File name:

Contract01-167220360-2044.docx

Full analysis: https://app.any.run/tasks/85ce2f4c-d16b-4146-8650-a1d0852efa55
Verdict: Malicious activity
Analysis date: April 29, 2025, 08:55:21
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
qrcode
phishing
phish-url
qr-redirect
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

20AAECD746C32A7D91B88885A6787103

SHA1:

06576CF8C0B01135561DB6A8E53D46D52840982A

SHA256:

35489D51C561D28E399D884943E2010945B679E96A06F824E9528FBABE54647C

SSDEEP:

1536:F3Vm/DkoJRW0vj/Yf/KIHFj98lxOok9PtBibR2sK29Ur5nR:FFm/DjRW07/dIHDME19eksKGi7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • QR code contains URL with email

      • WINWORD.EXE (PID: 7448)

  • SUSPICIOUS

    • Detected QR code with redirect chain

      • WINWORD.EXE (PID: 7448)

  • INFO

    • Manual execution by a user

      • SnippingTool.exe (PID: 4408)
      • firefox.exe (PID: 1240)

    • Application launched itself

      • firefox.exe (PID: 1240)
      • firefox.exe (PID: 7632)

    • Reads security settings of Internet Explorer

      • SnippingTool.exe (PID: 4408)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:04:29 04:00:50
ZipCRC: 0x107e5b0e
ZipCompressedSize: 355
ZipUncompressedSize: 1424
ZipFileName: [Content_Types].xml

XML

TotalEditTime: -
Pages: -
Words: -
Characters: -
Application: Microsoft Office Word
DocSecurity: None
Lines: -
Paragraphs: -
ScaleCrop: No
Company: -
LinksUpToDate: No
CharactersWithSpaces: -
SharedDoc: No
HyperlinksChanged: No
AppVersion: 12
RevisionNumber: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
38
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe sppextcomobj.exe no specs slui.exe ai.exe no specs snippingtool.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs slui.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5812 -childID 10 -isForBrowser -prefsHandle 5324 -prefMapHandle 4044 -prefsLen 31555 -prefMapSize 244583 -jsInitHandle 1520 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {902d0171-0b46-490b-8681-8186ab6732e4} 7632 "\\.\pipe\gecko-crash-server-pipe.7632" 1f9dfeb5a10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
444"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5592 -childID 11 -isForBrowser -prefsHandle 5596 -prefMapHandle 4620 -prefsLen 31555 -prefMapSize 244583 -jsInitHandle 1520 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {526c9bbe-6826-44d9-8a65-d79d715061f9} 7632 "\\.\pipe\gecko-crash-server-pipe.7632" 1f9dfeb5d90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
812"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2172 -parentBuildID 20240213221259 -prefsHandle 2164 -prefMapHandle 2152 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9720a25d-8f2a-48c2-83f7-b372c6da84fa} 7632 "\\.\pipe\gecko-crash-server-pipe.7632" 1f9c8681910 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1004"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7348 -childID 25 -isForBrowser -prefsHandle 5796 -prefMapHandle 5308 -prefsLen 31691 -prefMapSize 244583 -jsInitHandle 1520 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7bf9b1c4-8f28-44e0-a277-7055996616cf} 7632 "\\.\pipe\gecko-crash-server-pipe.7632" 1f9db429a10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140_1.dll
1240"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\windows\system32\crypt32.dll
1300"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5992 -childID 14 -isForBrowser -prefsHandle 7260 -prefMapHandle 7176 -prefsLen 31555 -prefMapSize 244583 -jsInitHandle 1520 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4f2b8a5-3105-4e7e-997f-b611dd3938fc} 7632 "\\.\pipe\gecko-crash-server-pipe.7632" 1f9db429bd0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
2108"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1912 -parentBuildID 20240213221259 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ec081c5-03f2-4380-811b-d3dba31f2b47} 7632 "\\.\pipe\gecko-crash-server-pipe.7632" 1f9d54eeb10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140_1.dll
3300"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2764 -childID 2 -isForBrowser -prefsHandle 2292 -prefMapHandle 2620 -prefsLen 36588 -prefMapSize 244583 -jsInitHandle 1520 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee222127-d28d-41b9-8736-c08fe7fc7547} 7632 "\\.\pipe\gecko-crash-server-pipe.7632" 1f9dc7d8850 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3332"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5496 -childID 22 -isForBrowser -prefsHandle 7508 -prefMapHandle 2688 -prefsLen 31691 -prefMapSize 244583 -jsInitHandle 1520 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c1b4b0a-3572-4626-a748-96a1fe66df73} 7632 "\\.\pipe\gecko-crash-server-pipe.7632" 1f9db429bd0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140_1.dll
3480"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6712 -childID 23 -isForBrowser -prefsHandle 6832 -prefMapHandle 6844 -prefsLen 31691 -prefMapSize 244583 -jsInitHandle 1520 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb49fe25-8d64-4553-9b79-bfad00141b9a} 7632 "\\.\pipe\gecko-crash-server-pipe.7632" 1f9db429d90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1.dll
Total events
61 848
Read events
61 252
Write events
553
Delete events
43

