General Info

File name

CARGO MANIFEST.doc

Full analysis
https://app.any.run/tasks/125512a6-b3db-4c98-8515-1074e61068c4
Verdict
Malicious activity
Analysis date
5/15/2019, 13:40:43
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:

ole-embedded

loader

keylogger

rat

remcos

Indicators:

MIME:
text/rtf
File info:
Rich Text Format data, unknown version
MD5

97cdaf2b3495dc6fa29c83d2dbf14795

SHA1

b14ada1401e4b405559250670fa5e188ff0e4f06

SHA256

ca8ebccb3b453c8dcef9bb762e63f2b7e3840bffa7056b55941fe5b23f846d1c

SSDEEP

6144:C3pWug+QK5wx/ug+QK5wx/ug+QK5wx/b57:Se+wxme+wxme+wxz57

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
535 seconds
Additional time used
none
Fakenet option
off
Heavy Evaision option
off
MITM proxy
on
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
off

Software preset

  • Internet Explorer 11.0.9600.18860 KB4052978
  • Adobe Acrobat Reader DC MUI (15.007.20033)
  • Adobe Flash Player 27 ActiveX (27.0.0.187)
  • Adobe Flash Player 27 NPAPI (27.0.0.187)
  • Adobe Flash Player 27 PPAPI (27.0.0.187)
  • CCleaner (5.35)
  • Google Chrome (73.0.3683.75)
  • Google Update Helper (1.3.33.23)
  • Java 8 Update 92 (64-bit) (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Office 32-bit Components 2010 (14.0.4763.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Professional 2010 (14.0.4763.1000)
  • Microsoft Office Proof (English) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (French) 2010 (14.0.4763.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.4763.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.4763.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Shared 32-bit MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Office Single Image 2010 (14.0.4763.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.4763.1000)
  • Microsoft Visual C++ 2005 Redistributable (x64) (8.0.61000)
  • Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (11.0.61030.0)
  • Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (11.0.61030)
  • Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (11.0.61030)
  • Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x64) - 14.12.25810 (14.12.25810.0)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.11.25325 (14.11.25325.0)
  • Microsoft Visual C++ 2017 x64 Additional Runtime - 14.12.25810 (14.12.25810)
  • Microsoft Visual C++ 2017 x64 Minimum Runtime - 14.12.25810 (14.12.25810)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.11.25325 (14.11.25325)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.11.25325 (14.11.25325)
  • Mozilla Firefox 65.0.2 (x64 en-US) (65.0.2)
  • Mozilla Maintenance Service (65.0.2)
  • Notepad++ (64-bit x64) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype™ 7.39 (7.39.102)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (64-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Hyphenation Parent Package English
  • IE Spelling Parent Package English
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • InternetExplorer Package TopLevel
  • KB2479943
  • KB2491683
  • KB2506014
  • KB2506212
  • KB2506928
  • KB2509553
  • KB2532531
  • KB2533552
  • KB2534111
  • KB2545698
  • KB2547666
  • KB2552343
  • KB2560656
  • KB2563227
