f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8

Interactive malware hunting service

General Info

File name: f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8.doc

Full analysis: https://app.any.run/tasks/3aa6f8dc-d955-4d47-b72e-dbe3a73afe86

Verdict: Malicious activity

Analysis date: 11/13/2018, 11:33:00

OS:: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)

Tags:: macros

macros-on-open

generated-doc

Indicators:

MIME:: application/msword

File info:: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: bjricopawo, Template: Normal, Last Saved By: AdminPC7, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 01:00, Create Time/Date: Wed Oct 31 15:44:00 2018, Last Saved Time/Date: Wed Oct 31 15:44:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 2, Security: 0

MD5: 107690af267e719dc1fd549832663560

SHA1: 99b2c58afc0919fcce921d89191cfc9b9703d486

SHA256: f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8

SSDEEP: 12288:HlfCLKW9GfvTZVerxa3FBK448OK5CuO3oNs7d:FftXvT3eryDEZu8oNc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration: 60 seconds

Additional time used: none

Fakenet option: off

Heavy Evaision option: off

MITM proxy: off

Route via Tor: off

Network geolocation: off

Privacy: Public submission

Autoconfirmation of UAC: on

Software preset

Internet Explorer 8.0.7601.17514
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (68.0.3440.106)
Google Update Helper (1.3.33.17)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Behavior activities

MALICIOUS	SUSPICIOUS	INFO
Application was dropped or rewritten from another process cesar.exe (PID: 2128) Executable content was dropped or overwritten WINWORD.EXE (PID: 1388) Unusual execution from Microsoft Office WINWORD.EXE (PID: 1388)	No suspicious indicators.	Creates files in the user directory WINWORD.EXE (PID: 1388) Reads Microsoft Office registry keys WINWORD.EXE (PID: 1388)

MALICIOUS

SUSPICIOUS

INFO

Application was dropped or rewritten from another process

cesar.exe (PID: 2128)

Executable content was dropped or overwritten

WINWORD.EXE (PID: 1388)

Unusual execution from Microsoft Office

WINWORD.EXE (PID: 1388)

No suspicious indicators.

Creates files in the user directory

WINWORD.EXE (PID: 1388)

Reads Microsoft Office registry keys

WINWORD.EXE (PID: 1388)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD

.doc

| Microsoft Word document (54.2%)

.doc

| Microsoft Word document (old ver.) (32.2%)

EXIF

Author:

bjricopawo

Template:

Normal

LastModifiedBy:

AdminPC7

RevisionNumber:

Software:

Microsoft Office Word

TotalEditTime:

1.0 minutes

CreateDate:

2018:10:31 15:44:00

ModifyDate:

2018:10:31 15:44:00

Pages:

Words:

null

Characters:

Security:

None

CodePage:

Windows Latin 1 (Western European)

Company:

bjricopawo

Lines:

Paragraphs:

CharCountWithSpaces:

AppVersion:

ScaleCrop:

LinksUpToDate:

SharedDoc:

HyperlinksChanged:

TitleOfParts:

null

HeadingPairs

null

CompObjUserTypeLen:

CompObjUserType:

Microsoft Word 97-2003 Document

Screenshots

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 27559 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 28563 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 29564 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 30565 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 31577 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 32588 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 35589 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 36597 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 42762 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 46911 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 51932 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 57991 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 65061 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 66072 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 67075 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 69085 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 70097 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 80197 ms from task started

Screenshot of f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8 taken from 81209 ms from task started

Processes

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

–

Specs description

Program did not start

Integrity level elevation

Task сontains an error or was rebooted

Process has crashed

Task contains several apps running

Executable file was dropped

Debug information is available

Process was injected

Network attacks were detected

Application downloaded the executable file

Actions similar to stealing personal data

Behavior similar to exploiting the vulnerability

Inspected object has sucpicious PE structure

File is detected by antivirus software

CPU overrun

RAM overrun

Process starts the services

Process was added to the startup

Behavior similar to spam

Low-level access to the HDD

Probably Tor was used

System was rebooted

Connects to the network

Known threat

Process information

Click at the process to see the details.