Modification events

(PID) Process:(7448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems
Operation:writeName:1w-
Value:
31772D00181D00000600000001000000A25B8174E4B8DB019200000002000000820000000400000063003A005C00750073006500720073005C00610064006D0069006E005C0061007000700064006100740061005C006C006F00630061006C005C00740065006D0070005C0063006F006E0074007200610063007400300031002D003100360037003200320030003300360030002D0032003000340034002E0064006F0063007800000000000000
(PID) Process:(7448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\AddinClassifier
Operation:writeName:9a3e8255d7eb9a1a1f397175007c13fc
Value:
v2:1;0;1745916928
(PID) Process:(7448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word
Operation:writeName:Expires
Value:
int64_t|0
(PID) Process:(7448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word
Operation:delete valueName:ConfigIds
Value:
P-D-29635-1-1,P-D-27087-1-9,P-D-29719-1-1,P-D-29718-1-1,P-D-29593-1-1,P-X-46178-1-3,P-X-45046-7-9,P-E-38713-2-4,P-E-38485-C1-6,P-E-38231-C1-4,P-R-45365-2-4,P-R-41741-18-10,P-R-38306-C17-3,P-R-35717-4-26,P-R-34019-4-3,P-D-37560-2-4,extes787:4008,exnop721cf:3280,P-E-29662-2-3,P-R-46411-1-3,P-R-46410-1-3,P-R-46111-1-4,P-R-45967-1-2,P-R-45966-1-2,P-R-45965-1-2,P-R-45964-1-5,P-R-45117-4-3,P-R-44092-2-3,P-R-44090-2-3,P-R-42512-1-2,P-R-42555-2-2,P-R-42557-2-3,P-R-42418-2-3,P-R-42417-2-2,P-R-40543-18-13,P-R-40169-8-9,P-R-39747-2-3,P-R-39746-2-3,P-R-39588-2-4,P-R-39582-2-5,P-R-39574-1-3,P-R-39568-1-3,P-R-39554-1-3,P-R-39522-1-4,P-R-39521-1-3,P-R-39467-2-4,P-R-39120-18-25,P-R-38704-4-6,P-R-37389-18-16,P-R-32143-5-17,P-R-36664-4-3,P-R-36385-18-10,P-R-35973-2-3,P-R-35946-6-3,P-R-35846-8-3,P-R-35476-2-3,P-R-35407-4-3,P-R-35234-14-6,P-R-35150-2-3,P-R-35129-2-3,P-R-35101-14-3,P-R-35056-4-3,P-R-35049-4-5,P-R-34904-2-3,P-R-34889-8-3,P-R-34044-2-3,P-R-33911-4-4,P-R-33824-1-4,P-R-33786-18-5,P-R-33718-6-4,P-R-33678-2-4,P-R-33459-1-4,P-R-33197-4-7,P-R-33176-4-17,P-R-33137-1-3,P-R-33136-2-6,P-R-32252-C39-56,P-R-32240-1-7,P-R-31921-C19-59,P-R-30649-1-5,P-R-30509-18-10,P-R-30293-4-7,P-R-29310-2-5,P-R-29301-4-10,P-R-29230-2-8,P-R-29224-5-11,P-R-29207-3-7,P-R-29208-2-4,P-R-29304-2-5,P-R-29279-2-8,P-R-29204-2-5,P-R-29056-2-4,P-R-29054-2-5,P-R-29025-9-26,P-R-28999-3-9,P-R-29000-4-7,P-R-28992-8-9,P-R-28988-8-11,P-R-28984-8-11,P-R-28644-1-4,P-R-25886-3-5,P-R-24037-1-6,P-R-23445-3-6,P-R-23410-1-5,P-R-23370-2-6,P-R-23485-1-6,P-R-23434-3-6,P-R-23403-3-6,P-R-20642-2-8,P-R-20640-1-7,P-R-19608-2-12,P-R-19841-2-8,P-R-18513-1-30,P-R-19024-9-58,P-D-34699-4-3,P-D-34697-2-3,P-D-34683-6-3,P-D-34675-1-3,P-D-34673-1-3,P-D-34654-1-3,P-D-34638-1-3,P-D-34609-1-3,P-D-34607-3-3,P-D-34587-3-3,P-D-34281-1-3,P-D-34278-4-3,P-D-34266-1-3,P-D-34263-1-3,P-D-34262-1-3,P-D-34260-1-3,P-D-34258-2-3,P-D-34250-1-3,P-D-34247-5-3,P-D-34225-1-3,P-D-32487-1-3,P-D-32471-3-3,P-D-32465-1-3,P-D-32459-2-3,P-D-32458-5-3,P-D-32403-1-3,P-D-30203-1-2,P-D-30202-1-3,P-D-30201-1-2,P-D-27615-1-3,P-D-27593-1-4,P-R-44990-1-4,P-R-43597-1-3,P-R-42114-18-8,P-R-42643-18-9,P-R-39888-1-3,P-R-39119-18-31,P-R-38346-2-3,P-R-37340-12-25,P-R-35848-14-14,P-R-33661-C17-6,P-R-33115-18-21,P-R-32298-18-11,P-R-25893-1-6,P-R-25867-1-5,P-R-25316-1-6,P-R-23348-1-7,P-X-45362-1-3,P-X-42197-2-3,P-E-44774-C1-6,P-E-29661-C1-3,P-R-46701-1-3,P-R-46309-1-4,P-R-46205-1-3,P-R-45832-1-4,P-R-45584-16-7,P-R-45452-2-3,P-R-45269-1-5,P-R-44738-16-3,P-R-44068-C15-4,P-R-44058-1-3,P-R-43957-C15-3,P-R-43718-16-4,P-R-42866-16-6,P-R-42865-16-8,P-R-42702-16-10,P-R-42794-2-2,P-R-42732-16-10,P-R-42547-16-12,P-R-42356-16-8,P-R-38028-C17-32,P-R-41047-16-19,P-R-41391-1-3,P-R-41370-18-10,P-R-40791-C15-7,P-R-37391-20-19,P-R-38531-16-16,P-R-39129-2-6,P-R-29934-6-17,P-R-36893-16-15,P-R-37769-16-19,P-R-38732-16-10,P-R-37487-16-14,P-R-37773-18-33,P-R-36381-16-14,P-R-36130-54-7,P-R-36102-8-3,P-R-35880-16-20,P-R-35006-4-3,P-R-34998-6-3,P-R-34958-2-3,P-R-34091-12-13,P-R-33918-1-5,P-R-33895-1-4,P-R-33883-2-4,P-R-33875-4-4,P-R-33738-2-11,P-R-32032-3-4,P-R-32026-12-7,P-R-31600-5-4,P-R-30442-20-52,P-R-27730-2-10,P-R-26653-1-4,P-R-26642-1-4,P-D-34604-1-3,P-D-32551-1-3,P-D-32550-1-3,P-D-32472-6-3,wotes819:3296,wotes907cf:1474,P-R-33555-1-4,P-R-46377-10-5,P-R-38462-1-11,P-R-30262-9-40,P-R-36932-2-11,P-R-46186-1-4,P-R-44014-1-6,P-R-43910-1-3,P-R-43909-1-3,P-R-43644-C5-10,P-R-42448-1-3,P-R-39912-1-2,P-R-39488-C3-7,P-R-39283-4-8,P-R-36539-10-4,P-R-24084-1-12,P-R-46100-20-5,P-R-45558-2-6,P-R-45546-1-5,P-R-37550-20-7,P-R-32186-C27-24,P-R-34049-2-3,P-D-41781-1-2,P-D-41780-1-2,P-D-40447-1-3,P-D-37672-1-2,P-D-36846-1-3,P-D-36843-1-4,P-R-39146-14-11,P-R-39147-14-9,P-R-28546-6-9,P-R-28165-6-25,P-R-24390-5-8,P-R-20518-9-39,P-R-19046-2-18,P-R-18975-1-29,P-R-18279-2-64,P-D-34200-4-4,P-R-39113-22-29,P-R-35209-8-3,P-D-34664-3-3,P-R-45538-1-4,P-R-45368-1-4,P-R-44875-6-5,P-R-43085-18-8,P-R-42578-1-3,P-R-42482-1-3,P-R-41670-18-10,P-R-40990-12-12,P-R-39594-18-13,P-R-39333-C17-20,P-R-39336-18-21,P-R-35387-18-13,P-R-37272-18-10,P-R-37469-8-9,P-R-36616-14-9,P-R-35972-2-3,P-R-35968-2-3,P-R-35572-2-3,P-R-33215-18-17,P-R-32653-18-18,P-R-31352-12-17,P-R-28751-2-19,P-R-20580-8-34,P-D-34495-2-9,P-D-34269-2-3,P-E-28677-2-3,P-R-44907-5-7,P-R-41912-1-2,P-R-41699-C15-18,P-R-38702-1-3,P-E-42700-C1-4,P-R-46706-2-2,P-R-46558-2-3,P-R-45837-1-4,P-R-40106-C17-13,P-R-45197-2-6,P-R-37650-1-5,P-R-43723-2-5,P-R-39825-22-28,P-R-42920-1-8,P-R-42797-2-4,P-R-42457-18-4,P-R-32234-25-67,P-R-41994-9-19,P-R-41742-C17-22,P-R-41640-7-20,P-R-41538-2-2,P-R-40648-2-7,P-R-39029-5-17,P-R-38835-18-39,P-R-36315-10-28,P-R-38026-1-5,P-R-37492-18-8,P-R-37467-18-42,P-R-36646-6-7,P-R-36624-10-5,P-R-36575-4-5,P-R-36478-2-3,P-R-36310-4-3,P-R-35945-10-3,P-R-35436-22-13,P-R-35417-16-7,P-R-35340-16-10,P-R-35143-4-3,P-R-35043-10-5,P-R-35008-18-4,P-R-34955-16-9,P-R-34817-8-7,P-R-34748-18-27,P-R-34331-4-8,P-R-34079-12-12,P-R-33996-18-20,P-R-33994-10-5,P-R-33597-12-8,P-R-33553-4-4,P-R-32261-1-4,P-R-32239-1-5,P-R-32236-1-8,P-R-31384-1-4,P-R-29809-1-6,P-R-28464-12-11,P-R-28276-1-4,P-R-27861-1-4,P-R-26968-3-8,P-R-46232-2-2,P-R-46170-2-2,P-R-41916-C17-14,P-R-40405-1-5,P-R-39876-18-22,P-R-38085-12-9,P-R-37017-18-23,P-R-37374-9-22,P-R-36450-18-17,P-R-35907-6-3,P-R-35850-10-4,P-R-35849-4-5,P-R-35389-18-34,P-R-33530-14-9,P-R-32169-3-4,P-R-30530-8-16,P-R-30067-18-7,P-R-18744-6-21,P-D-34659-8-3,P-D-34259-2-3,P-D-34257-9-3,P-D-34239-1-3,P-R-46080-2-3,P-R-38953-1-9,P-R-36551-18-14,P-R-31346-2-6,P-R-43355-C17-5,P-R-42383-18-8,P-R-40152-18-5,P-R-39981-18-7,P-R-39509-10-13,P-R-39328-18-8,P-R-39121-18-9,P-R-38296-18-11,P-R-38167-18-12,P-R-37675-8-25,P-R-37667-12-16,P-R-35869-18-9,P-R-35665-12-3,P-R-35337-16-5,P-R-35203-4-3,P-R-33916-1-4,P-R-33741-4-4,P-R-33739-1-4,P-R-33580-C7-7,P-R-33575-1-5,P-R-33560-4-4,P-R-32042-2-13,P-R-31966-3-10,P-R-31960-7-4,P-R-31949-4-4,P-R-31948-8-7,P-R-31946-3-4,P-R-20347-4-21,P-R-46404-2-2,P-R-40475-18-13,P-R-37668-C25-43,P-R-35891-18-3,P-R-32433-18-16,P-R-32004-2-4,P-R-38410-18-22,P-R-37609-18-12,P-R-20504-8-18,P-R-43232-1-15,P-R-42696-18-10,P-R-35680-8-4,P-R-32106-7-27,P-R-30085-1-8,P-R-30011-15-17,P-R-29138-38-73,P-R-29315-36-59,P-R-28033-14-54,P-R-25157-8-12,P-R-19898-1-20,P-R-19814-1-53,P-R-19262-2-12,P-R-35109-4-3,P-R-23378-2-6,P-R-45595-2-4,P-R-41433-18-25,P-R-40253-6-18,P-R-40254-6-17,P-R-35412-4-3,P-R-32107-22-21,P-R-32704-1-4,P-R-26006-3-5,P-R-34130-6-3,P-R-44921-2-2,P-R-40407-18-5,P-R-37603-3-6,P-R-36477-6-3,P-R-35887-18-9,P-R-35489-16-7,P-R-35454-16-5,P-R-35073-4-3,P-R-33746-2-6,P-R-40464-18-5,P-R-39227-18-8,P-R-37589-1-3,P-R-42510-1-3,P-R-41441-10-18,P-R-39073-1-5,P-R-38719-10-29,P-R-35442-2-6,P-R-28753-1-9,P-R-27070-1-4,P-R-26515-4-14,P-R-45019-1-4,P-R-32703-10-10,P-R-33970-10-7,P-R-33969-10-7,P-R-45554-1-3,P-R-44835-1-3,P-R-33737-1-4,P-R-35623-2-3,P-R-26442-1-7,P-R-23681-2-7,P-D-32502-2-3,P-D-32501-2-3,P-D-32415-2-3,P-R-46845-1-3,P-R-46844-1-3,P-R-46841-1-3,P-R-46580-3-5,P-R-46484-1-3,P-R-46233-1-3,P-R-46122-1-3,P-R-46121-3-5,P-R-46068-2-4,P-R-46067-2-4,P-R-46066-2-4,P-R-46065-2-4,P-R-46064-2-4,P-R-46062-2-4,P-R-46060-2-4,P-R-46059-2-4,P-R-46058-2-4,P-R-46056-2-4,P-R-46055-2-4,P-R-46054-2-4,P-R-46041-2-4,P-R-45865-2-6,P-R-45858-1-3,P-R-45241-1-3,P-R-44950-1-3,P-R-43966-1-3,P-R-43502-5-7,P-R-43238-3-5,P-R-43188-2-4,P-R-43094-8-10,P-R-42949-1-3,P-R-42635-1-3,P-R-42122-1-3,P-R-38248-7-11,P-R-41430-1-3,P-R-41033-2-4,P-R-40892-1-3,P-R-39375-2-6,P-R-40751-3-5,P-R-40273-3-5,P-R-39238-1-3,P-R-39045-1-3,P-R-38878-1-3,P-R-38682-2-4,P-R-37588-1-3,P-R-35713-2-4,P-R-35675-1-3,P-R-35606-3-5,P-R-35373-1-3,P-R-34355-4-6,P-R-23737-6-9,P-R-26211-3-9,P-R-26266-3-8,P-R-23733-14-19,P-R-26834-2-7,P-R-24662-12-18,P-R-27205-3-10,P-R-27299-2-7,P-R-27479-5-10,P-R-26056-5-13,P-R-27006-6-11,P-R-23722-17-22,P-R-32191-3-5,P-R-30338-1-5,P-R-30178-9-11,P-R-30053-2-4,P-R-27458-1-5,P-R-26722-6-8,P-R-25822-7-10,P-R-25653-1-4,P-R-25269-6-9,P-R-25083-5-8,P-R-24690-10-14,P-R-24689-1-4,P-R-24666-1-4,P-R-24663-3-8,P-R-24659-6-9,P-R-24658-3-6,P-R-23762-5-7,P-R-23747-6-8,P-R-23746-13-16,P-R-23744-6-8,P-R-23743-8-10,P-R-23741-7-9,P-R-23740-7-9,P-R-23739-6-8,P-R-23738-9-11,P-R-23736-11-13,P-R-23734-7-9,P-R-23732-7-9,P-R-23731-7-9,P-R-23730-15-18,P-R-23729-7-9,P-R-23728-7-9,P-R-23725-6-8,P-R-23723-6-8,P-R-23718-6-8,P-R-23717-7-9,P-R-23715-7-9,P-R-23714-8-10,P-R-23713-7-9,P-D-32589-1-3,P-D-32588-1-3,P-D-32534-1-3,P-D-32524-1-3,P-D-32518-1-3,P-D-32512-1-3,P-D-32509-1-3,P-D-32504-1-3,P-D-32486-1-3,P-D-32485-1-3,P-D-32484-1-3,P-D-32405-1-3,P-R-29928-1-13,P-R-26544-7-57,P-R-40220-1-4,P-R-35099-2-3,P-E-29576-C1-7,P-E-29325-2-4,P-R-40586-18-25,P-R-40732-18-13,P-R-39143-18-20,P-D-40316-9-3,P-R-35513-4-3,P-R-33892-1-4,P-R-33696-1-4,P-R-33569-1-6,P-R-31987-1-4,P-R-33504-1-4,P-R-42379-2-2,P-R-42378-2-2
