D342D362C502D522D313535313135332D312D332C502D522D313233363935332D382D31322C502D522D313534393032312D312D332C502D522D313036333231302D372D31332C502D522D313534373631372D312D332C502D522D313532383734302D312D332C502D522D313532363837352D31352D332C502D522D313532363837342D31352D332C502D522D313532363837332D31352D332C502D522D313532363837322D31352D332C502D522D313532363837302D31352D332C502D522D313532363836392D31352D332C502D522D313532363836382D31352D332C502D522D313532363836372D31352D332C502D522D313532363836362D31352D332C502D522D313532363836322D31352D332C502D522D313437393637342D332D352C502D522D33383234382D32322D32382C502D522D313431373335342D332D352C502D522D313431373335322D332D352C502D522D313431363735332D372D392C502D522D313431363734362D362D382C502D522D313431353138332D33322D342C502D522D313431353138322D33322D342C502D522D313431353138312D33322D342C502D522D313431353138302D33322D342C502D522D313431353137392D33322D342C502D522D313238303138362D312D332C502D522D313236373038342D322D362C502D522D313236313931382D322D342C502D522D313234353830342D34382D352C502D522D313234353239362D342D362C502D522D313138333633392D36322D362C502D522D313138333633312D36322D362C502D522D313138333632382D36322D362C502D522D313135373537302D322D342C502D522D313134303939382D37352D372C502D522D313134303939372D37352D372C502D522D313134303939362D37352D372C502D522D313134303939352D37352D372C502D522D313134303939342D37352D372C502D522D313134303939332D37352D372C502D522D313134303939322D37352D372C502D522D313134303939312D37352D372C502D522D313134303939302D37352D372C502D522D313134303938392D37352D372C502D522D313133323832312D322D342C502D522D313131393031332D312D332C502D522D313130363736382D38362D382C502D522D313130363736372D38362D382C502D522D313130363736362D38362D382C502D522D313130363736352D38362D382C502D522D313130363736342D38362D382C502D522D313130363736332D38362D382C502D522D313130363736322D38362D382C502D522D313130333237372D312D332C502D522D313039383739362D312D332C502D522D313039343434352D312D332C502D522D313035383634332D352D392C502D522D313038303431322D312D332C502D522D313038303130312D39362D392C502D522D313038303130302D39362D392C502D522D313038303039392D39362D392C502D522D313038303039372D39362D392C502D522D313038303039362D39362D392C502D522D313038303039352D39362D392C502D522D313038303039342D39362D392C502D522D313038303039332D39362D392C502D522D313038303039322D39362D392C502D522D313038303039312D39362D392C502D522D313038303039302D39362D392C502D522D313038303038392D39362D392C502D522D313038303038382D3131332D31302C502D522D313037333239312D342D362C502D522D313037313736312D312D332C502D522D313036393736392D322D342C502D522D313036393230332D312D332C502D522D313036383131352D312D332C502D522D313032343037362D342D382C502D522D313032343037342D342D382C502D522D313035393332392D3130342D31302C502D522D313035393332382D3132312D31312C502D522D313035393332362D3130342D31302C502D522D313035393332352D3130342D31302C502D522D313035393332342D3130342D31302C502D522D313035393332332D3132312D31312C502D522D313035393332322D3132312D31312C502D522D313035393332312D38372D392C502D522D313035393332302D3130342D31302C502D522D313035393331392D3130342D31302C502D522D313035393331382D3130342D31302C502D522D313035393331372D3130342D31302C502D522D313035393331362D3130342D31302C502D522D313035393331352D3130342D31302C502D522D313035393331342D3130342D31302C502D522D313035393331322D3130342D31302C502D522D313035393331312D3130342D31302C502D522D313035393331302D3130342D31302C502D522D313035393330392D3130342D31302C502D522D313035393330382D3130342D31302C502D522D313035393330372D3130342D31302C502D522D313035393330362D3130342D31302C502D522D313035393330352D3130342D31302C502D522D313035393330342D3130342D31302C502D522D313035393330332D3132312D31312C502D522D313035393330322D3130342D31302C502D522D313035393330312D3132312D31312C502D522D313035393330302D3130342D31302C502D522D313035393239392D3132312D31312C502D522D313035393239382D3130342D31302C502D522D313035393239372D3132312D31312C502D522D313035393239362D3130342D31302C502D522D313035393239352D3130342D31302C502D522D313035393239342D3130342D31302C502D522D313035393239332D3130342D31302C502D522D313035393239322D37312D382C502D522D313035393239312D3132312D31312C502D522D313035393239302D3130342D31302C502D522D313035393238392D3130342D31302C502D522D313035393238382D3130342D31302C502D522D313035393238372D3130342D31302C502D522D313035393238362D3130342D31302C502D522D313035393238352D3130342D31302C502D522D313035393238342D3130342D31302C502D522D313035393238332D3130342D31302