  • KB2564958
  • KB2579686
  • KB2585542
  • KB2585542 SP1
  • KB2598845
  • KB2603229
  • KB2604115
  • KB2620704
  • KB2621440
  • KB2631813
  • KB2640148
  • KB2653956
  • KB2654428
  • KB2656356
  • KB2656356 SP1
  • KB2660075
  • KB2667402
  • KB2685811
  • KB2685813
  • KB2685939
  • KB2690533
  • KB2698365
  • KB2705219
  • KB2706045
  • KB2719857
  • KB2726535
  • KB2727528
  • KB2729094
  • KB2729452
  • KB2732059
  • KB2732487
  • KB2736422
  • KB2742599
  • KB2750841
  • KB2758857
  • KB2761217
  • KB2763523
  • KB2770660
  • KB2773072
  • KB2786081
  • KB2789645
  • KB2789645 SP1
  • KB2791765
  • KB2799926
  • KB2800095
  • KB2807986
  • KB2808679
  • KB2813430
  • KB2834140
  • KB2836942
  • KB2836943
  • KB2840631
  • KB2843630
  • KB2847927
  • KB2852386
  • KB2853952
  • KB2861698
  • KB2862152
  • KB2862330
  • KB2862335
  • KB2864202
  • KB2868038
  • KB2871997
  • KB2884256
  • KB2888049
  • KB2891804
  • KB2892074
  • KB2893294
  • KB2893519
  • KB2894844
  • KB2900986
  • KB2908783
  • KB2911501
  • KB2912390
  • KB2918077
  • KB2919469
  • KB2931356
  • KB2937610
  • KB2943357
  • KB2952664
  • KB2966583
  • KB2968294
  • KB2970228
  • KB2972100
  • KB2972211
  • KB2973112
  • KB2973201
  • KB2973351
  • KB2977292
  • KB2978120
  • KB2978742
  • KB2984972
  • KB2985461
  • KB2991963
  • KB2992611
  • KB3003743
  • KB3004361
  • KB3004375
  • KB3006121
  • KB3006137
  • KB3010788
  • KB3011780
  • KB3013531
  • KB3019978
  • KB3020370
  • KB3021674
  • KB3021917
  • KB3022777
  • KB3023215
  • KB3030377
  • KB3031432
  • KB3035126
  • KB3035132
  • KB3037574
  • KB3042058
  • KB3045685
  • KB3046017
  • KB3046269
  • KB3054476
  • KB3055642
  • KB3059317
  • KB3060716
  • KB3067903
  • KB3068708
  • KB3071756
  • KB3072305
  • KB3074543
  • KB3075220
  • KB3076895
  • KB3078601
  • KB3078667
  • KB3080149
  • KB3084135
  • KB3086255
  • KB3092601
  • KB3092627
  • KB3093513
  • KB3097989
  • KB3101722
  • KB3107998
  • KB3108371
  • KB3108381
  • KB3108664
  • KB3109103
  • KB3109560
  • KB3110329
  • KB3115858
  • KB3115858 SP1
  • KB3122648
  • KB3124275
  • KB3126587
  • KB3127220
  • KB3133977
  • KB3137061
  • KB3138378
  • KB3138612
  • KB3138910
  • KB3139398
  • KB3139914
  • KB3140245
  • KB3147071
  • KB3150220
  • KB3155178
  • KB3156016
  • KB3156019
  • KB3159398
  • KB3161102
  • KB3161949
  • KB3161958
  • KB3170735
  • KB3170735 SP1
  • KB3172605
  • KB3177467
  • KB3179573
  • KB3184143
  • KB4019990
  • KB4040980
  • KB976902
  • KB982018
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • Package 1 for KB2656356
  • Package 1 for KB2789645
  • Package 1 for KB3115858
  • Package 1 for KB3170735
  • Package 2 for KB2585542
  • Package 2 for KB2656356
  • Package 2 for KB2789645
  • Package 2 for KB3115858
  • Package 2 for KB3170735
  • Package 3 for KB2585542
  • Package 3 for KB2656356
  • Package 4 for KB2656356
  • Package 4 for KB2789645
  • Package 5 for KB2656356
  • Package 7 for KB2656356
  • PlatformUpdate Win7 SRV08R2 Package TopLevel
  • ProfessionalEdition
  • RollupFix
  • UltimateEdition
  • WUClient SelfUpdate ActiveX
  • WUClient SelfUpdate Aux TopLevel
  • WUClient SelfUpdate Core TopLevel