(PID) Process:(7448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word
Operation:delete valueName:ETag
Value:
(PID) Process:(7448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
Operation:writeName:1
Value:
4D736F3A3A436865636B73756D52656769737472793A3A446174617C75696E7436345F747C2D363137363131383431313231343836333339383B456373436F6E666967526573706F6E7365446174617C7B202256657222203A2022696E7433325F747C30222C2022436F6E6649647322203A20227374643A3A77737472696E677C502D522D313039383135382D312D352C502D522D37363735372D312D322C502D522D32363134362D352D31372C502D442D32393633352D312D312C502D442D32373038372D312D392C502D522D37393638382D312D332C502D582D313035363139362D322D332C502D522D313037353533392D342D362C502D522D313036353130332D342D352C502D522D313034303537342D342D382C502D522D313032313439312D342D342C502D522D313032303733302D322D31302C502D522D313031393539312D342D342C502D522D313030343536312D342D342C64686965643636303A3434383338312C502D582D39383531382D362D392C502D582D313036313437302D322D332C502D582D313032313936352D312D372C502D582D313032313936382D322D332C502D582D37333633392D312D352C502D522D313037383237352D342D372C502D522D313037363531382D342D362C502D522D313036393531352D342D362C502D522D313032353434342D342D352C502D522D33333737342D31382D3235302C626C6F636B6564677261706869637361646170746572353A3437353839392C66653635313636373A3336313635382C37326838623835393A3238343430302C38306562633336353A3237363230352C61696764693533333A3338303137372C502D522D35383634302D312D332C502D582D37343731382D312D392C502D522D313037343034382D362D372C502D522D33353039392D322D342C6175656E613732343A3537373735332C502D522D313038313433312D382D362C502D522D313035333437382D382D352C502D522D33343834332D342D362C502D582D37313237342D312D372C502D522D33333832322D31342D36362C502D522D34353438332D31362D35332C502D522D35303731372D31382D36302C502D522D38373538372D342D342C502D522D37353036392D312D332C502D522D37353030312D312D332C502D522D36383135322D31382D32312C502D522D35323331362D31382D33372C502D522D34393136322D31382D31332C502D522D34393136312D31382D31332C502D522D34303235332D362D31392C502D522D34303235342D362D31382C502D522D33353430312D362D372C502D522D33323130372D32322D32322C636C70726F3130353A3436363736322C502D582D3130393138392D312D352C502D582D313030333535362D312D352C502D582D3130393137362D312D392C502D522D35323331352D31382D32362C502D522D32343938302D382D34382C502D522D31383237392D322D36352C63753637333A3332353936392C63756973663436343A3434363635342C63756973663833383A3333303731382C502D582D313033363930382D312D332C502D522D3131333931352D382D372C502D522D35323938322D31382D33342C502D522D35313134352D322D372C67356234623530373A3238363035352C502D582D313031323533332D312D352C502D522D313036393430352D342D382C502D522D313035303139342D33322D32312C502D522D34313034362D32322D38312C64696173793933323A3237333238302C502D582D313037373139382D322D352C502D582D313034383430382D322D352C502D582D313030343739312D312D332C502D582D38353335392D312D31332C502D582D39353537332D312D392C502D582D38393031322D312D31312C502D522D313036313635312D382D362C502D522D313034323432302D342D332C502D522D313033363136342D342D372C502D522D3131333530382D382D362C502D522D39353631362D382D352C502D522D37393631362D312D332C502D522D37373632312D312D332C502D522D37373230342D312D332C502D522D37363130372D312D332C502D522D37343333342D312D332C502D522D37343433392D312D332C502D522D37333634322D312D332C502D522D36383933382D312D362C502D522D36323837352D322D342C502D522D36303537392D322D322C502D522D36303333332D312D332C502D522D35383130372D322D322C502D522D35353734332D312D332C502D522D35313935382D312D352C502D522D33383038352D31322D392C502D522D33353338392D31382D33382C75736570726570726F63743A3337333738382C7573657632656E64706F696E7474726561746D656E743A3333333939332C646F3938353A3435313134352C6E617469766577696E333272646C3A3138363734342C646F63736C707077696E33323A3430343536382C646F6373686F6D6570616765736561726368656E61626C65616767726567617465646D7275736561726368736F757263653A3137353733392C502D522D313033343136392D31302D372C502D582D313037383537362D322D332C502D582D313035393131312D312D332C502D582D38303734322D312D31312C502D582D39333738372D332D31312C502D582D313035363137372D322D332C502D582D37393936312D312D372C502D582D313033333335362D322D332C502D582D39393034342D312D332C502D582D39363134312D312D332C502D452D32383637372D322D332C502D522D35353132322D382D382C502D522D35303235352D31302D392C502D522D34353331342D31302D31362C37393332313738393A3335353439302C336A6768393438383A3337353232372C6578706F773334343A3337353535352C65787069766F746E6F6E64657374727563746976656175746F67726F75703A3338373137392C69393268333737303A3333363131342C657861766F3833333A3234393839332C736D617274726563616C632D74726561746D656E743A3433313131322C6D6F6465726E62726F777365726F617574686469616C6F673A3230383934332C65786973723434383A3230383933342C502D582D313234303832332D312D332C502D452D33383233312D43312D342C502D522D313234353636322D31352D342C502D522D3130383334322D31342D31372C502D522D39353232352D31342D31372C502D522D39343636312D31342D31332C502D522D39343536302D31342D31322C502D522D39343138392D31342D31332C502D522D39333838322D31342D32362C502D522D36313134372D4331372D322C502D522D35343732382D31362D32332C502D522D35343639382D31362D31362C502D522D35343635382D31382D31392C502D522D34303034392D372D32392C502D522D33383330362D4331372D332C502D522D33343031392D342D332C77696E333264657669636563616E6172793A3534313438332C77696E333264657669636563616E6172793A3534313438332C502D582D313035313539312D312D352C502D582D313034373035372D312D392C502D582D313034363431342D312D372C502D582D313035383536382D312D352C502D582D3131333139312D312D31352C502D582D313034353432362D322D372C502D582D313032373535312D322D372C502D582D313036363637382D332D372C502D582D313035363938332D322D332C502D582D313035343132322D322D372C502D582D313035333332312D312D392C502D582D313030373237342D332D31372C502D582D313030373237352D31332D34352C502D582D38353839362D312D31392C502D582D313033383135362D312D332C502D582D313033373134382D322D332C502D582D313033353837312D312D332C502D582D313032383535342D312D332C502D582D313031343433312D312D372C502D582D313030353434352D312D352C502D582D313031313433352D312D332C502D582D3131363131352D312D392C502D582D3130373539352D312D352C502D582D3131363939302D312D352C502D582D38363238322D312D372C502D582D36313130322D332D31312C502D582D35313236322D312D31312C502D582D35323539312D312D31312C502D582D38383234312D312D352C502D582D39363935362D312D372C502D582D39383636352D312D392C502D582D39383635352D312D352C502D582D38343436342D312D352C502D582D38343633332D312D332C502D582D35343335382D312D372C502D582D36393330312D312D352C502D582D35333937352D332D392C502D582D36393138392D312D372C502D582D35363237342D312D392C502D582D36333133342D312D372C502D582D35383637382D312D352C502D582D35353833322D312D362C502D582D35363134372D312D352C502D582D35363135342D312D352C502D582D35343231322D312D352C502D522D313535343133302D342D352C502D522D313535343132372D342D352C502D522D313535343132322D342D362C502D522D313037343833392D382D352C502D522D313037343430372D382D352C502D522D313037343033302D382D342C502D522D313037323332362D382D362C502D522D313036323835322D382D392C502D522D313035333236392D382D352C502D522D39353038322D382D352C502D522D39333937302D382D342C502D522D36393036352D312D332C502D522D35393139332D312D332C502D522D34353630392D31342D362C502D522D34353137372D31382D32342C502D522D34353139372D322D362C502D522D34303938302D31382D31362C502D522D33393032392D352D31382C502D522D33353136352D322D372C502D522D32393830392D312D372C502D522D32363936382D332D392C502D522D31383432352D382D36322C502D522D31383432362D352D33302C502D522D31383432342D342D33342C502D442D313130393930372D342D31322C686E6C6162656C3A3630333036372C68316135683133323A3334353930312C37343261623432323A3434393633312C646A656366383539743A3336363731382C66696973633834343A3431393233322C66686F70747275653A3434343539352C37313567683537333A3338303334362C67343568623831303A3335333936332C66303366633135743A3334343233392C766563746F72636C6F636B656E61626C65643A3333343933342C64656661756C74746F6F6462666F726E657766696C653A3334383232352C686E656469746F72733A3531383233342C356D696E31306D696E5F31306D696E6772616365706572696F643A3531373738392C66696C69733436363A3733363730322C68617070793038323332322D313A3339383331332C63366567663438343A3333343231392C6D6F7665636C6F636B64617461746F657068656D6572616C73746F7265666F726F63733A3239353138352C68617070793037323132322D313A3335363237332C62657474657262726561646372