C502D522D313035393238322D3130342D31302C502D522D313035393238312D3130342D31302C502D522D313035393238302D3130342D31302C502D522D313035393237392D3130342D31302C502D522D313035393237382D3130342D31302C502D522D313035393237372D3130342D31302C502D522D313035393237362D3130342D31302C502D522D313035393237352D3130342D31302C502D522D313035393237342D3130342D31302C502D522D313035393237332D3130342D31302C502D522D313035393237322D3130342D31302C502D522D313035393237312D3130342D31302C502D522D313035393237302D3130342D31302C502D522D313035393236392D3130342D31302C502D522D313035393236382D3130342D31302C502D522D313035393236372D3130342D31302C502D522D313035393236362D3130342D31302C502D522D313035393236352D3130342D31302C502D522D313035393236342D3130342D31302C502D522D313035393236332D3130342D31302C502D522D313035393236322D3130342D31302C502D522D313035393236312D3130342D31302C502D522D313035393236302D3130342D31302C502D522D313035393235392D3130342D31302C502D522D313035393235382D3130342D31302C502D522D313035393235372D3130342D31302C502D522D313035393235362D3130342D31302C502D522D313035393235352D3130342D31302C502D522D313035393235342D3130342D31302C502D522D313035393235332D3130342D31302C502D522D313035393235322D3130342D31302C502D522D313035393235312D3130342D31302C502D522D313035393235302D3130342D31302C502D522D313035393234392D3130342D31302C502D522D313035393234382D3130342D31302C502D522D313035393234372D3130342D31302C502D522D313035393234352D3130342D31302C502D522D313035393234342D3132312D31312C502D522D313035393234332D3130342D31302C502D522D313035393234322D3130342D31302C502D522D313035393234312D3130342D31302C502D522D313035393134362D3132302D31322C502D522D313035393035332D3131322D31312C502D522D313035383938382D3132302D31322C502D522D313035383938372D3131322D31312C502D522D313035383938362D3131322D31312C502D522D313035383938352D3132382D31332C502D522D313035383938342D3132382D31332C502D522D313035383938332D3133362D31342C502D522D313035383938322D3133372D31332C502D522D313035383938312D3131322D31312C502D522D313035383938302D3131322D31312C502D522D313035383937392D3132382D31332C502D522D313035383937382D3132382D31332C502D522D313035383937372D3134342D31352C502D522D313035383937362D3133372D31332C502D522D313035383937352D3133372D31332C502D522D313035383937342D3133372D31332C502D522D313035383937332D3133372D31332C502D522D313035383937322D3133372D31332C502D522D313035383937312D3133372D31332C502D522D313035383936392D3133372D31332C502D522D313035383936382D3133372D31332C502D522D313035383936372D3133362D31342C502D522D313035383936362D3133362D31342C502D522D313035383936352D3131322D31312C502D522D313035383936342D3131322D31312C502D522D313035383936332D3131322D31312C502D522D313035383936322D3131322D31312C502D522D313035383936312D3131322D31312C502D522D313035383936302D3131322D31312C502D522D313035383935392D3131322D31312C502D522D313035383935382D3132302D31322C502D522D313035383935372D3131322D31312C502D522D313035383935362D3132392D31322C502D522D313035383935352D3132392D31322C502D522D313035383935342D3132392D31322C502D522D313035383935332D3132392D31322C502D522D313035383935322D3132392D31322C502D522D313035383935312D3132392D31322C502D522D313035383935302D3132392D31322C502D522D313035383934392D3132392D31322C502D522D313035383934382D3132392D31322C502D522D313035383934372D3132392D31322C502D522D313035383934362D3132392D31322C502D522D313035383934352D3132392D31322C502D522D313035383934342D3132302D31322C502D522D313035383934332D3132302D31322C502D522D313035383934322D3133362D31342C502D522D313035383934312D3132302D31322C502D522D313035383934302D3132302D31322C502D522D313035383933392D3132302D31322C502D522D313035383933382D3132302D31322C502D522D313035383933372D3132302D31322C502D522D313035383933362D3132302D31322C502D522D313035383933352D3132302D31322C502D522D313034393137352D312D332C502D522D313034353131382D322D342C502D522D313034343430382D312D332C502D522D313033373838372D312D332C502D522D313033373837392D312D332C502D522D313033363239332D312D332C502D522D313033363239322D312D332C502D522D313033363238392D322D342C502D522D313033363238382D312D332C502D522D313033363036382D322D342C502D522D313033363033392D322D342C502D522D313033353933332D322D342C502D522D313033353134392D322D342C502D522D313033333831372D312D332C502D522D313033333632342D322D342C502D522D313032383535302D322D342C502D522D313032383136382D312D332C502D522D313032373533352D332D352C502D522D313032343638302D342D362C502D522D313032343037312D322D342C502D522D313031303339332D312D332C502D522D313030363839362D312D332C502D522D313030363839342