Behavior activities

MALICIOUS SUSPICIOUS INFO
Detected logs from REMCOS RAT
  • edutest.exe (PID: 1636)
Application was dropped or rewritten from another process
  • edutest.exe (PID: 2612)
  • edutest.exe (PID: 3024)
  • edutest.exe (PID: 1040)
  • edutest.exe (PID: 2728)
  • edutest.exe (PID: 1636)
  • edutest.exe (PID: 1044)
  • edutest.exe (PID: 1992)
  • edutest.exe (PID: 2824)
  • edutest.exe (PID: 2868)
  • edutest.exe (PID: 2460)
  • edutest.exe (PID: 2552)
  • edutest.exe (PID: 2092)
  • edutest.exe (PID: 2208)
  • edutest.exe (PID: 2484)
  • edutest.exe (PID: 2272)
  • edutest.exe (PID: 1324)
  • edutest.exe (PID: 2312)
  • edutest.exe (PID: 1396)
  • edutest.exe (PID: 2436)
  • edutest.exe (PID: 2468)
  • edutest.exe (PID: 780)
  • edutest.exe (PID: 1680)
  • edutest.exe (PID: 2492)
  • edutest.exe (PID: 2452)
  • edutest.exe (PID: 2816)
  • edutest.exe (PID: 1416)
  • edutest.exe (PID: 2680)
  • edutest.exe (PID: 676)
  • edutest.exe (PID: 2476)
  • edutest.exe (PID: 2068)
  • edutest.exe (PID: 2796)
  • edutest.exe (PID: 2260)
  • edutest.exe (PID: 2524)
  • edutest.exe (PID: 128)
  • edutest.exe (PID: 2280)
  • edutest.exe (PID: 3052)
  • edutest.exe (PID: 2416)
  • edutest.exe (PID: 1148)
  • edutest.exe (PID: 2648)
  • edutest.exe (PID: 2836)
  • edutest.exe (PID: 2224)
  • edutest.exe (PID: 1812)
  • edutest.exe (PID: 2944)
  • edutest.exe (PID: 2632)
  • edutest.exe (PID: 1684)
  • edutest.exe (PID: 1264)
  • edutest.exe (PID: 1348)
  • edutest.exe (PID: 2380)
  • edutest.exe (PID: 1920)
  • edutest.exe (PID: 2508)
  • edutest.exe (PID: 2844)
  • edutest.exe (PID: 1624)
  • edutest.exe (PID: 304)
  • edutest.exe (PID: 2340)
  • edutest.exe (PID: 2760)
  • edutest.exe (PID: 2448)
  • edutest.exe (PID: 2636)
  • edutest.exe (PID: 712)
  • edutest.exe (PID: 2576)
  • edutest.exe (PID: 2804)
  • edutest.exe (PID: 2688)
  • edutest.exe (PID: 1376)
  • edutest.exe (PID: 1072)
  • edutest.exe (PID: 2420)
  • edutest.exe (PID: 2124)
  • edutest.exe (PID: 2004)
  • edutest.exe (PID: 2172)
  • edutest.exe (PID: 2432)
  • edutest.exe (PID: 2336)
  • edutest.exe (PID: 2204)
  • edutest.exe (PID: 2820)
  • edutest.exe (PID: 3044)
  • edutest.exe (PID: 1440)
  • edutest.exe (PID: 1492)
  • edutest.exe (PID: 1960)
  • edutest.exe (PID: 2548)
  • edutest.exe (PID: 1876)
  • edutest.exe (PID: 1576)
  • edutest.exe (PID: 3016)
  • edutest.exe (PID: 2544)
  • edutest.exe (PID: 912)
  • edutest.exe (PID: 1612)
  • edutest.exe (PID: 2848)
  • edutest.exe (PID: 3036)
  • edutest.exe (PID: 364)
  • edutest.exe (PID: 2896)
  • edutest.exe (PID: 2304)
  • edutest.exe (PID: 2496)
REMCOS RAT was detected
  • edutest.exe (PID: 1636)
Changes the autorun value in the registry
  • edutest.exe (PID: 2496)
Unusual execution from Microsoft Office
  • WINWORD.EXE (PID: 1448)
Requests a remote executable file from MS Office
  • WINWORD.EXE (PID: 1448)
Executable content was dropped or overwritten
  • WINWORD.EXE (PID: 1448)
Downloads executable files from IP
  • WINWORD.EXE (PID: 1448)
Creates files in the user directory
  • edutest.exe (PID: 1636)
  • edutest.exe (PID: 2496)
Writes files like Keylogger logs
  • edutest.exe (PID: 1636)
Application launched itself
  • edutest.exe (PID: 2496)
Executable content was dropped or overwritten
  • edutest.exe (PID: 2496)
Reads Internet Cache Settings
  • WINWORD.EXE (PID: 1448)
Reads the machine GUID from the registry
  • WINWORD.EXE (PID: 1448)
Creates files in the user directory
  • WINWORD.EXE (PID: 1448)
Reads Microsoft Office registry keys
  • WINWORD.EXE (PID: 1448)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.rtf
|   Rich Text Format (100%)

