26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ae,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 0160375e19e6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0160375e19e6…. Malware family: Trojan.Generic. Threat score 100/100. 12/28 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1"],"about":{"@type":"SoftwareApplication","name":"Salary_Lockheed_Martin_job_opportunities_confidential.doc","applicationCategory":["doc","office"],"identifier":"0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T68c,Normalized macro string: "httpk/kg6whzpxyemb2lqdp9kkz8nf5krog5h0m+fprv+c8qarvagx4ufdd+hqssaz/eukaubjrsk2gluu5aj" Normalized macro string: "t3TzCNeIhqxKttPK/Kg6WhZpxYemB2LqDP9KkZ8NF5kROG5h0m+fPRV+C8QarVAGX4ufDD+HqssAZ/EukaUBJRsk2GLuu5aj" Normalized macro string: "httpncd42nffibh" Normalized macro string: "LsPyjHCWDEaWXFG9pXsGGnJVFppwtWcIPtf3rBpjlONNlz1zciiGTdq4r142d4D2sxVyNSw7rfsCkgfVkozIiij8BLCURh2N" Normalized macro string: "httpj" Normalized macro string: "5edNaoyEVELpg3z0h7c8/ZG3qZ31tjLef3hmcryXLj+V9TE1E4ofB4ntHJvR6gpVW1Ilelecggtv5S5jFOMuGeUZnH4ddfko" Normalized macro string: "httpmew6k0p" Normalized macro string: "nxY4ALgY0fnhwVUEb1VTaaasbjstY1TZAWyPVWuUH9BmMNFMu/WEg0bv50lwxedlRdj6TawmOVNkm46O7wF0bXcmEcNPSEsy" Normalized macro string: "httpqsi" Normalized macro string: "jPVMDBpldygPfFv4GKR7XHLrrS0HqQ3S2h8O66FCIBKIDDVpsnOLJDTvcshBZto/D3SeP/9pYxyqEg5mO7S/p+XvCibKpN2E" Normalized macro string: "RVSTMya6w0hO7v/dQJQ26Jlu2kgTsRhK7RVMf7zYQZ/d8vNtAJW1KDdxCaBv/5g6xszptnmF4NHkZMW5rN0SVXWJiI7EmvYL" Normalized macro string: "httpq" Normalized macro string: "c8dZOP7BwWusGKN0uilbCL71oJcm/0ROGGtD9gdltOUJdcpvbUyLDhT7aVj3d7M+ytg9yjWm20rWPxsLyLKNu/Pq3hxLDECL" Normalized macro string: "httpgpvccnsbgsv7r2l86defjd" Normalized macro string: "uerBOio65pH6RcfMUmpvAnLKODErgPMvMdd+PyduD7l4XB4+gnx85HRKfaxYvZMRW0SgDVktTpgPVcCNsbGsv7r2L86dEFJD" Normalized macro string: "httph/" Normalized macro string: "qX53V6q7xrMNqXsDtIbHADayZBVTZ+QOwCa85OQ5iZKT9VW6rHMhR7S6n47pixXuhFungDiuTECHD3EXHcL4fIMyuYO/QMaJ" Normalized macro string: "httpxrj" Normalized macro string: "SeT6lPZk9lCgAPnHnPgcz70wzbeC4kUzt2bSQdwRRZZdtyS8yVIk9uL9PmpZF74Ot/s9XItwrqhMdBLqRGcHGjajaK6NjqcQ"28:T6f8,"\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-DDA5D3D7" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-38D16874" "\Sessions\1\BaseNamedObjects\Local\CSI_OMTX:{826A1C16-6F20-4414-AC28-D0A368CBCF82}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{583E1D7C-0341-4A74-BDDD-D124C6F2EC7F}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{150FED4D-8C23-4DDB-84FC-E7007A11633B}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{826A1C16-6F20-4414-AC28-D0A368CBCF82}" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-E44E7E6F" "\Sessions\1\BaseNamedObjects\Global\MsoCsi:GC:C:/Users/lRiOGEA/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-6A004CAC" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-251BADA0" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-4A73C104" "\Sessions\1\BaseNamedObjects\Local\CSI_OMTX:{BA350B42-7309-4F59-A8BB-AD9BE85ECCED}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{B3B8E3A5-1D0D-46F8-BDAB-72E4DE12BB3C}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{7E70934F-BE11-4049-BC3D-3717512CC22E}" "\Sessions\1\BaseNamedObjects\Local\CSI_WDW:{BA350B42-7309-4F59-A8BB-AD9BE85ECCED}" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-73DC824A" "\Sessions\1\BaseNamedObjects\Global\MsoCsi:GC:C:/Users/lRiOGEA/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF" "\Sessions\1\BaseNamedObjects\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-5DBE94C7" "\Sessions\1\BaseNamedObjects\Local\Csi_CTTxnLock:{07020C21-AADF-4299-889F-34E95453F00E}" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-E44E7E6F"29:Tb6f,"WindowsMediaPlayerVxEncdSrv.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\WMAuthorization\WindowsMediaPlayerVxEncdSrv.exe]- [targetUID: 00000000-00002908] "WMVxEncd.vbs" has type "ASCII text with CRLF line terminators"- Location: [C:\WMAuthorization\WMVxEncd.vbs]- [targetUID: 00000000-00002908] "Salary_Lockheed_Martin_job_opportunities_confidential.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Tue Sep 20 00:26:59 2022 mtime=Tue Sep 20 00:26:59 2022 atime=Tue Sep 20 00:26:16 2022 length=1293824 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\Salary_Lockheed_Martin_job_opportunities_confidential.LNK]- [targetUID: 00000000-00002908] "~_lary_Lockheed_Martin_job_opportunities_confidential.doc" has type "data"- [targetUID: 00000000-00002908] "WMPlaybackSrv.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\WMAuthorization\WMPlaybackSrv.exe]- [targetUID: 00000000-00002908] "WindowsHolographicUpdateMeta.lib" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\WMAuthorization\WindowsHolographicUpdateMeta.lib]- [targetUID: 00000000-00002908] "index.dat" has type "data"- Location: [%APPDATA%\Microsoft\Office\Recent\index.dat]- [targetUID: 00000000-00002908] "FSF-_0E1EEE64-E8C6-4E2A-9759-63CF07FD8988_.FSF" has type "data"- [targetUID: 00000000-00002908] "E34CB937.wmf" has type "Targa image data - Map - RLE 14 x 65536 x 0 +2 "\004""- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\E34CB937.wmf]- [targetUID: 00000000-00002908] "~WRD0000.tmp" has type "CDFV2 Microsoft Word"- Location: [C:\~WRD0000.tmp]- [targetUID: 00000000-00002908] "FSD-_38FFE4AD-7BB1-4A75-AFD0-2F5EB9E3A1D4_.FSD" has type "data"- [targetUID: 00000000-00002908] "331051CC.wmf" has type "Targa image data - Map - RLE 14 x 65536 x 0 +2 "\004""- Location: [%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.MSO\331051CC.wmf]- [targetUID: 00000000-00002908] "_21BE32E8-B06C-425E-AAB5-687F10D4E00A_" has type "data"- [targetUID: 00000000-00002908] "_8EA93CFA-8D2F-4CB0-B176-460C4BB1187A_" has type "data"- [targetUID: 00000000-00002908] "WMPlaybackSrvMeta.lib" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [C:\WMAuthorization\WMPlaybackSrvMeta.lib]- [targetUID: 00000000-00002908] "FSD-CNRY.FSD" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD]- [targetUID: 00000000-00002908] "FSD-_091F7388-ED07-4E12-9010-6881429444CF_.FSD" has type "data"- [targetUID: 00000000-00002908] "MSForms.exd" has type "data"- Location: [%TEMP%\Word8.0\MSForms.exd]- [targetUID: 00000000-00002908] "FSF-CTBL.FSF" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF]- [targetUID: 00000000-00002908]2a:T1f0d,"WINWORD.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 148a0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 148a0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 148a0000 "WINWORD.EXE" loaded module "KERNEL32" at base 16610000 "WINWORD.EXE" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base f6840000 "WINWORD.EXE" loaded module "IMM32.DLL" at base 16850000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base dc030000 "WINWORD.EXE" loaded module "WWLIB.DLL" at base d2db0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSO.DLL" at base cf880000 "WINWORD.EXE" loaded module "MSO.DLL" at base cf880000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base fed50000 "WINWORD.EXE" loaded module "KERNEL32.DLL" at base 16610000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 3200000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\1033\WWINTL.DLL" at base 3620000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 11ae0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 3820000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base 3a90000 "WINWORD.EXE" loaded module "DWMAPI.DLL" at base 11ef0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 15220000 "WINWORD.EXE" loaded module "SRPAPI.DLL" at base 4dd0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 16610000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSPTLS.DLL" at base e09d0000 "WINWORD.EXE" loaded module "UXTHEME.DLL" at base 11ae0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base dfd90000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base f2e50000 "WINWORD.EXE" loaded module "ADVAPI32.DLL" at base 15220000 "WINWORD.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base f0150000 "WINWORD.EXE" loaded module "SHLWAPI.DLL" at base 16b60000 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 13500000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 63550000 "WINWORD.EXE" loaded module "RPCRT4.DLL" at base 15bd0000 "WINWORD.EXE" loaded module "WINSPOOL.DRV" at base dc950000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base faf0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base c030000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 14c50000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base a3f0000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 6b80000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPCLIENT.DLL" at base e0140000 "WINWORD.EXE" loaded module "USER32.DLL" at base 16380000 "WINWORD.EXE" loaded module "SHELL32.DLL" at base 152d0000 "WINWORD.EXE" loaded module "POWRPROF.DLL" at base 14380000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base e220000 "WINWORD.EXE" loaded module "OLEAUT32.DLL" at base 16530000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 5b90000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 2ce0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 148a0000 "WINWORD.EXE" loaded module "SSPICLI.DLL" at base 13750000 "WINWORD.EXE" loaded module "VERSION.DLL" at base a3f0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\GKWORD.DLL" at base dee50000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WINDOWS.SYSTEM.LAUNCHER.DLL" at base ad60000 "WINWORD.EXE" loaded module "GDI32.DLL" at base 16190000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\USP10.DLL" at base 63020000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base f9ac0000 "WINWORD.EXE" loaded module "VIRTDISK.DLL" at base dd630000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 124b0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FM20.DLL" at base 62e90000 "WINWORD.EXE" loaded module "CSCAPI.DLL" at base 1a50000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\VBE7.DLL" at base 62b00000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\1033\VBE7INTL.DLL" at base d1f0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FM20ENU.DLL" at base ec10000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 16910000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 16790000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 16380000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 16380000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 15220000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 15df0000 "WINWORD.EXE" loaded module "GDIPLUS.DLL" at base ee330000 "WINWORD.EXE" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.22621.1635_NONE_57FA636ACE18905C\GDIPLUS.DLL" at base ee330000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\USP10.DLL" at base 0 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 11ef0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSPROOF7.DLL" at base ee2d0000 "WINWORD.EXE" loaded module "WMVCORE.DLL" at base de900000 "WINWORD.EXE" loaded module "NTDLL" at base 17090000 "WINWORD.EXE" loaded module "VBE7.DLL" at base 62b00000 "WINWORD.EXE" loaded module "CRYPT32" at base 14690000 "WINWORD.EXE" loaded module "WINDOWSCODECS.DLL" at base ff50000 "WINWORD.EXE" loaded module "OLE32.DLL" at base 15df0000 "WINWORD.EXE" loaded module "SECUR32.DLL" at base 8f50000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base c910000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NORMALIZ.DLL" at base 16a30000 "WINWORD.EXE" loaded module "MSI.DLL" at base e9da0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base e4a0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SXS.DLL" at base 14230000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CSI.DLL" at base de020000 "WINWORD.EXE" loaded module "CSI.DLL" at base de020000 "WINWORD.EXE" loaded module "WININET.DLL" at base fd300000 "WINWORD.EXE" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base f7d60000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base f7d60000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 13970000 "WINWORD.EXE" loaded module "WINHTTP.DLL" at base ddb0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base b460000 "WINWORD.EXE" loaded module "NETAPI32.DLL" at base 9d40000 "WINWORD.EXE" loaded module "MPR.DLL" at base 8520000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DRPROV.DLL" at base ac0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NTLANMAN.DLL" at base f8fa0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DAVCLNT.DLL" at base f7f80000 "WINWORD.EXE" loaded module "URLMON.DLL" at base 2ce0000 "WINWORD.EXE" loaded module "HLINK.DLL" at base f5e40000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 13470000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPCEXT.DLL" at base 62930000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\1033\MSGR3EN.DLL" at base dd1100002b:T7f9,Observed system executable string:"Fun_VBA_PROJECTdirQPROJECTwmZ)PROJECT[tC000-000000000046}#8.7#0#C:\Program Files\Microsoft Office\Root\Office16\MSWORD.OLB#Microsoft Word 16.0 Object Library*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\System32\stdole2.tlb#OLE Automation*\CNormal*\CNormalXdc(*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE16\MSO.DLL#Microsoft Office 16.0 Object Library"dcThisDocument036364ab58%ThisDocument;a&b 0(kFr+`b\8WordkVBAWin16~Win32Win64xMacVBA6#VBA7#Project1" [Source: 0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1.doc], Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00007924-00000C25-2184448269], Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00007924-00000C25-2184529075], Observed system executable string:"%WINDIR%\system32\mscoree.dll" [Source: 00000000-00007924-00000C25-2184778809], Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00007924-00000C25-2184978632], Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00007924-00000C25-2197420117], Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00007924-00000C25-2198312382], Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00007924-00000C25-2198366406], Observed system executable string:"%WINDIR%\system32\fm20ENU.DLL" [Source: 00000000-00007924-00000C25-2203684279], Observed system executable string:"%WINDIR%\system32\normaliz.dll" [Source: 00000000-00007924-00000C25-2208475479], Observed system executable string:"%WINDIR%\system32\SFC.DLL" [Source: 00000000-00007924-00000C25-2208539488], Observed system executable string:"%WINDIR%\system32\SXS.DLL" [Source: 00000000-00007924-00000C25-2208666992], Observed system executable string:"%WINDIR%\system32\mshtml.dll" [Source: 00000000-00007924-00000C36-58914846682]2c:T949,"WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\COMDLG32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\COMDLG32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\CURRENT\S-1-5-21-1271187874-1938232448-3812392235-1001\START"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\CURRENT\DEVICE\START"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE_36354489"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE_36354489"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{44294F7C-6083-41C6-8176-3C202D755616}\"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\DRIVE\SHELLEX\FOLDEREXTENSIONS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\DRIVE\SHELLEX\FOLDEREXTENSIONS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\DRIVE\SHELLEX\FOLDEREXTENSIONS\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}"; Key: ""; Value: "")2d:T875,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NORECENTDOCSHISTORY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: "START_TRACKDOCS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED"; Key: "START_TRACKDOCS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "POLICYTYPE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "BEHAVIOR"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "MERGEALGORITHM"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "REGKEYPATHREDIRECTMAPPED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "REGKEYPATHREDIRECT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "GROUPPOLICYNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "ADMXMETADATAUSER"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "ADMXMETADATADEVICE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "ADMXMETADATABOTH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "30VALUE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\POLICYMANAGER\DEFAULT\START\HIDERECENTJUMPLISTS"; Key: "VALUE"; Value: "")2e:T485,"WINWORD.EXE" trying to touch file "C:\Windows\System32\apphelp.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" "WINWORD.EXE" trying to touch file "C:\Windows\System32\ntdll.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\kernel32.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\KernelBase.dll" "WINWORD.EXE" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "WINWORD.EXE" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "WINWORD.EXE" trying to touch file "C:\Windows\System32\AcSpecfc.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\sspicli.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\userenv.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msi.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\winspool.drv" "WINWORD.EXE" trying to touch file "C:\Windows\System32\bcrypt.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\AcGenral.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\mpr.dll" "WINWORD.EXE" trying to touch file "C:\Windows\System32\msvcrt.dll"2f:T79b,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{45F5205B-FA7A-11ED-8886-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP6"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "")30:T17a92,"WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@ARIAL UNICODE MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MALGUN GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MALGUN GOTHIC SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MEIRYO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MEIRYO UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU_HKSCS-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS PGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS UI GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@NSIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@PMINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@SIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@SIMSUN-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC UI SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AGENCY FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ALGERIAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL NARROW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL ROUNDED MT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL UNICODE MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT LIGHT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT LIGHT SEMICONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT SEMIBOLD CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT SEMIBOLD SEMICONDEN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT SEMICONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT SEMILIGHT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT SEMILIGHT SEMICONDE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BASKERVILLE OLD FACE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAUHAUS 93"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BELL MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERLIN SANS FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERLIN SANS FB DEMI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERNARD MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BLACKADDER ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT POSTER COMPRESSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOK ANTIQUA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOKMAN OLD STYLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOKSHELF SYMBOL 7"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRADLEY HAND ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRITANNIC BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BROADWAY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRUSH SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIBRI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIBRI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIFORNIAN FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALISTO MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CAMBRIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CAMBRIA MATH"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CANDARA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CANDARA LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASCADIA CODE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASCADIA CODE EXTRALIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASCADIA CODE LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASCADIA CODE SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASCADIA CODE SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASCADIA MONO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASCADIA MONO EXTRALIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASCADIA MONO LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASCADIA MONO SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASCADIA MONO SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASTELLAR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTAUR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY SCHOOLBOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CHILLER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COLONNA MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COMIC SANS MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CONSOLAS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CONSTANTIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COOPER BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COPPERPLATE GOTHIC BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COPPERPLATE GOTHIC LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CORBEL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CORBEL LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COURIER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COURIER NEW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CURLZ MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EBRIMA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EDWARDIAN SCRIPT ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ELEPHANT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ENGRAVERS MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS BOLD ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS DEMI ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS LIGHT ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS MEDIUM ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FELIX TITLING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FIXEDSYS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FOOTLIGHT MT LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FORTE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC BOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC DEMI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC DEMI COND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC HEAVY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC MEDIUM COND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FREESTYLE SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRENCH SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GABRIOLA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GADUGI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GARAMOND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GEORGIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GIGI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT EXT CONDENSED BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS ULTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS ULTRA BOLD CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GLOUCESTER MT EXTRA CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GOUDY OLD STYLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GOUDY STOUT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAETTENSCHWEILER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HARLOW SOLID ITALIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HARRINGTON"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HIGH TOWER TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HOLOLENS MDL2 ASSETS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "IMPACT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "IMPRINT MT SHADOW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "INFORMAL ROMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "INK FREE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JAVANESE TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JOKERMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JUICE ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KRISTEN ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KUNSTLER SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LEELAWADEE UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LEELAWADEE UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA BRIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA CALLIGRAPHY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA CONSOLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA FAX"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA HANDWRITING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS TYPEWRITER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS UNICODE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MAGNETO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MAIANDRA GD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MALGUN GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MALGUN GOTHIC SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MARLETT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MATURA MT SCRIPT CAPITALS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MEIRYO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MEIRYO UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT HIMALAYA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT NEW TAI LUE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT PHAGSPA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT SANS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT TAI LE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YI BAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU_HKSCS-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MISTRAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MODERN NO. 20"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MONGOLIAN BAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MONOTYPE CORSIVA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS OUTLOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS PGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS REFERENCE SANS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS REFERENCE SPECIALTY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS SANS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS UI GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MT EXTRA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MV BOLI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MYANMAR TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIAGARA ENGRAVED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIAGARA SOLID"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIRMALA UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIRMALA UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NSIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OCR A EXTENDED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OLD ENGLISH TEXT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ONYX"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PALACE SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PALATINO LINOTYPE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PAPYRUS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PARCHMENT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PERPETUA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PERPETUA TITLING MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PLAYBILL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PMINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "POOR RICHARD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PRISTINA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "RAGE ITALIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "RAVIE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL EXTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SANS SERIF COLLECTION"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SCRIPT MT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE FLUENT ICONS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE MDL2 ASSETS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE PRINT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI EMOJI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI HISTORIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SYMBOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI VARIABLE DISPLAY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI VARIABLE DISPLAY LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI VARIABLE DISPLAY SEMIB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI VARIABLE DISPLAY SEMIL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI VARIABLE SMALL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI VARIABLE SMALL LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI VARIABLE SMALL SEMIBOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI VARIABLE SMALL SEMILIG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI VARIABLE TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI VARIABLE TEXT LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI VARIABLE TEXT SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI VARIABLE TEXT SEMILIGH"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SHOWCARD GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMSUN-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA BANNER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA BANNER SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA DISPLAY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA DISPLAY SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA HEADING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA HEADING SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA SMALL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA SMALL SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA SUBHEADING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA SUBHEADING SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA TEXT SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SMALL FONTS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SNAP ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "STENCIL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SYLFAEN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SYMBOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SYSTEM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TAHOMA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TEMPUS SANS ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TERMINAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TIMES NEW ROMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TREBUCHET MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT CONDENSED EXTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VERDANA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VINER HAND ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VIVALDI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VLADIMIR SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WEBDINGS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WIDE LATIN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS 2"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS 3"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC UI SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "0000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "0|K"; Value: "0|k") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "Off") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "4F006E000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "WORDFILES"; Value: "0400C558") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0A00C558") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0B00C558") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "MTTT"; Value: "F41E0000DC95CEA466B7DA0100000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: ",6L"; Value: ",6l") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "~:L"; Value: "~:l") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "VBAFILES"; Value: "0100C558") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\REVIEWCYCLE"; Key: "REVIEWTOKEN"; Value: "{1752F93B-D5B0-43C1-9FFB-867AA5656181}") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "MAX DISPLAY"; Value: "19000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01DAB766AFC59640][O00000000]*C:\") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\FILE MRU"; Key: "MAX DISPLAY"; Value: "19000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\FILE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01DAB766AFC80740][O00000000]*C:\0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1.doc") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{6D017F8D-5373-47DD-9841-0130D098C7E4}\2.0"; Key: "(DEFAULT)"; Value: "Microsoft Forms 2.0 Object Library"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{6D017F8D-5373-47DD-9841-0130D098C7E4}\2.0\FLAGS"; Key: "(DEFAULT)"; Value: "36000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{6D017F8D-5373-47DD-9841-0130D098C7E4}\2.0\0\WIN32"; Key: "(DEFAULT)"; Value: "%TEMP%\Word8.0\MSForms.exd"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\CLASSES\TYPELIB\{6D017F8D-5373-47DD-9841-0130D098C7E4}\2.0\HELPDIR"; Key: "(DEFAULT)"; Value: "%TEMP%\Word8.0"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\TYPELIB\{6D017F8D-5373-47DD-9841-0130D098C7E4}\2.0"; Key: "(DEFAULT)"; Value: "Microsoft Forms 2.0 Object Library"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\TYPELIB\{6D017F8D-5373-47DD-9841-0130D098C7E4}\2.0\FLAGS"; Key: "(DEFAULT)"; Value: "36000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\TYPELIB\{6D017F8D-5373-47DD-9841-0130D098C7E4}\2.0\0\WIN32"; Key: "(DEFAULT)"; Value: "%TEMP%\Word8.0\MSForms.exd"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\TYPELIB\{6D017F8D-5373-47DD-9841-0130D098C7E4}\2.0\HELPDIR"; Key: "(DEFAULT)"; Value: "%TEMP%\Word8.0"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{BEF6E003-A874-101A-8BBA-00AA00300CAB}"; Key: "(DEFAULT)"; Value: "Font"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{BEF6E003-A874-101A-8BBA-00AA00300CAB}"; Key: "(DEFAULT)"; Value: "Font"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{EC72F590-F375-11CE-B9E8-00AA006B1A69}"; Key: "(DEFAULT)"; Value: "IDataAutoWrapper"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{EC72F590-F375-11CE-B9E8-00AA006B1A69}"; Key: "(DEFAULT)"; Value: "IDataAutoWrapper"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{82B02370-B5BC-11CF-810F-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnInteger"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{82B02370-B5BC-11CF-810F-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnInteger"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{82B02371-B5BC-11CF-810F-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnBoolean"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{82B02371-B5BC-11CF-810F-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnBoolean"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{82B02372-B5BC-11CF-810F-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnString"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{82B02372-B5BC-11CF-810F-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnString"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8A683C90-BA84-11CF-8110-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnSingle"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8A683C90-BA84-11CF-8110-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnSingle"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8A683C91-BA84-11CF-8110-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnEffect"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8A683C91-BA84-11CF-8110-00A0C9030074}"; Key: "(DEFAULT)"; Value: "IReturnEffect"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "IControl"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "IControl"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "Controls"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "Controls"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{29B86A70-F52E-11CE-9BCE-00AA00608E01}"; Key: "(DEFAULT)"; Value: "IOptionFrame"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{29B86A70-F52E-11CE-9BCE-00AA00608E01}"; Key: "(DEFAULT)"; Value: "IOptionFrame"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "_UserForm"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "_UserForm"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}"; Key: "(DEFAULT)"; Value: "ControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}"; Key: "(DEFAULT)"; Value: "ControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}"; Key: "(DEFAULT)"; Value: "FormEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}"; Key: "(DEFAULT)"; Value: "FormEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}"; Key: "(DEFAULT)"; Value: "OptionFrameEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}"; Key: "(DEFAULT)"; Value: "OptionFrameEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ILabelControl"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ILabelControl"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ICommandButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ICommandButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcText"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcText"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcList"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcList"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcCombo"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcCombo"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcCheckBox"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcCheckBox"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcOptionButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcOptionButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcToggleButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "IMdcToggleButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "IScrollbar"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "IScrollbar"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{A38BFFC3-A5A0-11CE-8107-00AA00611080}"; Key: "(DEFAULT)"; Value: "Tab"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{A38BFFC3-A5A0-11CE-8107-00AA00611080}"; Key: "(DEFAULT)"; Value: "Tab"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{944ACF93-A1E6-11CE-8104-00AA00611080}"; Key: "(DEFAULT)"; Value: "Tabs"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{944ACF93-A1E6-11CE-8104-00AA00611080}"; Key: "(DEFAULT)"; Value: "Tabs"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ITabStrip"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "ITabStrip"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{79176FB3-B7F2-11CE-97EF-00AA006D2776}"; Key: "(DEFAULT)"; Value: "ISpinbutton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{79176FB3-B7F2-11CE-97EF-00AA006D2776}"; Key: "(DEFAULT)"; Value: "ISpinbutton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{4C599243-6926-101B-9992-00000B65C6F9}"; Key: "(DEFAULT)"; Value: "IImage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{4C599243-6926-101B-9992-00000B65C6F9}"; Key: "(DEFAULT)"; Value: "IImage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLSubmitButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLSubmitButton"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLImage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLImage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLReset"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLReset"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLCheckbox"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLCheckbox"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLOption"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLOption"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLText"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLText"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLHidden"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLHidden"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLPassword"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLPassword"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLSelect"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLSelect"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLTextArea"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "IWHTMLTextArea"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}"; Key: "(DEFAULT)"; Value: "LabelControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}"; Key: "(DEFAULT)"; Value: "LabelControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "CommandButtonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "CommandButtonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcTextEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcTextEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcListEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcListEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcComboEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcComboEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcCheckBoxEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcCheckBoxEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcOptionButtonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcOptionButtonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcToggleButtonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}"; Key: "(DEFAULT)"; Value: "MdcToggleButtonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "ScrollbarEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "ScrollbarEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "TabStripEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "TabStripEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{79176FB2-B7F2-11CE-97EF-00AA006D2776}"; Key: "(DEFAULT)"; Value: "SpinbuttonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{79176FB2-B7F2-11CE-97EF-00AA006D2776}"; Key: "(DEFAULT)"; Value: "SpinbuttonEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{4C5992A5-6926-101B-9992-00000B65C6F9}"; Key: "(DEFAULT)"; Value: "ImageEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{4C5992A5-6926-101B-9992-00000B65C6F9}"; Key: "(DEFAULT)"; Value: "ImageEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents1"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents1"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents2"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents2"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents3"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents3"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents4"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents4"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents5"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents5"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents6"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents6"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents7"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents7"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents9"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents9"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents10"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}"; Key: "(DEFAULT)"; Value: "WHTMLControlEvents10"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{5CEF5613-713D-11CE-80C9-00AA00611080}"; Key: "(DEFAULT)"; Value: "IPage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{5CEF5613-713D-11CE-80C9-00AA00611080}"; Key: "(DEFAULT)"; Value: "IPage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{92E11A03-7358-11CE-80CB-00AA00611080}"; Key: "(DEFAULT)"; Value: "Pages"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{92E11A03-7358-11CE-80CB-00AA00611080}"; Key: "(DEFAULT)"; Value: "Pages"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "IMultiPage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}"; Key: "(DEFAULT)"; Value: "IMultiPage"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\INTERFACE\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "MultiPageEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\WOW6432NODE\INTERFACE\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}"; Key: "(DEFAULT)"; Value: "MultiPageEvents"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\DOCUMENTRECOVERY\36364D95"; Key: "36364D95"; Value: "04000000F41E00004700000043003A005C0030003100360030003300370035006500310039006500360030003600640030003600660036003700320062006500360065003400330066003700300066006100370030003000390033006400320061003300300030003300310061006600660064003200390032003900610035006300340034003600640030003700630031002E0064006F0063004400000030003100360030003300370035006500310039006500360030003600640030003600660036003700320062006500360065003400330066003700300066006100370030003000390033006400320061003300300030003300310061006600660064003200390032003900610035006300340034003600640030003700630031002E0064006F00630000000000010000000000000085ACE49C66B7DA01954D3636954D363600000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0100C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0200C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0100C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0200C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0200C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0300C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0300C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0400C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0300C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0400C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0400C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0500C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\1.0\CUSTOM DICTIONARIES"; Key: "1"; Value: "CUSTOM.DIC"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\1.0\CUSTOM DICTIONARIES"; Key: "UPDATECOMPLETE"; Value: "01000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0C00C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0D00C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SYMBOL"; Value: "05050102010706020507"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ARIAL"; Value: "020B0604020202020204"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MALGUN GOTHIC"; Value: "020B0503020000020004"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CAMBRIA MATH"; Value: "02040503050406030204"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01DAB766B42DAB50][O00000000]*C:\"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\FILE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01DAB766B4326640][O00000000]*C:\0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1.doc"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\DOCUMENTRECOVERY\36364D95"; Key: "36364D95"; Value: "04000000F41E00004700000043003A005C0030003100360030003300370035006500310039006500360030003600640030003600660036003700320062006500360065003400330066003700300066006100370030003000390033006400320061003300300030003300310061006600660064003200390032003900610035006300340034003600640030003700630031002E0064006F0063004400000030003100360030003300370035006500310039006500360030003600640030003600660036003700320062006500360065003400330066003700300066006100370030003000390033006400320061003300300030003300310061006600660064003200390032003900610035006300340034003600640030003700630031002E0064006F0063000000000001000000000000004A532BB466B7DA01954D3636954D363600000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\INTERNET\SERVER CACHE"; Key: "VERSION"; Value: "01000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0E00C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LICENSING"; Key: "C0AC079DA84B4CBD8DBAF1BB44146899"; Value: "01000000270000007B39303134303030302D303031312D303030302D313030302D3030303030303046463143457D00580000004F00660066006900630065002000310034002C0020004F0066006600690063006500500072006F0050006C00750073002D004B004D0053005F0043006C00690065006E0074002000650064006900740069006F006E000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "WORDNAME"; Value: "Microsoft Word"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\TOOLBARS\SETTINGS"; Key: "MICROSOFT WORD"; Value: "0101000000000000000006000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400100000000F01FEC\USAGE"; Key: "PRODUCTNONBOOTFILESINTL_1033"; Value: "0100C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400100000000F01FEC\USAGE"; Key: "PRODUCTNONBOOTFILESINTL_1033"; Value: "0200C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01DAB766FA11D1F0][O00000000]*C:\"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\FILE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01DAB766FA1442F0][O00000000]*C:\0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1.doc"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\DOCUMENTRECOVERY\36364D95"; Key: "36364D95"; Value: "04000000F41E00004700000043003A005C0030003100360030003300370035006500310039006500360030003600640030003600660036003700320062006500360065003400330066003700300066006100370030003000390033006400320061003300300030003300310061006600660064003200390032003900610035006300340034003600640030003700630031002E0064006F0063004400000030003100360030003300370035006500310039006500360030003600640030003600660036003700320062006500360065003400330066003700300066006100370030003000390033006400320061003300300030003300310061006600660064003200390032003900610035006300340034003600640030003700630031002E0064006F0063000000000001000000000000000000000000000000954D3636954D363600000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\DOCUMENTRECOVERY\36382A28"; Key: "36382A28"; Value: "04000000F41E00004700000043003A005C0030003100360030003300370035006500310039006500360030003600640030003600660036003700320062006500360065003400330066003700300066006100370030003000390033006400320061003300300030003300310061006600660064003200390032003900610035006300340034003600640030003700630031002E0064006F0063004400000030003100360030003300370035006500310039006500360030003600640030003600660036003700320062006500360065003400330066003700300066006100370030003000390033006400320061003300300030003300310061006600660064003200390032003900610035006300340034003600640030003700630031002E0064006F006300000000000100000000000000801038FA66B7DA01282A3836282A383600000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\DATA"; Key: "SETTINGS"; Value: "C00054033001000034010000040000001E0000001E0000001E0000001E0000001E0000001E000000220000001E0000001E0000001E00000006000000060000000600000006000000060000000000000006000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000100000000200000002000000020000000200000000000000000000000000000048000000060000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000006000000E25026A1100A00603090060002000A002D008200000082000000C00300001F02000004060300000000000000000000000000040087010C000600C80009000180FFFF000006000000040000000C0100000502000000000000A004020000001200000000603090000064000000000000FF0000FF000000000000FF01000000010000005C08E0100000000000010000E40400001D000100000000000000020050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D000000000000000000000000D4944600D49446010000002F91010000080A000600000003333296040000000A050C0C0302040600000300000101010606060000000000000000000000000000000000000063631900000001000000000000000000000000000000030000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000002100190000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006301190000008C0A00000000E01000004B0000004B0000002000640000006301190000008C0A00000000B01300004B0000004B000000640000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000009002000002000001010101010101000101010101010001010100010001000101010101010101000100020003010301030103000301020003010301030103010000230101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101020101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010301010101010101010101010101FFFFCFFFFFFF00008602FFFF00008602FFFF00001000FFFF00000100FFFF00000100FFFF000001004800000048004100500055004200570053000000000000000000000087FFFF0300003E00020200000600090034000000000090009000000000000F000000FFFFFF000000000000001400140000000000000002637800C80000000000140000000000900090008000FFFF00001000FFFF00001000FFFF0000040000000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\OPTIONS"; Key: "BACKGROUNDOPEN"; Value: "00000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0F00C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1000C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "MTTF"; Value: "9A000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "MTTA"; Value: "9A000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "AB0F0000000000000400040001002F020200000000B31C0200F76A010152B601019952020212F80002388F020285C70102E8C20103A63A0203CBE40103F91B02043E8E02045F9A0204931A0104AF630104DADC0105DE850205F9E70106C42802079A1902088D4201089E1902095E2F0209A336010A6B6C010BE8C5010BF99C020C3131020CE9C2000D28C7010D7879000D7E3E020D7E4F020DD3F9000E091A020E303E020E9F67020F168C01101755021043E800104A9002104C8E021129690211373E021142C2001169A10011AB3D0212E5F800130A36021364EB0113951B0213E9780015E07E0216D134021793380117C06F0117DE370118208A02186C1E0219C0E2001A2D42021AE8EC011BF60B001C8FCF001C955C001D3083021D3BC5011D5819021E451E021E8D52001EC330021ED770011F34CC011F6C76022018F200213AC30121777A00223BED0122A7730123116E01237AF80123ABE90123CC4F01246B460124ACC70024C18B0125023802254F6E01262B9401264BA801267F9D022834190228A11B012919DA012945000229450101297DA90129861F0229CE33022AC7DE002B2499002BD8E5012C9F7A022CA603022D22DA012D5838012E1EF0012E4A1C022E6974012E7714022F39D5002F4CE5012FA8FF0131484F0031CF44023257A400329F7A0232D1A70032D45F0133FB2A0233FE38023542CC0135602102361EE10139A7C20139AFDE013A99D9013AD143023B8031023CB352003D121F023D218F023DC47F023E1CB7013E3383003E5BED01403D670140A28E0141A8760041BC3A02420D510242264A0042B3AE0042C54D02435EBA0143AB210144A4C401454ED30045668A024677300146AB2E02483BDB0148C24F0048F9A60049CBA30149DA1B0249EAB7004AAA81004AC433024ADEE1014B2A91014B6EE3014B7207024BF474024C15AA014C41B4004C9E02024CC84B014D3ED9014E50C2014F14C2004FA53302508F00025232300252769302534673015355E401536A3A02538AAD015408340254302F0254B7DC0054DFE20155DB8C0155E6E101560A850057426B01577AF801578A1B0257920E0257AD120158021202589E270258BB5C02594F87025953940059C43C025A0189025A0289025A0A83025A2C80015AE213025AF783025B1203025C3598015E83D7015EF05F025F83500260BA320261D42A0261D98C0162DC300262EF34026396770063EC740263FD310264054E0264C9260164D4190164E08E0264F42B0265C4850265ED1D0267ABEE0167BA6B0268130102682C90006957EA0169592A0269CC4F016A3683026A61E8016A7365016A95E2016BF42B026C0B76026C137F026C6F66026CA164026D2390026DEE2C026E4538027052E20170A32C02718C9A02726E4A0072A2420172CD990173422F0274A3A30175A37E007691CF0177D52F0277F98F0178159600785DD30179F99C027A5B7C027B863D027C82C9017CBAFC017D904A017DBBD6017E1044017E3732027E5030027EEE89027F16AA017F88CA00800184028106950081B0690281B942028227730082409702825B8A0282FB2A0283F16000844D260184D7780284E11E0284E6830085311B028550AE0085E34102861BDE01867B060186ECB6018754990287D5140287DE830087F0250187FC38028881870288D13302890CE901892F830289DC8B018AFAE3008BEEF2008BFD6E018C1D88028C8F94028E78A2008E90C6018ED891018FEAF9019123D30091C335029259160092603302928271009369C70093CA3D0293CDFD0193CE8C019439F701945AE001945B270294A15B0195126E01959F33019697E30196A26E019744860297F6C40098C7F10198D7780299429B02996776029A0B73019B4A72029C429B029C4D22029CE0A8009D9D92009E1E90019F8230029F8314029FF47702A1236602A19D2A01A2050600A2065D02A2961002A3998D02A3C4E200A3C88302A3E8DD01A4580200A4778D02A4AEE901A5092E02A5ADCF00A644A600A6E9B300A736A800A7B8AD00A7C23301A7E23E02A8EA4E02AAB1FC01AAF63F02AB9FC901ABF42B02AC4D1C02AC54F900AC79D901AC930202AD2DB801AD73BF00AE4D5702AEE69101AF086501AF9C0202B09E9702B0F13802B2376E01B2827902B2BAFC01B3732002B3742D02B392FB00B4D7C501B51B6701B5661202B7750C02B7E23E02B7F15002B8029700B8C37F02B91AF300B9B92A02B9FA7702BB51DD01BB8E1602BB8E8B00BBF42B02BC6EB400BCD22A01BD388F00BEAF8A02BF0CE901BF674602BFDC4602C0079A00C03A8E02C046AD00C1BCF101C2151602C2610B01C2DEE401C2FD7C02C33EA300C36D8100C399F300C48E9002C535C900C561EA01C58D9002C5EA1602C6331902C75DD700C85C5902C8B83902C9389700CA072E02CA23B700CB533302CB74DA00CC495600CCEFEF00CDBA8302CE99E001CEE23E02CF1C0402CF74AA00CFF36501D00ABA01D0175600D0B00802D1B08D02D1D2A700D2638F02D2C12702D2CF9D02D2E67302D2ED3702D3140C02D3826100D3834B01D3E88D00D4489A01D4A04002D5398801D5F78602D6EF5802D737C501D7D2C501D7E86C02D8E79C01D940E901D997E001DA0B7301DA38C801DB7A1402DB87DD01DBE23E02DBE56F02DC1BF901DC451502DD1B1901DE0F8702DE692702DF294302E0093602E01FA101E0BC0102E1417E02E16D9901E17E8C00E193B001E1ABE501E1E3D801E21B5600E2BC8802E2DB2C02E4402701E469C900E4EF1B02E5BD5C01E5E03902E6109902E63E2B0DE66C8100E6BD3902E7A3E901E7A4D900E7E23E02E88E2401E98C0A01E9D36601E9EA3402EB3B9402EB8D3302EB908D02EC63C501EC95E101ECBC3602EDAA2E02EE165502EE5F9902EE930202EEAF9B02EFD67202F0694F02F07F0B02F0B91402F0E0B600F133E901F13A9102F1728102F17D5F00F1AD3D01F1FC6000F20E9302F2B4FA00F2FFA501F308DB00F3492A02F3658E02F3894001F3B82102F458EC01F4EA9502F5500D01F577C201F62D3102F6F12B02F7125E00F7D36F00F7EC8302F7ED6A00F8C13D02F9DFA101FA667802FAFB8402FB8CC601FC3A4701FC75BA01FD148602FDB0D900FDDFE501FE784F02FE8D5E02FEDC8C01FEE26301FF10DD01FF3400024100060000000DEAFC0112F7C70113F7C7011A6F93021BA02E02212E4D0225C5010228614B022B9EA1022E240F022EDD89023C6AF901410189024BFC6D0251B2340261057C0261367A0263CB2E0269B992026A23E20170FC8802786C6D0279DE98027A8B38027E018902877B32028B2894028EE3780299345802996776029E306B02A1866302A2994802A6749502AFA32E02B0D58102B2C32801B5235202B6F13B02B8723E02BB635C02C1239D01C3445D02C8D15D02CA174101CF6C8502CFF42B02D2AD5C02D88C3F02DBB95D02DCEF8E02DD0B4101DFD47602E2077F02E2C56D02E4718902E7EB4001EA5B9402EBAC7502EDF38E02EF007702F02A7402F0E23E02F7CC9002FC998D020600400100001ED770014B11B4006041AE00682C9000A5ADCF00CE99E001010041010000F938ED000100420100009E1E9001010043010000C0EC7C00"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0600C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0700C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0800C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0900C558"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\GRAMMAR\MSGRAMMAR\3.0\1033"; Key: "OPTIONS VERSION"; Value: "01000000"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\GRAMMAR\MSGRAMMAR\3.0\1033\OPTION SET 0"; Key: "NAME"; Value: "Grammar & Style"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\GRAMMAR\MSGRAMMAR\3.0\1033\OPTION SET 0"; Key: "DATA"; Value: "0101010101010101010101010101010101010101010101010101010100010101020202"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\GRAMMAR\MSGRAMMAR\3.0\1033\OPTION SET 1"; Key: "NAME"; Value: "Grammar Only"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PROOFING