756D62733A3439303833362C666173617263686976616C3A3333303738332C66697365733932313A3234313639392C6669616C6C3139383A3439383838372C66696261633936373A3630383537312C66696F63733230303A3434393439382C66696973773136313A3331373630342C66697465733231373A3136313436382C66697265663334363A33343532352C66696D6F633538393A32383937392C66696361633132343A3230373735372C66697061723833393A3139313036322C6772617068617069666F726F64656E61626C6564726F6C6C6F75743A3339343135362C6F6E656472697665636F6E76657267656E6365656E6C69676874656E6564726F6C6C6F75743A3135393033382C66696F6D693239333A3131383038312C6669736B693232353A3439383837342C6669656E613934373A33303633352C66697368653935373A36343036322C66697374613430373A36313032372C6669656E613930333A36353934342C66696461763236353A35353033352C66696361633834313A34393636342C6669656E613431353A33383738302C6669656E613439303A33343138312C72656D6F74656D6F76656465766963653A34323530302C6669656E613237363A34313030342C6669656E613338313A34393939372C502D582D313032303335332D312D372C502D522D313233363533302D382D322C502D522D313037383537312D31382D382C502D522D313034363334302D31382D31352C502D522D313033333537392D31382D31312C502D522D313033343131382D31382D32302C502D522D313032363335342D31382D32312C502D522D313031383335392D322D322C502D522D36313730372D32382D32322C502D522D35333534352D342D352C502D522D34393733362D362D32322C502D522D33303038352D312D392C502D522D32353135372D382D31342C502D522D32343336332D362D31332C502D522D31393831342D312D36322C502D522D31393031322D312D35372C666C656E613231343A3532363832342C666C656E613231343A3532363832342C502D582D313032343434382D312D332C30356269353338323A3430333333312C502D582D313035363435362D322D31312C502D582D313031383536342D332D392C502D582D313032303539372D312D372C502D582D313035313531322D312D332C502D582D313030393332392D312D372C502D582D313030363237392D312D372C502D582D313031313434322D312D31312C502D582D313031393633322D312D332C502D582D313031353535342D312D352C502D582D313031303331342D312D352C502D582D3130383336342D312D332C502D582D37373734322D312D352C502D582D38313035362D31312D32352C502D582D38363339352D312D352C502D582D38343332312D312D352C502D582D37333633372D312D392C502D582D35303232302D312D332C502D582D34393733302D312D332C502D522D313034333838352D362D362C502D522D313031343435322D382D382C502D522D36343834312D32322D31352C502D522D36333130302D32382D31302C502D522D35323033382D32382D31382C502D522D33363638332D31382D34302C502D522D34303939302D31322D31352C502D522D33353937322D322D352C502D522D33353537322D322D332C502D522D33323734342D31342D31352C502D522D33323734312D33322D31362C502D522D32383735312D322D32302C69693435373531323A3434393137382C6272616B696E67736B703A3338383633312C6772616C743139333A3431313231352C3832626A333335353A3337333930362C6772616C743232323A3334353534372C67726869643532383A3436303939362C67726766783930363A3432333930352C67723233343A3433343331362C6772736B693435353A3537383535332C67723331323A3631333334312C67723337303A3538333038372C677264656C3334373A3132373632382C6772656E613331363A3631393236312C67727376673936303A3435323639302C67727573653434343A3132343039312C6772616C6C3436343A3133343338362C67727573653438383A3537303335382C677269636F3430363A31393737372C502D582D3130353838392D312D352C32346139333336353A3134373734372C502D522D35303432392D31382D382C502D522D33363533392D31302D352C502D522D32343038342D312D31362C502D582D313535393535332D312D332C502D582D313034393232352D312D332C502D582D313033333336302D312D352C502D582D313033333335352D312D332C502D582D313031313137332D312D352C502D522D313537363838342D31332D31342C502D522D313434353932342D382D362C502D522D313130313038312D382D352C502D522D313037373631302D382D352C502D522D313032363534322D382D342C502D522D313032313732352D31382D34392C502D522D35333432312D32382D31342C502D522D34303437352D32382D32382C502D522D33353938352D31342D32332C502D522D33323030342D322D352C37613961633834303A3736333637322C39373935633332303A3335393832302C32646262623537393A3238363232352C69383364613438393A3338383033382C69643539323A3238383731342C502D582D38383033352D312D352C6C616C616E3233313A3134303738312C502D582D313237363530392D312D352C502D582D313035313131312D322D352C502D582D313031393632392D332D31362C502D582D38353734312D312D31372C502D582D313030363733362D332D32312C502D582D3131333530312D322D382C502D582D3130333738362D312D332C502D582D37303037382D32332D34342C502D522D313238303432352D31332D31372C502D522D37303730332D312D352C502D522D36313234382D31382D372C502D522D35313939352D31382D32382C502D522D34323839362D37342D3134312C502D522D34303231322D34322D37332C69306437363937303A3539383638392C68696263313339393A3334343439352C646F63756D656E747461736B756977696E6D61637778703A3533323435372C68617070793036303732312D313A3233323730342C6D756C74696C6576656C6C697374737570706F72743A3331373735382C6C656D69633530353A3230373133372C6C656973753732343A3631303738342C696D616765737570706F72747374616765323A3332323037342C502D582D313034343531342D322D372C502D582D313036313732332D322D352C502D582D313037363235322D312D362C502D582D313034393634392D322D352C502D582D313034373731352D322D372C502D582D313031343139352D342D31392C502D582D313032363133312D322D352C502D582D313032373931332D312D31312C502D582D313031373734352D382D31342C502D582D3130383634332D322D372C502D582D39353630352D322D332C502D522D313035383637352D382D342C502D522D313033363537362D342D342C502D522D39383131302D342D352C502D522D37393936332D312D322C502D522D36303831362D31302D31392C502D522D35313736342D312D342C502D522D34323339322D322D342C502D522D33393037332D312D352C70697063687962726964743A3333363236352C326766396A3631383A3336323439302C396A6734633839333A3335373434342C34676839653230353A3438333737382C363135316A3631333A3434373631392C67643868383735353A3331373939302C6A6A3035303832373A3234353136322C61306537323236393A3332323039342C37673633363833323A3236383639382C37366534673937353A3332343937392C67306864303232313A3435303335352C502D522D313132333337362D31302D31342C502D522D313030393835352D31322D31342C502D522D39383835362D31382D34382C502D522D313036313233392D382D362C502D522D34333438392D33302D31352C502D522D33383431302D31322D32332C502D582D313239313234362D322D332C502D582D313232393336302D332D31352C502D582D39323634342D312D392C502D582D37373133362D312D32372C502D582D313032373135362D312D372C502D582D313031323935302D342D372C502D582D313037343533362D312D332C502D582D313036363534362D312D31332C502D582D38393837382D312D352C502D582D313035313633372D322D352C502D582D313035303636352D332D372C502D582D313033303234352D312D352C502D582D313034313735362D322D352C502D582D313033393334372D322D31312C502D582D313033393537362D322D332C502D582D313031393538312D312D332C502D
(PID) Process:(7448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
Operation:writeName:ChunkCount
Value:
uint64_t|0
(PID) Process:(7448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
Operation:writeName:1.1
Value:
582D313031343837382D312D392C502D582D313031333031362D312D332C502D582D313030363137342D312D352C502D582D3131383332302D312D352C502D582D38333832342D312D332C502D582D35313735392D312D332C502D522D313536353432382D322D332C502D522D313234393337302D342D352C502D522D313039343131352D342D342C502D522D313038393139322D362D352C502D522D313031373036362D342D352C502D522D3131373934312D342D342C502D522D35393533342D312D332C502D522D35343535372D312D332C502D522D33373630332D332D362C63683337313137393A3630303339362C656E61626C656D616E6966657374786D6C7369676E6174757265766572696669636174696F6E72656C696162696C697479323A3535323631322C656E61626C656D616E6966657374786D6C7369676E6174757265766572696669636174696F6E3A3237343939302C6578706572696D656E746174696F6E7364787072656C6F61643A37373732392C31323568373933353A3335313834372C6F65736574757064656C697665727966616C6C6261636B333A3434353037352C39623864613935353A3434393932342C62656C6F776F70656E646976696465723A3534323535372C6F6575696C3832303A3332363132342C33633867643634383A3436343939302C6F65656E61626C656F73666964656E746974796D616E616765723A3434393931392C34633668643237393A3436333732312C67623038643735323A3239323132322C64336769653536343A3238333835332C39396631643631363A3238333835342C6F656D69633633393A3339373735332C6F653539383A3339313531302C6F65616C6C3431393A3431343537312C6F65616C6C3834333A3337353838372C6F65656E613535353A3432303338362C6F65636F6F3133333A3336313137322C6F656D61633335383A32303530322C502D522D37313336302D31382D31392C502D582D37363535352D312D332C6F6E6D61703336363A38313734302C502D442D313437363534302D312D332C502D442D313234383335302D312D332C502D442D313233363437322D332D342C502D442D313232303436342D372D352C502D442D313033303630312D332D332C502D442D313135373731372D312D332C502D442D313134393433362D312D332C502D442D313133313332392D362D372C502D442D313131303935362D342D332C502D442D313038343536352D332D332C502D442D313037353534332D312D332C502D442D313037333031342D352D332C502D442D313033373534312D372D362C502D442D313033333339312D322D342C502D442D313033313533372D312D332C502D442D313033313533362D312D332C502D442D313033313533342D342D332C502D442D313033313533322D312D332C502D442D313033313532392D312D332C502D442D313033313532372D312D332C502D442D313033313532352D312D332C502D442D313033313532312D322D332C502D442D313033313532302D322D332C502D442D313033313531322D312D332C502D442D313033313531302D312D332C502