Video and screenshots

Processes

Total processes
124
Monitored processes
89
Malicious processes
3
Suspicious processes
0

Behavior graph

+
download and start start winword.exe edutest.exe edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs edutest.exe no specs #REMCOS edutest.exe
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
1448
CMD
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\CARGO MANIFEST.doc.rtf"
Path
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Microsoft Word
Version
14.0.5123.5000
Modules
Image
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\msvcr90.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_a4d981ff711297b6\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\microsoft office\office14\wwlib.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\program files\microsoft office\office14\gfx.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msimg32.dll
c:\program files\microsoft office\office14\oart.dll
c:\program files\common files\microsoft shared\office14\mso.dll
c:\windows\system32\msi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll
c:\program files\common files\microsoft shared\office14\cultures\office.odf
c:\program files\microsoft office\office14\1033\wwintl.dll
c:\program files\common files\microsoft shared\office14\1033\msointl.dll
c:\program files\common files\microsoft shared\office14\msores.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\dwmapi.dll
c:\program files\common files\microsoft shared\office14\msptls.dll
c:\windows\system32\uxtheme.dll
c:\program files\common files\microsoft shared\office14\riched20.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework64\v2.0.50727\mscorwks.dll
c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppc.dll
c:\windows\system32\winspool.drv
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\msxml6.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\profapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\wininet.dll
c:\windows\system32\userenv.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
c:\windows\system32\sxs.dll
c:\windows\system32\packager.dll
c:\windows\system32\comsvcs.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\windows\system32\scrobj.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
c:\windows\system32\vbscript.dll
c:\windows\system32\wshom.ocx
c:\windows\system32\mpr.dll
c:\windows\system32\scrrun.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wship6.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\wshqos.dll
c:\program files\common files\system\ado\msado15.dll
c:\windows\system32\msdart.dll
c:\program files\common files\microsoft shared\office14\usp10.dll
c:\program files\common files\microsoft shared\office14\1033\alrtintl.dll
c:\windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\gdiplus.dll
c:\program files\microsoft office\office14\msohev.dll
c:\program files\microsoft office\office14\msproof7.dll
c:\program files\microsoft office\office14\proof\mssp7en.dll
c:\program files\microsoft office\office14\mscss7en.dll
c:\windows\winsxs\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_08e61857a83bc251\msvcp90.dll
c:\program files\microsoft office\office14\css7data0009.dll
c:\program files\microsoft office\office14\mscss7cm_en.dub
c:\program files\microsoft office\office14\mscss7wre_en.dub
c:\program files\microsoft office\office14\proof\1033\msgr3en.dll
c:\windows\system32\spool\drivers\x64\3\unidrvui.dll
c:\windows\system32\spool\drivers\x64\3\sendtoonenoteui.dll
c:\windows\system32\spool\drivers\x64\3\mxdwdrv.dll
c:\windows\system32\fontsub.dll
c:\program files\microsoft office\office14\gkword.dll
c:\windows\system32\oleacc.dll
c:\program files\common files\system\ado\msadox.dll
c:\windows\system32\netutils.dll

PID
2496
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
Parent process
WINWORD.EXE
User
admin
Integrity Level
MEDIUM
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
c:\windows\syswow64\rpcrt4.dll
c:\windows\syswow64\sspicli.dll
c:\windows\syswow64\cryptbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
c:\windows\syswow64\gdi32.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\lpk.dll
c:\windows\syswow64\usp10.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\comdlg32.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\iphlpapi.dll
c:\windows\syswow64\nsi.dll
c:\windows\syswow64\winnsi.dll
c:\windows\syswow64\mpr.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\userenv.dll
c:\windows\syswow64\profapi.dll
c:\windows\syswow64\uxtheme.dll
c:\windows\syswow64\version.dll
c:\windows\syswow64\wininet.dll
c:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
c:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
c:\windows\syswow64\normaliz.dll
c:\windows\syswow64\iertutil.dll
c:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\wsock32.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\imm32.dll
c:\windows\syswow64\msctf.dll
c:\windows\syswow64\cryptsp.dll
c:\windows\syswow64\rsaenh.dll
c:\windows\syswow64\apphelp.dll