PID: 1388

CMD: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\f5f8ab9863dc12d04731b1932fc3609742de68252c706952f31894fc21746bb8.doc"

Path: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Indicators

Parent process: ––

User: admin

Integrity Level: MEDIUM

Version:

Company: Microsoft Corporation

Description: Microsoft Word

Version: 14.0.6024.1000

Modules

Image
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\microsoft office\office14\wwlib.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\program files\microsoft office\office14\gfx.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msimg32.dll
c:\program files\microsoft office\office14\oart.dll
c:\program files\common files\microsoft shared\office14\mso.dll
c:\windows\system32\msi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\apphelp.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\program files\common files\microsoft shared\office14\cultures\office.odf
c:\program files\microsoft office\office14\1033\wwintl.dll
c:\program files\common files\microsoft shared\office14\1033\msointl.dll
c:\program files\common files\microsoft shared\office14\msores.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\dwmapi.dll
c:\program files\common files\microsoft shared\office14\msptls.dll
c:\windows\system32\uxtheme.dll
c:\program files\common files\microsoft shared\office14\riched20.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll
c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppc.dll
c:\windows\system32\winspool.drv
c:\windows\system32\shell32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\devobj.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\msxml6.dll
c:\windows\system32\profapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\sspicli.dll
c:\progra~1\common~1\micros~1\vba\vba7\vbe7.dll
c:\program files\microsoft office\office14\gkword.dll
c:\program files\common files\microsoft shared\office14\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\spool\drivers\w32x86\3\unidrvui.dll
c:\windows\system32\spool\drivers\w32x86\3\sendtoonenoteui.dll
c:\windows\system32\inked.dll
c:\windows\system32\msftedit.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\sxs.dll
c:\progra~1\common~1\micros~1\vba\vba7\1033\vbe7intl.dll
c:\windows\system32\fm20.dll
c:\windows\system32\comdlg32.dll
c:\program files\common files\microsoft shared\ink\inkobj.dll
c:\windows\system32\atl.dll
c:\program files\common files\microsoft shared\ink\mshwlatin.dll
c:\windows\system32\slc.dll
c:\program files\common files\microsoft shared\ink\mshwgst.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\program files\common files\microsoft shared\ink\tpcps.dll
c:\windows\system32\mf3216.dll
c:\windows\system32\fm20enu.dll
c:\windows\system32\scrrun.dll
c:\windows\system32\wshom.ocx
c:\windows\system32\mpr.dll
c:\users\admin\contacts\cesar.exe
c:\program files\microsoft office\office14\msproof7.dll
c:\program files\microsoft office\office14\proof\1033\msgr3en.dll
c:\windows\system32\spool\drivers\w32x86\3\mxdwdrv.dll
c:\windows\system32\fontsub.dll

PID: 2128

CMD: C:\Users\admin\Contacts\cesar.exe //E:jscript C:\Users\admin\AppData\Local\Temp\settings.txt

Path: C:\Users\admin\Contacts\cesar.exe

Indicators: No indicators

Parent process: WINWORD.EXE

User: admin

Integrity Level: MEDIUM

Version:

Company: Microsoft Corporation

Description: Microsoft ® Console Based Script Host

Version: 5.8.7600.16385

Modules

Image
c:\users\admin\contacts\cesar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\sxs.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\jscript.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\msisip.dll
c:\windows\system32\wshext.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\windowspowershell\v1.0\pwrshsip.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\wshom.ocx
c:\windows\system32\mpr.dll
c:\windows\system32\scrrun.dll
c:\windows\system32\wbem\wbemdisp.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbem\wmiutils.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll

Registry activity

Total events

1289

Read events

870

Write events

418

Delete events

Modification events

PID

Process

Operation

Key

Name

Value

1388

WINWORD.EXE

delete key

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

1388

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

z*h

7A2A68006C050000010000000000000000000000

1388

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages

1033

Off

1388

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages

1033

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage

WORDFiles

1298989071

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage

ProductFiles

1298989184

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage

ProductFiles

1298989185

1388

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word

MTTT

6C050000B887A64F3C7BD40100000000

1388

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

q,h

712C68006C05000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000

1388

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap

UNCAsIntranet

1388

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap

AutoDetect

1388

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

*-h

2A2D68006C0500000600000001000000DE00000002000000CE0000000400000063003A005C00750073006500720073005C00610064006D0069006E005C0061007000700064006100740061005C006C006F00630061006C005C00740065006D0070005C0066003500660038006100620039003800360033006400630031003200640030003400370033003100620031003900330032006600630033003600300039003700340032006400650036003800320035003200630037003000360039003500320066003300310038003900340066006300320031003700340036006200620038002E0064006F006300000000000000

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage

VBAFiles

1298989060

1388

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

{33DFB210-38AD-424B-A72B-A2A3885775E9}

1388

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU

Max Display

1388

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU

Max Display

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\TypeLib\{7C7C9C4D-69DB-4254-BC8D-4E195AA6AADC}\2.0

Microsoft Forms 2.0 Object Library

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\TypeLib\{7C7C9C4D-69DB-4254-BC8D-4E195AA6AADC}\2.0\FLAGS

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\TypeLib\{7C7C9C4D-69DB-4254-BC8D-4E195AA6AADC}\2.0\0\win32

C:\Users\admin\AppData\Local\Temp\VBE\MSForms.exd

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\TypeLib\{7C7C9C4D-69DB-4254-BC8D-4E195AA6AADC}\2.0\HELPDIR

C:\Users\admin\AppData\Local\Temp\VBE

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}

Font

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}

IDataAutoWrapper

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}

IReturnInteger

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}

IReturnBoolean

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}

IReturnString

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}

IReturnSingle

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}

IReturnEffect

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}

IControl

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}

Controls

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}

IOptionFrame

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}

_UserForm

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}

ControlEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}

FormEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}

OptionFrameEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}

ILabelControl

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}

ICommandButton

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}

IMdcText

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}

IMdcList

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}

IMdcCombo

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}

IMdcCheckBox

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}

IMdcOptionButton

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}

IMdcToggleButton

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}

IScrollbar

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}

Tab

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}

Tabs

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}

ITabStrip

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}

ISpinbutton

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{4C599243-6926-101B-9992-00000B65C6F9}

IImage

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLSubmitButton

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLImage

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLReset

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLCheckbox

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLOption

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLText

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLHidden

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLPassword

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLSelect

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}

IWHTMLTextArea

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}

LabelControlEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}

CommandButtonEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}

MdcTextEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}

MdcListEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}

MdcComboEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}

MdcCheckBoxEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}

MdcOptionButtonEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}

MdcToggleButtonEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}

ScrollbarEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}

TabStripEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}

SpinbuttonEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}

ImageEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}

WHTMLControlEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents1

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents2

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents3

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents4

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents5

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents6

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents7

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents9

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}

WHTMLControlEvents10

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}

IPage

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}

Pages

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}

IMultiPage

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}

MultiPageEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\TypeLib\{1FB27358-722F-446D-8DDB-99F4E4A90CF2}\1.0

Microsoft InkEdit Control 1.0

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\TypeLib\{1FB27358-722F-446D-8DDB-99F4E4A90CF2}\1.0\FLAGS

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\TypeLib\{1FB27358-722F-446D-8DDB-99F4E4A90CF2}\1.0\0\win32

C:\Users\admin\AppData\Local\Temp\Word8.0\INKEDLib.exd

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\TypeLib\{1FB27358-722F-446D-8DDB-99F4E4A90CF2}\1.0\HELPDIR