D442D313033313530392D312D332C502D442D313033313530382D312D332C502D442D313033313439332D312D332C502D442D313033313438362D312D332C502D442D313033313438342D312D332C502D442D313033313438322D312D332C502D442D313033313437392D312D332C502D442D313033313436302D312D332C502D442D313033313035302D342D332C502D442D313033313032322D312D332C502D442D313033313031382D312D332C502D442D313033313031322D312D332C502D442D313033303936342D312D332C502D442D313033303936332D312D332C502D442D313033303935362D312D332C502D442D313033303932382D312D332C502D442D313033303932372D312D332C502D442D313033303932362D312D332C502D442D313033303932332D322D332C502D442D313033303932322D322D332C502D442D313033303932302D322D332C502D442D313033303931382D322D332C502D442D313033303931362D322D332C502D442D313033303931342D322D332C502D442D313033303931322D322D332C502D442D313033303931302D322D332C502D442D313033303930382D322D332C502D442D313033303930362D322D332C502D442D313033303930342D322D332C502D442D313033303930322D322D332C502D442D313033303930302D322D332C502D442D313033303839382D322D332C502D442D313033303839362D322D332C502D442D313033303839332D322D332C502D442D313033303839312D322D332C502D442D313033303838392D322D332C502D442D313033303838372D322D332C502D442D313033303838352D322D332C502D442D313033303838332D322D332C502D442D313033303838312D322D332C502D442D313033303837392D322D332C502D442D313033303837372D322D332C502D442D313033303837362D322D332C502D442D313033303837352D322D332C502D442D313033303837332D332D332C502D442D313033303837322D322D332C502D442D313033303837312D322D332C502D442D313033303837302D322D332C502D442D313033303836392D322D332C502D442D313033303836382D322D332C502D442D313033303836372D322D332C502D442D313033303836362D322D332C502D442D313033303836352D322D332C502D442D313033303836342D322D332C502D442D313033303836322D322D332C502D442D313033303836302D322D332C502D442D313033303835382D322D332C502D442D313033303835362D322D332C502D442D313033303835342D322D332C502D442D313033303835322D322D332C502D442D313033303835302D322D332C502D442D313033303834382D322D332C502D442D313033303834372D322D332C502D442D313033303834362D322D332C502D442D313033303834342D322D332C502D442D313033303834322D322D332C502D442D313033303834312D322D332C502D442D313033303834302D322D332C502D442D313033303833382D322D332C502D442D313033303833362D322D332C502D442D313033303833342D322D332C502D442D313033303833322D322D332C502D442D313033303833302D322D332C502D442D313033303832382D322D332C502D442D313033303832362D322D332C502D442D313033303832342D322D332C502D442D313033303832322D322D332C502D442D313033303831392D322D332C502D442D313033303831362D322D332C502D442D313033303831322D322D332C502D442D313033303831312D322D332C502D442D313033303831302D322D332C502D442D313033303830382D322D332C502D442D313033303830362D322D332C502D442D313033303830332D322D332C502D442D313033303830312D322D332C502D442D313033303830302D322D332C502D442D313033303739392D322D332C502D442D313033303739382D322D332C502D442D313033303739372D322D332C502D442D313033303739362D322D332C502D442D313033303739352D322D332C502D442D313033303739342D322D332C502D442D313033303739332D322D332C502D442D313033303739322D322D332C502D442D313033303739312D322D332C502D442D313033303738392D322D332C502D442D313033303738372D322D332C502D442D313033303738362D322D332C502D442D313033303738352D322D332C502D442D313033303738332D322D332C502D442D313033303738312D322D332C502D442D313033303737392D322D332C502D442D313033303737372D322D332C502D442D313033303737352D322D332C502D442D313033303737332D322D332C502D442D313033303737312D322D332C502D442D313033303736392D322D332C502D442D313033303736372D322D332C502D442D313033303736352D322D332C502D442D313033303736332D322D332C502D442D313033303736312D322D332C502D442D313033303736302D322D332C502D442D313033303735392D322D332C502D442D313033303735382D322D332C502D442D313033303735372D322D332C502D442D313033303735362D322D332C502D442D313033303735352D322D332C502D442D313033303735332D322D332C502D442D313033303735312D322D332C502D442D313033303734392D322D332C502D442D313033303734372D322D332C502D442D313033303734352D322D332C502D442D313033303734332D322D332C502D442D313033303734302D332D332C502D442D313033303733382D322D332C502D442D313033303733372D322D332C502D442D313033303733362D322D332C502D442D313033303733342D322D332C502D442D313033303733322D322D332C502D442D313033303733302D322D332C502D442D313033303732382D322D332C502D442D313033303732362D322D332C502D442D313033303732342D322D332C502D442D313033303732322D322D332C502D442D313033303731392D322D332C502D442D313033303731372D322D332C502D442D313033303731352D322D332C502D442D313033303731332D322D332C502D442D313033303731322D322D332C502D442D313033303731312D322D332C502D442D313033303730392D322D332C502D442D313033303730382D322D332C502D442D313033303730372D322D332C502D442D313033303730362D322D332C502D442D313033303730352D322D332C502D442D313033303730342D322D332C502D442D313033303730332D322D332C502D442D313033303730322D322D332C502D442D313033303730312D322D332C502D442D313033303639392D322D332C502D442D313033303639372D322D332C502D442D313033303639362D322D332C502D442D313033303639352D322D332C502D442D313033303639332D322D332C502D442D313033303639312D322D332C502D442D313033303639302D322D332C502D442D313033303638392D322D332C502D442D313033303638372D322D332C502D442D313033303638352D322D332C502D442D313033303638332D322D332C502D442D313033303638312D322D332C502D442D313033303637392D322D332C502D442D313033303637372D322D332C502D442D313033303637352D322D332C502D442D313033303637332D322D332C502D442D313033303637312D322D332C502D442D313033303636392D322D332C502D442D313033303636382D322D332C502D442D313033303636352D322D332C502D442D313033303636342D322D332C502D442D313033303636332D322D332C502D442D313033303636312D322D332C502D442D313033303635392D322D332C502D442D313033303635362D312D332C502D442D313033303634392D312D332C502D442D313033303634322D31322D382C502D442D313033303633372D372D332C502D442D313033303633362D372D332C502D442D313033303633352D372D332C502D442D313033303633342D312D332C502D442D313033303633332D312D332C502D442D313033303632382D322D342C502D442D313033303539312D312D332C502D442D313033303536312D312D332C502D442D313033303534372D322D342C502D442D313033303534352D312D332C502D442D313033303534322D312D332C502D442D313033303438352D312D332C502D442D313033303231392D332D352C502D442D313033303231382D332D352C502D442D313032393532312D352D342C502D442D313032393531372D312D332C502D442D313032393531352D312D332C502D442D313032393531342D312D332C502D442D313032393531332D312D332C502D442D313032393531322D312D332C502D442D313032393531312D312D332C502D442D313032393531302D312D332C502D442D313032393530392D312D332C502D442D313032393530382D312D332C502D442D313032393530362D312D332C502D442D313032393530352D312D332C502D442D313032393434342D312D332C502D442D313032393433302D312D332C502D442D313032393432382D312D332C502D442D313032393432362D312D332C502D442D313032393431362D312D332C502D442D313032393431342D312D332C502D442D313032393337312D312D332C502D442D313032393333382D312D332C502D442D313032393239332D322D332C502D442D313032393238392D31362D342C502D442D313032393237362D312D332C502D442D313032393237352D312D332C502D442D313032393237322D312D332C502D442D313032393237302D312D332C502D442D313032393236372D362D342C502D442D313032393235302D312D332C502D442D313032393234332D312D332C502D442D313032393233382D312D332C502D442D313032393233372D312D332C502D442D313032393233342D312D332C502D442D313032393230352D312D332C502D442D313032393230332D312D332C502D442D313032393134382D332D342C502D442D313032393133372D312D332C502D442D313032393039372D322D332C502D442D313032393039362D322D332C502D442D313032393039332D322D332C502D442D313032393039322D322D332C502D442D313032393039312D322D332C502D442D313032393039302D322D332C502D442D313032393038362D312D332C502D442D313032393038332D31322D332C502D442D313032393038322D31322D332C502D442D313032393038302D382D352C502D442D313032393037382D312D332C502D442D313032393037372D312D332C502D442D313032393037352D372D342C502D442D313032393036352D312D332C502D442D313032393036332D31322D332C502D442D313032383937372D312D332C502D442D313032383937342D312D332C502D442D313032383935362D332D342C502D442D313032383931342D312D332C502D442D313032383837342D312D332C502D442D313032313733302D322D342C502D442D313032313732392D322D342C502D442D313032313032302D322D342C502D442D313032313031392D322D342C502D442D313032313031372D322D342C502D442D313032313031362D322D342C502D442D313032313031352D352D372C502D442D313032313031342D322D342C502D442D313032313031332D322D342C502D442D313032313031322D322D342C502D442D313032313031312D322D342C502D442D313032313031302D322D342C502D442D313032313030382D322D342C502D582D313034333136302D312D31332C64393467633535363A3439303439302C502D582D313035323931302D312D332C502D582D313032303532392D312D332C502D522D313031363533392D382D352C502D522D38323437332D312D342C502D522D35363631382D312D332C31393167353730353A3433333136302C7065696E703639343A3234363834392C502D582D313030363439392D312D31332C502D582D3130383433372D312D332C502D582D39393534392D312D352C502D582D38323337372D312D332C502D522D33353531332D342D342C502D522D33333639362D312D352C502D522D33333536392D312D392C502D522D33313938372D312D362C7065656E3335333A3430373634392C7065656E613738383A3139333433