PID
2304
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1612
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
364
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
3036
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2544
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2896
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
912
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
3016
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2848
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1576
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1876
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2548
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2432
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1960
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2820
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2004
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2204
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1492
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2688
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2172
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2336
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1376
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2124
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1440
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2804
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1072
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2420
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
3044
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2576
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
304
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2340
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2448
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2760
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2636
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2844
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
712
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1624
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1920
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2380
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1348
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2508
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2632
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1264
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1684
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2944
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1812
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2280
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2416
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2224
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
3052
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1148
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2836
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2648
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
128
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2524
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2260
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2816
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
676
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2796
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2680
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2068
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1416
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2476
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2492
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2484
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2436
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1680
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2452
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2312
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1396
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2208
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1324
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2468
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
780
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2092
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2460
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2552
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2272
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2728
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2868
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2824
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
2612
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1040
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1044
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1992
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
3024
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
No indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll

PID
1636
CMD
"C:\Users\admin\AppData\Roaming\edutest.exe"
Path
C:\Users\admin\AppData\Roaming\edutest.exe
Indicators
Parent process
edutest.exe
User
admin
Integrity Level
MEDIUM
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\roaming\edutest.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
c:\windows\syswow64\rpcrt4.dll
c:\windows\syswow64\sspicli.dll
c:\windows\syswow64\cryptbase.dll
c:\windows\syswow64\gdi32.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\lpk.dll
c:\windows\syswow64\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\msvcp60.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\urlmon.dll
c:\windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
c:\windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\syswow64\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\syswow64\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\syswow64\version.dll
c:\windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
c:\windows\syswow64\normaliz.dll
c:\windows\syswow64\iertutil.dll
c:\windows\syswow64\wininet.dll
c:\windows\syswow64\userenv.dll
c:\windows\syswow64\profapi.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\nsi.dll
c:\windows\syswow64\imm32.dll
c:\windows\syswow64\msctf.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\mswsock.dll
c:\windows\syswow64\wshtcpip.dll
c:\windows\syswow64\nlaapi.dll
c:\windows\syswow64\napinsp.dll
c:\windows\syswow64\pnrpnsp.dll
c:\windows\syswow64\dnsapi.dll
c:\windows\syswow64\winrnr.dll
c:\windows\syswow64\iphlpapi.dll
c:\windows\syswow64\winnsi.dll
c:\windows\syswow64\fwpuclnt.dll
c:\windows\syswow64\rasadhlp.dll