D312D332C502D522D313030363536322D322D342C502D522D313030303036312D322D342C502D522D3131353934362D332D352C502D522D3131313638322D312D332C502D522D3130353733312D33362D33382C502D522D3130343433352D31332D31352C502D522D3130303239342D312D332C502D522D39393633332D312D332C502D522D39383932392D322D342C502D522D39383932362D312D332C502D522D39383235302D312D332C502D522D39343535362D322D342C502D522D39333037372D312D332C502D522D39303839352D332D352C502D522D38383330392D322D342C502D522D38363131382D312D332C502D522D38333430382D322D342C502D522D38303531372D372D392C502D522D37383835322D332D352C502D522D37383332352D332D352C502D522D37383131322D342D362C502D522D37363931382D322D342C502D522D37363732312D312D332C502D522D37363235332D312D332C502D522D37353434302D322D342C502D522D37353433362D312D332C502D522D37353433342D312D332C502D522D37353433332D312D332C502D522D37343532382D342D362C502D522D37323434392D372D31302C502D522D36383036392D322D342C502D522D36363937352D312D332C502D522D36353536372D312D332C502D522D36303630322D332D352C502D522D35383437312D322D342C502D522D35383039332D312D332C502D522D35333330392D312D332C502D522D35323633332D312D332C502D522D35323137312D322D342C502D522D35313932312D382D31302C502D522D35313235382D382D31302C502D522D35303735322D322D342C502D522D35303638312D322D342C502D522D35303539392D342D362C502D522D35303539362D342D382C502D522D35303538352D31382D32302C502D522D35303535332D312D332C502D522D34393539372D332D352C502D522D34393435382D322D342C502D522D34383533302D372D392C502D522D34373934382D312D342C502D522D34363538302D332D352C502D522D34363438342D31302D31322C502D522D34363132322D312D332C502D522D34353835382D322D342C502D522D34343935302D312D332C502D522D34333936362D322D342C502D522D34333530322D31392D32312C502D522D34333233382D332D352C502D522D34333138382D362D382C502D522D34313433302D312D332C502D522D34303735312D382D31302C502D522D34303237332D342D362C502D522D33393233382D352D372C502D522D33383837382D322D342C502D522D33383638322D332D352C502D522D33373538382D322D342C502D522D33343335352D382D31302C502D522D32363236362D342D392C502D522D32363833342D332D382C502D522D32343636322D31362D32322C502D522D32373437392D362D31312C502D522D32363035362D372D31352C502D522D32373030362D372D31322C502D522D33323139312D392D31312C502D522D33303333382D332D372C502D522D33303137382D37392D38312C502D522D33303035332D382D31302C502D522D32373435382D312D352C502D522D32353832322D31362D31392C502D522D32353038332D362D392C502D522D32343639302D34342D34382C502D522D32343638392D322D352C502D522D32343636362D322D352C502D522D32343636332D362D31312C502D522D32343635392D372D31302C502D522D32333736322D352D382C502D522D32333734342D372D392C502D522D32333733392D372D392C502D522D32333733362D31342D31372C502D522D32333733342D372D392C502D522D32333733302D32312D32342C502D522D32333732332D31302D31322C502D442D33323538392D312D332C502D442D33323538382D312D332C502D442D33323533342D312D332C502D442D33323532342D312D332C502D442D33323531382D312D332C502D442D33323531322D312D332C502D442D33323530392D312D332C502D442D33323530342D312D332C502D442D33323438352D312D342C502D442D33323438342D312D342C502D442D33323430352D312D332C502D582D313032353438352D312D352C502D582D313031343937322D322D372C502D582D313033373435392D322D352C502D582D313033363938372D322D332C502D582D313033363137332D322D332C502D582D313033333537332D312D352C502D582D313033313539322D312D332C502D582D313033303033352D322D332C502D582D313032383334312D332D31362C502D582D313031373032392D322D352C502D582D313032353231332D312D332C502D582D3131373832392D332D31332C502D582D313032303536382D312D332C502D582D313032303338302D312D352C502D582D313031353238332D322D372C502D582D313030343337332D312D352C502D582D39333430372D312D352C502D582D313031323937392D322D352C502D582D313030333137372D322D352C502D582D38373438342D372D31372C502D582D3131313733302D312D352C502D582D3130383438312D312D352C502D582D3130393235302D322D332C502D582D37373839302D312D352C502D582D37393633352D312D372C502D582D37393333352D352D32372C502D582D37333137312D312D352C502D582D37333137392D312D372C502D582D37313939392D332D31312C502D582D37313831392D312D332C502D522D313038373134312D342D372C502D522D313037353139392D362D342C502D522D313031333933302D342D352C502D522D36303537312D31382D33302C502D522D35333038352D31382D31332C502D522D35313331382D31382D382C502D522D34373034362D32362D32342C502D522D34373630312D31382D31332C502D522D | |||
| (PID) Process: | (3520) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData |
| Operation: | write | Name: | ChunkCount |
Value: uint64_t|2 | |||
Executable files