302C74756C69707376323A3137373838352C656E61626C65616C776179736F6E726566726573683A3232343838382C502D522D33393931322D312D322C502D522D35303338302D31382D31382C502D582D3131353136362D312D332C70753436393A3433343439332C502D582D313037303034312D322D332C502D582D313032373334312D322D352C502D582D313034383034362D312D332C502D582D313034353236392D312D352C502D582D313034313335352D312D352C502D582D313034353035392D312D332C502D582D313034343238362D312D352C502D582D313030303536392D362D31392C502D582D313033383038312D322D352C502D582D313031383131372D312D352C502D582D313030393537362D332D31352C502D582D313032313138372D312D332C502D582D313031353532362D312D352C502D582D3131373734302D312D332C502D522D313533313035352D382D322C502D522D313038383737372D382D352C502D522D313038313636382D382D342C502D522D313037353133352D382D352C502D522D313037343337322D342D352C502D522D313037343037372D342D352C502D522D313036343135392D382D382C502D522D313034303537392D32362D31372C502D522D313033383632392D382D352C502D522D36333333382D31382D31312C502D522D35383235312D31382D31322C502D522D33333733372D312D342C6A663868373136353A3638373839372C6A636765643937303A3336353634322C38663966623737313A3339363938322C38623061313234353A3435343833312C66393935643630373A3334363839312C36366568313330383A3334353931382C33666831623238333A3338333636362C68693536673538353A3336383031332C65303931363830323A3439303739312C6A757374696669636174696F6E6F746865727769746873656375726974797761726E696E673A3435313233342C7365636C703230303A3432303334332C33363832333632363A3532363433392C736566673833383A3334363836392C677261706869637366696C74657265787472616C6F636B646F776E3A3439363034382C502D582D37383534352D312D352C502D582D37313933392D332D31322C502D582D313031373631362D312D372C502D582D313031343232372D312D332C502D582D3131363238362D312D332C502D582D3131363038352D312D332C502D582D3131363037382D312D352C502D582D3131363036352D312D332C502D582D37343233342D312D31312C502D582D37333731382D312D332C502D452D32393636322D322D332C502D522D36313335382D4331372D32322C502D522D313034393532362D322D382C502D522D313034393533352D322D382C502D522D32393330332D322D32302C502D522D32393033312D322D32302C502D522D33363331362D362D32302C502D522D33303239302D362D32332C502D522D32383938322D332D31382C502D522D36333934372D31382D322C502D522D36333335372D31382D31392C502D522D36313336312D31382D32362C502D522D36313336302D31382D32312C502D522D34383633342D322D31352C502D522D34373234322D31382D31312C502D522D34353537392D31382D382C502D522D34323531322D312D332C502D522D34303532312D322D31332C502D522D33383730342D342D362C502D522D33383231322D322D31312C502D522D33353934362D362D342C502D522D33353834362D382D342C502D522D33353430372D342D332C502D522D33333133342D322D31372C502D522D33303239322D342D392C502D522D32383634342D312D342C502D522D32343033372D312D372C502D522D32333434352D332D372C502D522D32333337302D322D392C502D522D32333433342D332D372C502D522D31383531332D312D33302C502D442D33343630392D312D332C502D442D33343235302D312D332C73686175743539363A3639383734352C73686564693835393A3534303336382C7368776F723635333A3334393437312C736176656173706466616C7474657874736D6172746172743A3639373830332C73686772613439383A3232373730372C73686772613630313A3138343038302C73686772613335353A3230383034392C7368677261353032
(PID) Process:(7448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
Operation:writeName:ChunkCount
Value:
uint64_t|1
(PID) Process:(7448) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\word\ConfigContextData
Operation:writeName:1.2
Value:
3A3138393932342C73686772613734373A38363637372C73686963723331373A39343532312C502D582D313130373037302D322D332C502D582D313038333432372D322D352C502D582D313034313336382D332D31302C502D582D313034323339332D332D372C502D582D313032343737362D322D372C502D582D313032343034372D312D362C502D582D313030303332322D312D372C502D522D36353031312D312D332C502D522D35303534312D322D372C66366562623730383A3433343833322C6A683861623434373A3338303633332C65386A69683932303A3434323136302C6C697374656E696E676F6E6465766963653A3332343439342C61686938323431313A3434323139322C38356863643939303A3432353033352C73683335303A3332393432382C502D582D37313536382D312D352C502D522D36393233322D33382D31322C502D522D32363434322D312D382C502D522D32333638312D322D372C502D442D33323530322D322D332C502D442D33323530312D322D332C502D442D33323431352D322D332C7461656E613537363A39303236352C502D582D313032373136332D322D31312C502D582D313033383432302D322D352C502D582D3130393636322D312D31372C502D582D3130373131392D312D332C502D582D38303033382D312D352C502D522D36343531332D31382D31312C502D522D35313931362D38342D33312C502D442D313136303234302D312D362C502D442D313136303134312D312D342C6F74656C657564623A3332363832362C38686262343533383A3338363637302C74656172693335323A3233333737342C74657072693632383A3433393731302C74656576653835303A3132303534302C502D522D313538353838372D322D342C502D522D313535313135332D312D332C502D522D313233363935332D382D31322C502D522D313534393032312D312D332C502D522D313036333231302D372D31332C502D522D313534373631372D312D332C502D522D313532383734302D312D332C502D522D313532363837352D31352D332C502D522D313532363837342D31352D332C502D522D313532363837332D31352D332C502D522D313532363837322D31352D332C502D522D313532363837302D31352D332C502D522D313532363836392D31352D332C502D522D313532363836382D31352D332C502D522D313532363836372D31352D332C502D522D313532363836362D31352D332C502D522D313532363836322D31352D332C502D522D313437393637342D332D352C502D522D33383234382D32312D32372C502D522D313431373335342D332D352C502D522D313431373335322D332D352C502D522D313431363735332D372D392C502D522D313431363734362D362D382C502D522D313431353138332D33322D342C502D522D313431353138322D33322D342C502D522D313431353138312D33322D342C502D522D313431353138302D33322D342C502D522D313431353137392D33322D342C502D522D313238303138362D312D332C502D522D313236373038342D322D362C502D522D313236313931382D322D342C502D522D313234353830342D34382D352C502D522D313234353239362D342D362C502D522D313138333633392D36322D362C502D522D313138333633312D36322D362C502D522D313138333632382D36322D362C502D522D313135373537302D322D342C502D522D313134303939382D37352D372C502D522D313134303939372D37352D372C502D522D313134303939362D37352D372C502D522D313134303939352D37352D372C502D522D313134303939342D37352D372C502D522D313134303939332D37352D372C502D522D313134303939322D37352D372C502D522D313134303939312D37352D372C502D522D313134303939302D37352D372C502D522D313134303938392D37352D372C502D522D313133323832312D322D342C502D522D313131393031332D312D332C502D522D313130363736382D38362D382C502D522D313130363736372D38362D382C502D522D313130363736362D38362D382C502D522D313130363736352D38362D382C502D522D313130363736342D38362D382C502D522D313130363736332D38362D382C502D522D313130363736322D38362D382C502D522D313130333237372D312D332C502D522D313039383739362D312D332C502D522D313039343434352D312D332C502D522D313035383634332D352D392C502D522D313038303431322D312D332C502D522D313038303130312D39362D392C502D522D313038303130302D39362D392C502D522D313038303039392D39362D392C502D522D313038303039372D39362D392C502D522D313038303039362D39362D392C502D522D313038303039352D39362D392C502D522D313038303039342D39362D392C502D522D313038303039332D39362D392C502D522D313038303039322D39362D392C502D522D313038303039312D39362D392C502D522D313038303039302D39362D392C502D522D313038303038392D39362D392C502D522D313038303038382D3131332D31302C502D522D313037333239312D342D362C502D522D313037313736312D312D332C502D522D313036393736392D322D342C502D522D313036393230332D312D332C502D522D313036383131352D312D332C502D522D313032343037362D342D382C502D522D313032343037342D342D382C502D522D313035393332392D3130342D31302C502D522D313035393332382D3132312D31312C502D522D313035393332362D3130342D31302C502D522D313035393332352D3130342D31302C502D522D313035393332342D3130342D31302C502D522D313035393332332D3132312D31312C502D522D313035393332322D3132312D31312C502D522D313035393332312D38372D392C502D522D313035393332302D3130342D31302C502D522D313035393331392D3130342D31302C502D522D313035393331382D3130342D31302C502D522D313035393331372D3130342D31302C502D522D313035393331362D3130342D31302C502D522D313035393331352D3130342D31302C502D522D313035393331342D3130342D31302C502D522D313035393331322D3130342D31302C502D522D313035393331312D3130342D31302C502D522D313035393331302D3130342D31302C502D522D313035393330392D3130342D31302C502D522D313035393330382D3130342D31302C502D522D313035393330372D3130342D31302C502D522D313035393330362D3130342D31302C502D522D313035393330352D3130342D31302C502D522D313035393330342D3130342D31302C502D522D313035393330332D3132312D31312C502D522D313035393330322D3130342D31302C502D522D313035393330312D3132312D31312C502D522D313035393330302D3130342D31302C502D522D313035393239392D3132312D31312C502D522D313035393239382D3130342D31302C502D522D313035393239372D3132312D31312C502D522D313035393239362D3130342D31302C502D522D313035393239352D3130342D31302C502D522D313035393239342D3130342D31302C502D522D313035393239332D3130342D31302C502D522D313035393239322D37312D382C502D522D313035393239312D3132312D31312C502D522D313035393239302D3130342D31302C502D522D313035393238392D3130342D31302C502D522D313035393238382D3130342D31302C502D522D313035393238372D3130342D