C:\Users\admin\AppData\Local\Temp\Word8.0

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{F2127A19-FBFB-4AED-8464-3F36D78CFEFB}

IInkEdit

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{BF519B75-0A15-4623-ADC9-C00D436A8092}

IInkDrawingAttributes

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{89F2A8BE-95A9-4530-8B8F-88E971E3E25F}

IInkExtendedProperties

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{DB489209-B7C3-411D-90F6-1548CFFF271E}

IInkExtendedProperty

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{782BF7CF-034B-4396-8A32-3A1833CF6B56}

IInkRecognizer

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{C68F52F9-32A3-4625-906C-44FC23B40958}

IInkRecognizerContext

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{F1F4C9D8-590A-4963-B3AE-1935671BB6F3}

IInkStrokes

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{9D398FA0-C4E2-4FCD-9973-975CAAF47EA6}

IInkDisp

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{7E23A88F-C30E-420F-9BDB-28902543F0C1}

IInkCustomStrokes

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{9794FF82-6071-4717-8A8B-6AC7C64A686E}

IInkRectangle

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{43242FEA-91D1-4A72-963E-FBB91829CFA2}

IInkStrokeDisp

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{615F1D43-8703-4565-88E2-8201D2ECD7B7}

IInkTransform

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{3BC129A8-86CD-45AD-BDE8-E0D32D61C16D}

IInkRecognitionResult

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{B7E660AD-77E4-429B-ADDA-873780D1FC4A}

IInkRecognitionAlternate

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{286A167F-9F19-4C61-9D53-4F07BE622B84}

IInkRecognitionAlternates

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{D934BE07-7B84-4208-9136-83C20994E905}

IInkRecognizerGuide

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{76BA3491-CB2F-406B-9961-0E0C4CDAAEF2}

IInkWordList

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{E3B0B797-A72E-46DB-A0D7-6C9EBA8E9BBC}

_IInkEditEvents

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{AD30C630-40C5-4350-8405-9C71012FC558}

IInkCursor

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{2DE25EAA-6EF8-42D5-AEE9-185BC81B912D}

IInkTablet

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{3671CC40-B624-4671-9FA0-DB119D952D54}

IInkCursorButtons

1388

WINWORD.EXE

write

HKEY_CLASSES_ROOT\Interface\{85EF9417-1D59-49B2-A13C-702C85430894}

IInkCursorButton

1388

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\5DB8EC

5DB8EC

040000006C0500006600000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0066003500660038006100620039003800360033006400630031003200640030003400370033003100620031003900330032006600630033003600300039003700340032006400650036003800320035003200630037003000360039003500320066003300310038003900340066006300320031003700340036006200620038002E0064006F0063004400000066003500660038006100620039003800360033006400630031003200640030003400370033003100620031003900330032006600630033003600300039003700340032006400650036003800320035003200630037003000360039003500320066003300310038003900340066006300320031003700340036006200620038002E0064006F00630000000000010000000000000042D7954F3C7BD401ECB85D00ECB85D0000000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

1298989081

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

1298989082

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

1298989081

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

1298989082

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1298989098

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1298989099

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

1298989083

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00000000000F01FEC\Usage

SpellingAndGrammarFiles_3082

1298989084

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

1298989083

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400000000000F01FEC\Usage

SpellingAndGrammarFiles_1036

1298989084

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1298989100

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1298989101

1388

WINWORD.EXE

write

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Licensing

019C826E445A4649A5B00BF08FCC4EEE

01000000270000007B39303134303030302D303033442D303030302D303030302D3030303030303046463143457D005A0000004F00660066006900630065002000310034002C0020004F0066006600690063006500500072006F00660065007300730069006F006E0061006C002D00520065007400610069006C002000650064006900740069006F006E000000

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1298989102

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1298989103

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1298989104

1388

WINWORD.EXE

write

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage

SpellingAndGrammarFiles_1033

1298989105

1388

WINWORD.EXE

write