Registry activity

Total events
1307
Read events
1230
Write events
73
Delete events
4

Modification events

PID
Process
Operation
Key
Name
Value
1448
WINWORD.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
1448
WINWORD.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\7733B0
1448
WINWORD.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery
1448
WINWORD.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
dd}
64647D00A8050000010000000000000000000000
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
Off
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
On
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
WORDFiles
1320091690
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
1320091782
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
1320091783
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTT
A80500009CB86811130BD50100000000
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
'i}
27697D00A805000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
ProxyBypass
1
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
IntranetName
1
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
1
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
0
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
2m}
326D7D00A805000006000000010000006C000000020000005C0000000400000063003A005C00750073006500720073005C00610064006D0069006E005C006400650073006B0074006F0070005C0063006100720067006F0020006D0061006E00690066006500730074002E0064006F0063002E00720074006600000000000000
1448
WINWORD.EXE
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\65\52C64B7E
LanguageList
en-US
1448
WINWORD.EXE
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\65\52C64B7E
@%SystemRoot%\system32\packager.dll,-2000
Package
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000078000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
CachePrefix
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
CachePrefix
Cookie:
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
CachePrefix
Visited:
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
GraphicsFiltersPNGFilesIntl_1033
1320091649
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
{E96D6DA7-9AEF-4198-AAFC-FE5AA0E82315}
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU
Max Display
25
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU
Item 1
[F00000000][T01D50B13166B69C0][O00000000]*C:\Users\admin\Desktop\
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU
Max Display
25
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU
Item 1
[F00000000][T01D50B13166DB3B0][O00000000]*C:\Users\admin\Desktop\CARGO MANIFEST.doc.rtf
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
ProductNonBootFilesIntl_1033
1320091654
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
ProductNonBootFilesIntl_1033
1320091655
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
ProductNonBootFilesIntl_1033
1320091656
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
ProductNonBootFilesIntl_1033
1320091657
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\7733B0
7733B0
04000000A80500002D00000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C0043004100520047004F0020004D0041004E00490046004500530054002E0064006F0063002E007200740066001200000043004100520047004F0020004D0041004E00490046004500530054002E0064006F00630000000000010000000000000026085811130BD501B0337700B033770000000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Licensing
C0AC079DA84B4CBD8DBAF1BB44146899
01000000270000007B39303134303030302D303033442D303030302D313030302D3030303030303046463143457D005A0000004F00660066006900630065002000310034002C0020004F0066006600690063006500500072006F00660065007300730069006F006E0061006C002D00520065007400610069006C002000650064006900740069006F006E000000
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
1320091697
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
1320091698
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
1320091697
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
1320091698
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1320091722
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1320091723
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
1320091699
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
SpellingAndGrammarFiles_3082
1320091700
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
1320091699
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
SpellingAndGrammarFiles_1036
1320091700
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1320091724
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1320091725
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1320091726
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1320091727
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1320091728
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1320091729
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Toolbars\Settings
Microsoft Word
0101000000000000000006000000
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
1320091784
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
1320091785
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU
Item 1
[F00000000][T01D50B13297BC8C0][O00000000]*C:\Users\admin\Desktop\
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU
Item 1
[F00000000][T01D50B13297E39C0][O00000000]*C:\Users\admin\Desktop\CARGO MANIFEST.doc.rtf
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\7733B0
7733B0
04000000A80500002D00000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C0043004100520047004F0020004D0041004E00490046004500530054002E0064006F0063002E007200740066001200000043004100520047004F0020004D0041004E00490046004500530054002E0064006F0063000000000001000000000000000C757929130BD501B0337700B033770000000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Data
Settings
C00054033001000034010000040000001E0000001E0000001E0000001E0000001E0000001E000000220000001E0000001E0000001E000000060000000600000006000000060000000600000000000000060000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000C00000002000000020000000200000002000000000000000000000000000000480000000600000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000DC000000E25024A1100A00633090060009000A002D005800000058000000C0030000F501000004060300000000000000000000000000040087010C000600C80009000180FFFF000006000000040000000C0100000502000000000000A004020000001200000000603090000064000000000000FF0000FF000000000000FF01000000010000005C08E0100000000000010000E40400001D000100000000000000020050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D000000000000000000000000D4944600D49446010000002F91010000080A000600000003333296040000000A050C0C0302040600000300000101010606060000000000000000000000000000000000000063631900000001000000000000000000000000000000030000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000002100190000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006301190000008C0A00000000E01000004B0000004B0000002000640000006301190000008C0A00000000B01300004B0000004B000000640000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000009002000002000001010101010101000101010101010001010100010001000101010101010101000100020003010301030103000301020003010301030103010000230101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101020101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010301010101010101010101010101FFFFCFFFFFFF00008602FFFF00008602FFFF00001000FFFF00000100FFFF00000100FFFF0000010061000000610064006D0069006E000000000000000000000087FFFF0300003E00020200000600090034000000000090009000000000000F000000FFFFFF000000000000001400140000000000000002637800C80000000000140000000000900090008000FFFF00001000FFFF00001000FFFF0B00040001002000018014000B0043006F007500720069006500720020004E0065007700018014000B0043006F007500720069006500720020004E0065007700018014000B0043006F007500720069006500720020004E00650077000180140001002000018014000B0043006F007500720069006500720020004E00650077000180140009004D005300200047006F0074006800690063000180150007004D0069006E0067004C0069005500018018000600530069006D00530075006E0001801500050044006F00740075006D00018014000100200001801C0000000000
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Options
BackgroundOpen
0
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
1320091786
1448
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
1320091787
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTF
516
1448
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTA
516
2496
edutest.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
Load
C:\Users\admin\AppData\Roaming\RdpSa\wscript.exe
1636
edutest.exe
write
HKEY_CURRENT_USER\Software\Replay14519-PNG2NB
exepath
761D2B8863D14562EDE11EDC92EDC6C0EF07EFE41713D9FE7BCC9ABFBCD1DB5F6A417E383443491C29F2C9EC2FF762F6F4CFEF846C43A0E16A97DC6C474915E24A994E331485AC18046B3FA1363A3F1640C2EC6D5E18
1636
edutest.exe
write
HKEY_CURRENT_USER\Software\Replay14519-PNG2NB
licence
59B2A3C7EDD5E6516B6B4DC0A3CD9E1B