31302C502D522D313035393238362D3130342D31302C502D522D313035393238352D3130342D31302C502D522D313035393238342D3130342D31302C502D522D313035393238332D3130342D31302C502D522D313035393238322D3130342D31302C502D522D313035393238312D3130342D31302C502D522D313035393238302D3130342D31302C502D522D313035393237392D3130342D31302C502D522D313035393237382D3130342D31302C502D522D313035393237372D3130342D31302C502D522D313035393237362D3130342D31302C502D522D313035393237352D3130342D31302C502D522D313035393237342D3130342D31302C502D522D313035393237332D3130342D31302C502D522D313035393237322D3130342D31302C502D522D313035393237312D3130342D31302C502D522D313035393237302D3130342D31302C502D522D313035393236392D3130342D31302C502D522D313035393236382D3130342D31302C502D522D313035393236372D3130342D31302C502D522D313035393236362D3130342D31302C502D522D313035393236352D3130342D31302C502D522D313035393236342D3130342D31302C502D522D313035393236332D3130342D31302C502D522D313035393236322D3130342D31302C502D522D313035393236312D3130342D31302C502D522D313035393236302D3130342D31302C502D522D313035393235392D3130342D31302C502D522D313035393235382D3130342D31302C502D522D313035393235372D3130342D31302C502D522D313035393235362D3130342D31302C502D522D313035393235352D3130342D31302C502D522D313035393235342D3130342D31302C502D522D313035393235332D3130342D31302C502D522D313035393235322D3130342D31302C502D522D313035393235312D3130342D31302C502D522D313035393235302D3130342D31302C502D522D313035393234392D3130342D31302C502D522D313035393234382D3130342D31302C502D522D313035393234372D3130342D31302C502D522D313035393234352D3130342D31302C502D522D313035393234342D3132312D31312C502D522D313035393234332D3130342D31302C502D522D313035393234322D3130342D31302C502D522D313035393234312D3130342D31302C502D522D313035393134362D3132302D31322C502D522D313035393035332D3131322D31312C502D522D313035383938382D3132302D31322C502D522D313035383938372D3131322D31312C502D522D313035383938362D3131322D31312C502D522D313035383938352D3132382D31332C502D522D313035383938342D3132382D31332C502D522D313035383938332D3133362D31342C502D522D313035383938322D3133372D31332C502D522D313035383938312D3131322D31312C502D522D313035383938302D3131322D31312C502D522D313035383937392D3132382D31332C502D522D313035383937382D3132382D31332C502D522D313035383937372D3134342D31352C502D522D313035383937362D3133372D31332C502D522D313035383937352D3133372D31332C502D522D313035383937342D3133372D31332C502D522D313035383937332D3133372D31332C502D522D313035383937322D3133372D31332C502D522D313035383937312D3133372D31332C502D522D313035383936392D3133372D31332C502D522D313035383936382D3133372D31332C502D522D313035383936372D3133362D31342C502D522D313035383936362D3133362D31342C502D522D313035383936352D3131322D31312C502D522D313035383936342D3131322D31312C502D522D313035383936332D3131322D31312C502D522D313035383936322D3131322D31312C502D522D313035383936312D3131322D31312C502D522D313035383936302D3131322D31312C502D522D313035383935392D3131322D31312C502D522D313035383935382D3132302D31322C502D522D313035383935372D3131322D31312C502D522D313035383935362D3132392D31322C502D522D313035383935352D3132392D31322C502D522D313035383935342D3132392D31322C502D522D313035383935332D3132392D31322C502D522D313035383935322D3132392D31322C502D522D313035383935312D3132392D31322C502D522D313035383935302D3132392D31322C502D522D313035383934392D3132392D31322C502D522D313035383934382D3132392D31322C502D522D313035383934372D3132392D31322C502D522D313035383934362D3132392D31322C502D522D313035383934352D3132392D31322C502D522D313035383934342D3132302D31322C502D522D313035383934332D3132302D31322C502D522D313035383934322D3133362D31342C502D522D313035383934312D3132302D31322C502D522D313035383934302D3132302D31322C502D522D313035383933392D3132302D31322C502D522D313035383933382D3132302D31322C502D522D313035383933372D3132302D31322C502D522D313035383933362D3132302D31322C502D522D313035383933352D3132302D31322C502D522D313034393137352D312D332C502D522D313034353131382D322D342C502D522D313034343430382D312D332C502D522D313033373838372D312D332C502D522D313033373837392D312D332C502D522D313033363239332D312D332C502D522D313033363239322D312D332C502D522D313033363238392D322D342C502D522D313033363238382D312D332C502D522D313033363036382D322D342C502D522D313033363033392D322D342C502D522D313033353933332D322D342C502D522D313033353134392D322D342C502D522D313033333831372D312D332C502D522D313033333632342D322D342C502D522D313032383535302D322D342C502D522D313032383136382D312D332C502D522D313032373533352D332D352C502D522D313032343638302D342D362C502D522D313032343037312D322D342C502D522D313031303339332D312D332C502D522D313030363839362D312D332C502D522D313030363839342D312D332C502D522D313030363536322D322D342C502D522D313030303036312D322D342C502D522D3131353934362D332D352C502D522D3131313638322D312D332C502D522D3130353733312D33362D33382C502D522D3130343433352D31332D31352C502D522D3130303239342D312D332C502D522D39393633332D312D332C502D522D39383932392D322D342C502D522D39383932362D312D332C502D522D39383235302D312D332C502D522D39343535362D322D342C502D522D39333037372D312D332C502D522D39303839352D332D352C502D522D38383330392D322D342C502D522D38363131382D312D332C502D522D38333430382D322D342C502D522D38303531372D372D392C502D522D37383835322D332D352C502D522D37383332352D332D352C502D522D37383131322D342D362C502D522D37363931382D322D342C502D522D37363732312D312D332C502D522D37363235332D312D332C502D522D37353434302D322D342C502D522D37353433362D312D332C502D522D37353433342D312D332C502D522D37353433332D312D332C502D522D37343532382D342D362C502D522D37323434392D372D31302C502D522D36383036392D322D342C502D522D36363937352D312D332C502D522D36353536372D312D332C502D522D36303630322D332D352C502D522D35383437312D322D342C502D522D35383039332D312D332C502D522D35333330392D312D332C502D522D35323633332D312D332C502D522D35323137312D322D342C502D522D35313932312D382D31302C502D522D35313235382D382D31302C502D522D35303735322D322D342C502D522D35303638312D322D342C502D522D35303539392D342D362C502D522D35303539362D342D382C502D522D35303538352D31372D31392C502D522D35303535332D312D332C502D522D34393539372D332D352C502D522D34393435382D322D342C502D522D34383533302D372D392C502D522D34373934382D312D342C502D522D34363538302D332D352C502D522D34363438342D31302D31322C502D522D34363132322D312D332C502D522D34353835382D322D342C502D522D34343935302D312D332C502D522D34333936362D322D342C502D522D34333530322D31392D32312C502D522D34333233382D332D352C502D522D34333138382D362D382C502D522D34313433302D312D332C502D522D34303735312D382D31302C502D522D34303237332D342D362C502D522D33393233382D352D372C502D522D33383837382D322D342C502D522D33383638322D332D352C502D522D33373538382D322D342C502D522D33343335352D382D31302C502D522D32363236362D342D392C502D522D32363833342D332D382C502D522D32343636322D31362D32322C502D522D32373437392D362D31312C502D522D32363035362D372D31352C502D522D32373030362D372D31322C502D522D33323139312D392D31312C502D522D33303333382D332D372C502D522D33303137382D37392D38312C502D522D33303035332D382D31302C502D522D32373435382D312D352C502D522D32353832322D31362D31392C502D522D32353038332D362D392C502D522D32343639302D34342D34382C502D522D32343638392D322D352C502D522D32343636362D322D352C502D522D32343636332D362D31312C502D522D32343635392D372D31302C502D522D32333736322D352D382C502D522D32333734342D372D392C502D522D32333733392D372D392C502D522D32333733362D31342D31372C502D522D32333733342D372D392C502D522D32333733302D32312D32342C502D522D32333732332D31302D31322C502D442D33323538392D312D332C502D442D33323538382D312D332C502D442D33323533342D312D332C502D442D33323532342D312D332C502D442D33323531382D312D332C502D442D33323531322D312D332C502D442D33323530392D312D332C502D442D33323530342D312D332C502D442D33323438352D312D342C502D442D33323438342D312D342C502D442D33323430352D312D332C502D582D313032353438352D312D352C502D582D313031343937322D322D372C502D582D313033373435392D322D352C502D582D313033363938372D322D332C502D582D313033363137332D322D332C502D582D313033333537332D312D352C502D582D313033313539322D312D332C502D582D313033303033352D322D332C502D582D313032383334312D332D31362C502D582D313031373032392D322D352C502D582D313032353231332D312D332C502D582D3131373832392D332D31332C502D582D313032303536382D312D332C502D582D313032303338302D312D352C502D582D313031353238332D322D372C502D582D313030343337332D312D352C502D582D39333430372D312D352C502D582D313031323937392D322D352C502D582D313030333137372D322D352C502D582D38373438342D372D31372C502D582D3131313733302D312D352C502D582D3130383438312D312D352C502D582D3130393235302D322D332C502D582D37373839302D312D352C502D582D37393633352D312D372C502D582D37393333352D352D32372C502D582D37333137312D312D352C502D582D37333137392D312D372C502D582D37313939392D332D31312C502D582D37313831392D312D332C502D522D313038373134312D342D372C502D522D313037353139392D362D342C502D522D313031333933302D342D352C502D522D36303537312D31382D33302C502D522D35333038352D31382D31332C502D522D35313331382D31382D382C502D522D34373034362D32362D32342C502D522D34373630312D31382D31332C502D522D34363930302D31382D382C502D522D34353831372D32302D31362C502D522D34303135322D31382D31362C502D522D
Executable files
33
Suspicious files
370
Text files
46
Unknown types
1