33
Suspicious files
129
Text files
17
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3520 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres | binary | |
MD5:13F4E3A901E667395F436353E2915A6E | SHA256:BA8429599AB48E1B1253C071BACFF2FC0F692310C7E6629CF5E3156B32AEB5F0 | |||
| 6384 | DWWIN.EXE | C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_WINWORD.EXE_f7ebf39cc5f491a9fe3a7843ec498e5cf7bcf7_00000000_4c3f16ff-0d40-4ddf-bcca-009e1eff8b03\Report.wer | — | |
MD5:— | SHA256:— | |||
| 6384 | DWWIN.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FE | binary | |
MD5:0F7B8F6A846AA9CA52FA562DDDCDB5ED | SHA256:AFF90E65A81289B80D1FCC5E71B3D88E5D1AAFE22CE358EB6E28A56D1845263D | |||
| 3520 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin | text | |
MD5:1DC79773D63D5187C0577C964408C78C | SHA256:D753A7D231D3CA5D503EA1994B808F4E43421E9879CA6C691D7668B560C9BC64 | |||
| 3520 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\127BD86C-C362-4E7D-9566-2E0300AE5AB4 | xml | |
MD5:D8E83B81034371E3AD31369C20A613FA | SHA256:81701ABCE6F3E90C17E9BD88D3C163F2B89EDEAF832D817DB7EBE0E31E26AEA4 | |||
| 3520 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres | binary | |
MD5:E84A03783EC0F4820B81B1CA37FEB9D1 | SHA256:53E87FE57C94CB986EB519E36C8AFFD6E6F4ACD8EBB761EE320C244B769D2C99 | |||
| 3520 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E479362F.wmf | binary | |
MD5:FE97064665EBE15DD56DDE1EDD2DF969 | SHA256:B7F0B658E073B348819687BEF0A3971CEAB0F29C4C405EB650936F32420CD0D8 | |||
| 3520 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin | text | |
MD5:CC90D669144261B198DEAD45AA266572 | SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899 | |||
| 3520 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$01b24f7666f9bccf0f16ea97e41e0bc26f4c49cdfb7a4dabcc0a494b44ec9b.docx.doc | binary | |
MD5:3050F6337A39ED2643FF6B972F92372A | SHA256:F8BBF264DFCDE96591AD1AE66E78056F4E323313E613C1D55E78C051A1004821 | |||
| 3520 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\30557A64.wmf | binary | |
MD5:FE97064665EBE15DD56DDE1EDD2DF969 | SHA256:B7F0B658E073B348819687BEF0A3971CEAB0F29C4C405EB650936F32420CD0D8 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
71
DNS requests
25
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6384 | DWWIN.EXE | GET | 200 | 23.216.77.31:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.216.77.31:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1936 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
3520 | WINWORD.EXE | GET | 200 | 2.16.253.202:80 | http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl | unknown | — | — | whitelisted |
3520 | WINWORD.EXE | GET | 200 | 23.216.77.31:80 | http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl | unknown | — | — | whitelisted |
3520 | WINWORD.EXE | GET | 200 | 23.216.77.31:80 | http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl | unknown | — | — | whitelisted |
3520 | WINWORD.EXE | GET | 200 | 23.216.77.31:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl | unknown | — | — | whitelisted |
1936 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.216.77.31:80 | http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5172 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1268 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3520 | WINWORD.EXE | 52.109.28.46:443 | officeclient.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | GB | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3520 | WINWORD.EXE | 52.123.129.14:443 | ecs.office.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3520 | WINWORD.EXE | 23.48.23.26:443 | omex.cdn.office.net | Akamai International B.V. | DE | whitelisted |
3520 | WINWORD.EXE | 52.111.231.13:443 | messaging.lifecycle.office.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6384 | DWWIN.EXE | 20.189.173.22:443 | watson.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
officeclient.microsoft.com |
| whitelisted |
ecs.office.com |
| whitelisted |
omex.cdn.office.net |
| whitelisted |
messaging.lifecycle.office.com |
| whitelisted |
watson.events.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
Process | Message |
|---|---|
WINWORD.EXE | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|
WINWORD.EXE | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|
WINWORD.EXE | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|