Files activity

Executable files
3
Suspicious files
1
Text files
7
Unknown types
3

Dropped files

PID
Process
Filename
Type
2496
edutest.exe
C:\Users\admin\AppData\Roaming\RdpSa\wscript.exe
executable
MD5: 89064f954e18424e704eb54b168eb4b9
SHA256: 7592e2d9d9a1bead3e362f6567f21f7342c04614ce4a050fad06a11744f3e37c
1448
WINWORD.EXE
C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\test1chima[1].exe
executable
MD5: b3b8215152ce77d6e5a800732941871b
SHA256: 37cc219cef364820e99331ffe0b0e4f2c4d9a9a4a8d3363c935b9a82d66cf44f
1448
WINWORD.EXE
C:\Users\admin\AppData\Roaming\edutest.exe
executable
MD5: b3b8215152ce77d6e5a800732941871b
SHA256: 37cc219cef364820e99331ffe0b0e4f2c4d9a9a4a8d3363c935b9a82d66cf44f
1448
WINWORD.EXE
C:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
text
MD5: f3b25701fe362ec84616a93a45ce9998
SHA256: b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
1448
WINWORD.EXE
C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{AA2A4C70-D225-4E29-BCFF-D832063A298A}.tmp
––
MD5:  ––
SHA256:  ––
1448
WINWORD.EXE
C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{EC3CF8F0-0196-42A9-84C8-E53E7C3CEBE3}.tmp
––
MD5:  ––
SHA256:  ––
1448
WINWORD.EXE
C:\Users\admin\Desktop\CARGO MANIFEST.doc.rtf
text
MD5: f3ff489d118b7b661cf6964f8337c118
SHA256: be5c3ba9ea7fe28f7fb54656aa5e18341df600ec9f7edee56079527b3819c5b1
1448
WINWORD.EXE
C:\Users\admin\Desktop\~WRL0001.tmp
text
MD5: f3ff489d118b7b661cf6964f8337c118
SHA256: be5c3ba9ea7fe28f7fb54656aa5e18341df600ec9f7edee56079527b3819c5b1
1448
WINWORD.EXE
C:\Users\admin\Desktop\~WRD0000.tmp
––
MD5:  ––
SHA256:  ––
1448
WINWORD.EXE
C:\Users\admin\AppData\Local\Temp\CVRDCE4.tmp.cvr
––
MD5:  ––
SHA256:  ––
1448
WINWORD.EXE
C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\CARGO MANIFEST.doc.LNK
lnk
MD5: ea8a7fbed483ca4f63f11ecd6ef45fd4
SHA256: 3c2aae25bfb4e4bf71e6aa65bc2be079883373c994c818e7356723a681073218
1448
WINWORD.EXE
C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
text
MD5: 25d7b5bc5a6389ba899be0fe1a858bbc
SHA256: 5e7c55ed9cbbe0c8d68f55aae9c07ff6a8bc44585b4aff666f61301a477b406c
1448
WINWORD.EXE
C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\68289466.png
––
MD5:  ––
SHA256:  ––
1448
WINWORD.EXE
C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{36090C34-38CC-4C96-8F3F-E92E6D256A38}.tmp