Dropped files

PID
Process
Filename
Type
7448WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$ntract01-167220360-2044.docxbinary
MD5:65DD3A792429F82208B5FB9D8663AFA0
SHA256:83B576D33BDF4109836EFEB2BF93A14D2EAABE4F1F4D4BE16EB9FDFB584786EE
7448WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\83683DE6-5473-4310-B6CD-E055C8231FEExml
MD5:428EC46ABA69E47F539BD8149A96DBDD
SHA256:16750DF3E03085EC4145160F2155DDC8BDE36E32861E071E79A18B64629B2A76
7448WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:5F1D11A429A4497917714F4ED34268B1
SHA256:D94BE1FC7ABA5240C7DCBA8C0BE3DDE9DA2D2C9FAF8F08BE0BCCED26A6B8BA53
7448WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:E16CF0E49AA8BCBE5E34E17DCA85E78C
SHA256:FD7C12095DDD85622231CE63FA575CD23BF44CA72A5E7D17409741528F724F36
7448WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_41.ttfbinary
MD5:A807151D5747F6460143DC1FD2C3195F
SHA256:C0C3B354480E34CCC0C25D371B30D0272DB86C786AF6438C217998B0A30E5EB0
7448WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:8533609591A5316A095D383199FD716C
SHA256:D6E36B31920DEDFD546399500BFDE69E8C4A7CC3DFE926EEA36EF2166E9FA80C
7448WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:6C9E47E6959B0709D8B68834F14BF6C5
SHA256:561F05CBB49CF459FD999E8D3E29B0CB93E9CB84C83A5D8C99A2C17BA4C8BCB6
7448WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:17624CCF4FED41B5B1E512563CB05FBF
SHA256:39CB6E281334730D0D97169F5CD45842F963A9EB0BE4A081231518DD7D923D1D
7448WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.Sbinary
MD5:FCB0392EB81E123604C58AB3435273AD
SHA256:BCBE30ADAB4C16038E41BA42DC6B6D4A007E41F83EC0046234854C4F9EA7C552
7448WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms~RF10f0ab.TMPbinary
MD5:4FCB2A3EE025E4A10D21E1B154873FE2
SHA256:90BF6BAA6F968A285F88620FBF91E1F5AA3E66E2BAD50FD16F37913280AD8228
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
64
TCP/UDP connections
213
DNS requests
222
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7448
WINWORD.EXE
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
7448
WINWORD.EXE
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
—
—
whitelisted
7448
WINWORD.EXE
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7448
WINWORD.EXE
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7448
WINWORD.EXE
GET
200
23.63.118.230:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7448
WINWORD.EXE
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7448
WINWORD.EXE
52.109.28.46:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
7448
WINWORD.EXE
23.32.238.193:443
omex.cdn.office.net
Akamai International B.V.
DE
whitelisted
7448
WINWORD.EXE
52.123.243.92:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.32.238.107
  • 23.32.238.112
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
google.com
  • 172.217.16.142
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
omex.cdn.office.net
  • 23.32.238.193
  • 23.32.238.185
whitelisted
ecs.office.com
  • 52.123.243.92
  • 52.123.224.68
  • 52.123.243.87
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
whitelisted
fs.microsoft.com
  • 23.197.142.186
whitelisted
messaging.engagement.office.com
  • 52.111.246.2
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Contract01-167220360-2044.docx