TOOLS\GRAMMAR\MSGRAMMAR\3.0\1033\OPTION SET 1"; Key: "DATA"; Value: "0101010101010101010101000000000000000000000000000000000000000000020202"), "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\SECURITY\TRUSTED DOCUMENTS"; Key: "LASTPURGETIME"; Value: "46CFB401")31:T410,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT")32:T7ad,"WINWORD.EXE" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "")33:T4b3,"WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")34:Ta47,"WINWORD.EXE" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WINWORD.EXE" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "WINWORD.EXE" touched "SAX XML Reader 6.0" (Path: "HKCU\CLSID\{88D96A0C-F192-11D4-A65F-0040963251E5}") "WINWORD.EXE" touched "MXXMLWriter 6.0" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A0F-F192-11D4-A65F-0040963251E5}\TREATAS") "WINWORD.EXE" touched "OneNote Word Add-In Take Notes Content Service Class" (Path: "HKCU\CLSID\{C580A1B2-5915-4DC3-BE93-8A51F4CAB320}\INPROCSERVER32") "WINWORD.EXE" touched "PersistentZoneIdentifier" (Path: "HKCU\CLSID\{0968E258-16C7-4DBA-AA86-462DD61E31A3}\TREATAS") "WINWORD.EXE" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WINWORD.EXE" touched "Microsoft Word-Vorlage mit Makros" (Path: "HKCU\CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "WINWORD.EXE" touched "Microsoft Forms 2.0 Frame" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{6E182020-F460-11CE-9BCD-00AA00608E01}\IMPLEMENTED CATEGORIES\{4FED769C-D8DB-44EA-99EA-65135757C156}") "WINWORD.EXE" touched "Microsoft Word-Dokument" (Path: "HKCU\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\TREATAS") "WINWORD.EXE" touched "Microsoft Word 97-2003-Dokument" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020906-0000-0000-C000-000000000046}\TREATAS") "WINWORD.EXE" touched "Microsoft Word-Dokument mit Makros" (Path: "HKCU\CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\TREATAS") "WINWORD.EXE" touched "Microsoft Word-Vorlage" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\INPROCHANDLER") "WINWORD.EXE" touched "Microsoft Word-Vorschau" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{84F66100-FF7C-4FB4-B0C0-02CD7FB668FE}\PROGID") "WINWORD.EXE" touched "OpenDocument-Text" (Path: "HKCU\CLSID\{1B261B22-AC6A-4E68-A870-AB5080E8687B}\TREATAS") "WINWORD.EXE" touched "Microsoft Word Picture" (Path: "HKCU\CLSID\{00020907-0000-0000-C000-000000000046}\TREATAS") "WINWORD.EXE" touched "Microsoft Forms 2.1 DataObject" (Path: "HKCU\CLSID\{1C3B4210-F441-11CE-B9EA-00AA006B1A69}\CONTROL") "WINWORD.EXE" touched "Microsoft Forms 2.1 FontNew" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{AFC20920-DA4E-11CE-B943-00AA006887B4}\INSERTABLE") "WINWORD.EXE" touched "Task Bar Communication" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\PROGID") "WINWORD.EXE" touched "TaskScheduler class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\PROGID")35:T52e,"WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "C:\Users\f09m3Hc\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{AB67A088-CB3F-4DE0-BA0D-C6EE66E709AA}.tmp" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{D4859BA6-42B8-4332-9CE5-9DBC23FF9E4A}.tmp" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{AB67A088-CB3F-4DE0-BA0D-C6EE66E709AA}.tmp" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\8848AFF9.wmf" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\111F25A6.wmf" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History"36:T6d6,"WINWORD.EXE" wrote bytes "56bc21db0112d801" to virtual address "0xEF81FA00" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "e9abc0a6fecc" to virtual address "0xFE414060" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e933f0a6fe" to virtual address "0xFE411180" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "074221db0112d801" to virtual address "0xECB22350" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "84c824dc0112d801" to virtual address "0xE580DE48" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "0000000000000000" to virtual address "0xE561E228" (part of module "GKWORD.DLL") "WINWORD.EXE" wrote bytes "a5224dd90112d801" to virtual address "0x3FD43258" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "d4c010dd0112d801" to virtual address "0xF3CE0160" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "c673d0f30112d801" to virtual address "0xE5207450" (part of module "MSCORWKS.DLL") "WINWORD.EXE" wrote bytes "e933efa6fecccc" to virtual address "0xFE411210" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e94b9fa6fecccccccccc" to virtual address "0xFE416230" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "bc645fdb0112d801" to virtual address "0xEEB271C0" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "a05374ce0112d801" to virtual address "0xF44C25D8" (part of module "MSPROOF7.DLL") "WINWORD.EXE" wrote bytes "a3867cdb0112d801" to virtual address "0xEB87D610" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "48b8bc5246eafe070000ffe0" to virtual address "0x76BD9020" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "e913b0e8fe" to virtual address "0xFDFF50C0" ("OleLoadFromStream@OLE32.DLL")37:T6fe,"WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA-ES") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA-ES") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "CA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-HANS") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ZH-HANS") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ZH-CN") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EL-GR") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EL-GR") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EL") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EL")38:T6e3,Found string "set shellObj = Wscript.CreateObject("WScript.Shell")" (Indicator: "set "; File: "WMVxEncd.vbs") Found string "set" (Indicator: "set"; Source: "00000000-00006396.00000000.77940.05690000.00000002.mdmp") Found string "Set As &Default" (Indicator: "set "; Source: "00000000-00006396.00000000.77940.05690000.00000002.mdmp") Found string "Set priority to use when sorting in recommended order" (Indicator: "set "; Source: "00000000-00006396.00000000.77940.05690000.00000002.mdmp") Found string "Set whether style shows when viewing recommended styles" (Indicator: "set "; Source: "00000000-00006396.00000000.77940.05690000.00000002.mdmp") Found string "Set availability of selected styles" (Indicator: "set "; Source: "00000000-00006396.00000000.77940.05690000.00000002.mdmp") Found string "Set &value to:" (Indicator: "set "; Source: "00000000-00006396.00000000.77940.05690000.00000002.mdmp") Found string "Set Numbering Value" (Indicator: "set "; Source: "00000000-00006396.00000000.77940.05690000.00000002.mdmp") Found string "Set Size" (Indicator: "set "; Source: "00000000-00006396.00000000.77940.05690000.00000002.mdmp") Found string "Set As D&efault" (Indicator: "set "; Source: "00000000-00006396.00000000.77940.05690000.00000002.mdmp") Found string "Set &Font..." (Indicator: "set "; Source: "00000000-00006396.00000000.77940.05690000.00000002.mdmp") Found string "Set as &Default Printer" (Indicator: "set "; Source: "00000000-00006396.00000000.77940.05690000.00000002.mdmp") Found string "Set as defaul&t for new documents" (Indicator: "set "; Source: "00000000-00006396.00000000.77940.05690000.00000002.mdmp") Found string "Set for All Levels" (Indicator: "set "; Source: "00000000-00006396.00000000.77940.05690000.00000002.mdmp")39:T629,Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00006396-00000C98-43678097") Found string "ncalrpc:[lsapolicylookup]" (Indicator: "ncalrpc"; Source: "00000000-00006396-00000C98-43678097") Found string "ncalrpc:[dhcpcsvc6,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006396-00000C98-43762445") Found string "ncalrpc:[dhcpcsvc,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006396-00000C98-43767324") Found string "ncalrpc:[,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006396-00000C98-43782698") Found string "ncalrpc:[epmapper]" (Indicator: "ncalrpc"; Source: "00000000-00006396-00000C98-43783005") Found string "ncalrpc:[IMpService77BDAF73-B396-481F-9042-AD358843EC24]" (Indicator: "ncalrpc"; Source: "00000000-00006396-00000C98-51940721") Found string "ncalrpc:" (Indicator: "ncalrpc"; Source: "00000000-00006396-00000C98-68821889") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006396.00000000.77940.03310000.00000004.mdmp") Found string "I+ncalrpc:[OLE9F92D4BAEF52CAE2E7722E190C43]" (Indicator: "ncalrpc"; Source: "00000000-00006396.00000000.77940.03310000.00000004.mdmp") Found string "+ncalrpc:[OLE8C11D6F4AD55CE7886F60442B10F]" (Indicator: "ncalrpc"; Source: "00000000-00006396.00000000.77940.03310000.00000004.mdmp") Found string "+ncalrpc:[OLE9F92D4BAEF52CAE2E7722E190C43]" (Indicator: "ncalrpc"; Source: "00000000-00006396.00000000.77940.03310000.00000004.mdmp")3a:T938,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGsElEQVR4Xs2W2W9UZRjGSUz8C7j3iph4oZgoGow3aiRgiKiENBJECIugqEDAsIQIFSgUWYrshQJdpystlNIdKEtb6A60dJnpLJ3O0k5n2hk6++P3fGfOdKYU2wsTPcnTmelynt/zvt/7ns6a9X+9imvbEKtrNa0oqm6RKqxqQUFlE/Kp8ibklT9G7q1H0JQ1Ikco+2aDUD2yxKtOZ4bNZsPk+0970XSmVzgspL4KhUJAUCiztB5bD6RKCL3d/mqIraetULXphFlq/ZF+rEnqwXeJT5HweyeW7W7Dkm2NWLLlARZuuiP1yQ/lmLeyMGoszWMAMm48gMkBJGxK/GcIGpfVu6dUbo0rqstlTqlzxcNSJ/PMmLs8b0rzgFB6yT0J0GsJ4OOlP74aQgWIKyuUGwbFl0AwDJ+fCmHcG4JnPAi3Jzg1gHijAly+djcK0Kr14P3Fa6aGYMljAZQbTZj7A2F4ffHmo26/BHgrISMKkNs4Fqe0wjsxAG7UPXHgnQUrX4Zgvwmw80wXfk1ul2Kvi6p00vzDhLPSnGdg+c5HUjwDhzKtUQAC05TXiDuATqMbFwtqUds+hMpmG0obB1F4zwRNjT4KMSUAU1Frd1+XN1u3vwVvLzmGhnaD/P6GxIf4YNUNJKZ2IzmjD29+lRYH8EJUKiQ+NHTacTG/Bqu3HcGKzUlYtnEvFq/egc++3YyPvt4gIaIAPO0E4E14U5rrzR75nqZzFh2WAKwIzWfPXwqH0yt//sai83EATN7YNQSnJ4DcuyZk3zEis9aAzEptVOniPnEAHDWecvabVSCApsom036+7bkEIMiCLY/l+22HUzE04pNVmAyQeceKnDoLrtaYcbRIi3O3jNh7pRlj42G4XoQw4gnhSuUkAM44Adhv9p8AvLlqzn6rpWf6Z7022Bxe+TuzPz0WB5CkeY6UEh0ulA8gpbgf58pMEmD0RRhOAeAYCyGtQjkHUYBvdjRLAI4ZjTiWqjlLz0WkfmZ6mluHvLJaBFAmRgFg8uy6QWTUDuLkdQPO3FQAXAJgxB3CsABILZ8EwBPPBUOAFbvqomYDFofs9fz1zfKzmp7mlqHxCYDI8qHRq+T0hOEQAEOjIZwvM8QDsMQE4KjN+VIjzQoqWuEc9UvxezRPSS9VzG1emK3j2Hq8Aa/PT1IWD/cFFxZ3hlhaL3xhuL1h0fuQ7D3Nh4W5zRXC6VLTywBcreqSoVRzVoAHTi27am6yTABoeNpvG5AhZvxqVT8uV+hw8VYfLtzsxdkbPTh9vVuW3uYKwuIMIuX6QDwAHyoqADfcTMxVgNfe2ydTxyb3xCRX+24X6S3OEMyOII4VTwGgLiBV3HKcc4qnnf2maBorAqjJ0yq08clLnuOva11IKeqEVaQfHAnBNBxEcpE5HoCPVD5UKK5WihuOM07xoKliySkaU7Pmbo+mVnquzLtTzPuwW0mumAeluWEoiIOFlniAqa60wrsYFyWlihssKHo4iIL7ZuTVDSDnrhFZkZ5fiSRPFcnPy+Td0eQnCjtxrOAZjuY9xYAovVGY62wBJOZZpwe4JJ5kHiZT5Y2XW/SYaanRSL+ZWp522fPgRHIHkwfQL8z7xJNxj8Y+A4D82xjz0iQ0kVzs9Syx19Or9XKdppWL5GXxyU/GJP9TJE/OfYLDOR2KuTWAnsEAdmYPTw+QmlcrtxeTxYoLhUkpnnCuVibmguGYWZ1KapZc9tzOsgdl8m5h3jXgx/bMGQBcyK2RDw6aMDmfaGryS2ry0h6cETN+qjgmeX4kueYJDuW0IymrHQcy26Lmz4x+bEkfmR7gvKZaJpPpIgntkXm2if5yo1ldnG0lMeebiY1CeplaKTn/G3pu9qPTpJh3GPz45apzeoCzOVVKSV00U0pL0dAi5lk1VUvNE64XStZ0yOQHs9pk8j8yWpGY3oKnwrxd70drvx8/XXbNACC7UppIo5GAEF+F4bBiqJqyx3qb0metTUnMg9bN1KLkT01K6ja9T5o36/zYcGl0eoAzWZVyfEzDAcVQjJFRiIYGuxgpIZZZZ50odfegXxp3sdxCTww+dIjUbcK4RedDk9aHxl4f1l0cmx7gdGaF7KWq/khfaaiNmvrRG0kr+8xDRuNIr9v7fWgRahbGj/sU8/oeH9akumcGwLLea9Kh7H4f8qu1uHpLi7MlRhwXTzNVR0sGkHzNjKSiQewvsGJfvg17cu1i1ofEuDnkif/5igsbRd/XXxrDGpF+9YUZAJzKKMeGXSfwxfe/yf9i5y1ei3cXrpJ/+G9psud/cv0NW8FnkZfetYIAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790872578423,"unified_at":"2026-10-01T16:36:18.423Z","metadata":{"hashes":{"sha256":"0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1","sha1":"0ab8602cee94f36739b6649467ced514301e58fa","md5":"a27a9324d282d920e495832933d486ee","sha512":"76a3ced357d5fbae7bbb0288c4ddd23e2f8f77b7256f2555b34f666ff2ff7e5a1f1b68f0f53b859c41d57d5ab44129f910e0f1c7b9a51ca079dbbfac6973a96b","ssdeep":"24576:iguUgXlNfAEIk0AKDxj4eigeIAzTQYUrX:inUg/IVGge8","ssdeep_chunks":["24576:iguUgXl","24576:guUgXlN","24576:uUgXlNf","24576:UgXlNfA","24576:gXlNfAE","24576:XlNfAEI","24576:lNfAEIk","24576:NfAEIk0","24576:fAEIk0A","24576:AEIk0AK","24576:EIk0AKD","24576:Ik0AKDx","24576:k0AKDxj","24576:0AKDxj4","24576:AKDxj4e","24576:KDxj4ei","24576:Dxj4eig","24576:xj4eige","24576:j4eigeI","24576:4eigeIA","24576:eigeIAz","24576:igeIAzT","24576:geIAzTQ","24576:eIAzTQY","24576:IAzTQYU","24576:AzTQYUr","24576:zTQYUrX","49152:iguUgXl","49152:guUgXlN","49152:uUgXlNf","49152:UgXlNfA","49152:gXlNfAE","49152:XlNfAEI","49152:lNfAEIk","49152:NfAEIk0","49152:fAEIk0A","49152:AEIk0AK","49152:EIk0AKD","49152:Ik0AKDx","49152:k0AKDxj","49152:0AKDxj4","49152:AKDxj4e","49152:KDxj4ei","49152:Dxj4eig","49152:xj4eige","49152:j4eigeI","49152:4eigeIA","49152:eigeIAz","49152:igeIAzT","49152:geIAzTQ","49152:eIAzTQY","49152:IAzTQYU","49152:AzTQYUr","49152:zTQYUrX","24576:inUg/IV","24576:nUg/IVG","24576:Ug/IVGg","24576:g/IVGge","24576:/IVGge8"],"imphash":"Unknown"},"file_info":{"file_name":"Salary_Lockheed_Martin_job_opportunities_confidential.doc","file_type":["doc","office"],"file_type_id":"doc","file_size":1293824,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1642882498000,"last_seen":1764442080000,"last_multi_scan":1764442080000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["labyrinthchollima","suspicious","targeted"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":40},"sandbox_signatures":{"informative_count":98,"suspicious_count":13,"malicious_count":3,"total":114},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/DOC.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[APT]/MSOffice.Lazarus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.37689795","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"ms_office/malicious_confidence_100","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.37689795 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBA/Agent.ADJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-AFJI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"W97M/Downloader.duc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W97/Agent.BG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"User Execution","attack_id":"T1204","attack_id_wiki":"https://attack.mitre.org/techniques/T1204","identifiers":[{"type":"informative","value":"Contains embedded VBA macros"},{"type":"suspicious","value":"Contains embedded VBA macros with suspicious keywords"},{"type":"suspicious","value":"Contains embedded VBA macros with interesting strings"}],"sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"suspicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Persistence","technique":"Change Default File Association","attack_id":"T1546.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/001","identifiers":[{"type":"suspicious","value":"Modifies the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains embedded VBA macros (normalized)"}],"sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies the protected view settings of microsoft office"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Removes Office resiliency keys (often used to avoid problems opening documents)"}],"sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"},{"type":"informative","value":"Found a potential E-Mail address in binary/memory"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Sample/File contains another embedded binary"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Defense Evasion","technique":"Indirect Command Execution","attack_id":"T1202","attack_id_wiki":"https://attack.mitre.org/techniques/T1202","identifiers":[{"type":"suspicious","value":"Able to run command on file using forfiles"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"},{"type":"informative","value":"Rename files"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Tries to open documents files"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a HTTP or FTP session"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Calls an API used to connect to internet"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops script (vb/js) files"},{"type":"informative","value":"Contains ability to copy files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"suspicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Loaded modules"}],"sources":[{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to create string binding handle (RPC)"},{"type":"informative","value":"Calls an API typically used to register protocol sequence (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"markettrendingcenter.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"172.105.27.36:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"details too long to display","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1137","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$28","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~_lary_Lockheed_Martin_job_opportunities_confidential.doc\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"WindowsHolographicUpdateMeta.lib\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"WMPlaybackSrvMeta.lib\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"H<\"\" (08@H@PX`hpx&\" (&Hp & b;a> CryptStringToBinaryWLXLoadLibraryAM8LoadLibraryALhGetProcAddressMGetProcAddressLVirtualProtectfHmemcpyMp(VirtualProtectgPmemcpyfNtQueryInformationProcessxRRME(S\"SS\"@n(1Normal.ThisDocument@P 0%+. i0i2i4i6i80i:Pi\n\\Sub Gantdll\" memHcpyDReyMV!gAnyA/mdBA)F?/?/\" (Indicator: \"GetProcAddress\")\n \"!!!!W8@0(\" (Indicator: \"open\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 60890000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$29","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops LNK files (Windows shortcut)","description":"\"Salary_Lockheed_Martin_job_opportunities_confidential.LNK\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Tue Sep 20 00:26:59 2022 mtime=Tue Sep 20 00:26:59 2022 atime=Tue Sep 20 00:26:16 2022 length=1293824 window=hide\"- Location: [%APPDATA%\\Microsoft\\Office\\Recent\\Salary_Lockheed_Martin_job_opportunities_confidential.LNK]- [targetUID: 00000000-00002908]","origin":"Binary File","relevance":5,"id":"binary-31","sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops executable files","description":"\"WindowsMediaPlayerVxEncdSrv.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\WMAuthorization\\WindowsMediaPlayerVxEncdSrv.exe]- [targetUID: 00000000-00002908]\n \"WMPlaybackSrv.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\WMAuthorization\\WMPlaybackSrv.exe]- [targetUID: 00000000-00002908]\n \"WindowsHolographicUpdateMeta.lib\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\WMAuthorization\\WindowsHolographicUpdateMeta.lib]- [targetUID: 00000000-00002908]\n \"WMPlaybackSrvMeta.lib\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [C:\\WMAuthorization\\WMPlaybackSrvMeta.lib]- [targetUID: 00000000-00002908]","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"}]},{"level":"informative","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"63292497da828307b52d4dd0"},{"report_type":"sandbox","report_id":"61f026da23b31605de761dfe"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://markettrendingcenter.com/lk_job_oppor.docx\"\n Heuristic match: \"_x+J?ESG)C?d{Z}SmByUBX$0C'RJ}(|1KkWpQ$T,)faB1O_>,\\3IOy*=@[-FZ].mq\"\n Heuristic match: \"O+`5.g'd(vxuIsK_/>'WP(K~; CryptStringToBinaryWLXLoadLibraryAM8LoadLibraryALhGetProcAddressMGetProcAddressLVirtualProtectfHmemcpyMp(VirtualProtectgPmemcpyfNtQueryInformationProcessxRRME(S\"SS\"@n(1Normal.ThisDocument@P 0%+. i0i2i4i6i80i:Pi CryptStringToBinaryWLXLoadLibraryAM8LoadLibraryALhGetProcAddressMGetProcAddressLVirtualProtectfHmemcpyMp(VirtualProtectgPmemcpyfNtQueryInformationProcessxRRME(S\"SS\"@n(1Normal.ThisDocument@P 0%+. i0i2i4i6i80i:Pi CryptStringToBinaryWLXLoadLibraryAM8LoadLibraryALhGetProcAddressMGetProcAddressLVirtualProtectfHmemcpyMp(VirtualProtectgPmemcpyfNtQueryInformationProcessxRRME(S\"SS\"@n(1Normal.ThisDocument@P 0%+. i0i2i4i6i80i:Pi CryptStringToBinaryWLXLoadLibraryAM8LoadLibraryALhGetProcAddressMGetProcAddressLVirtualProtectfHmemcpyMp(VirtualProtectgPmemcpyfNtQueryInformationProcessxRRME(S\"SS\"@n(1Normal.ThisDocument@P 0%+. i0i2i4i6i80i:Pi CryptStringToBinaryWLXLoadLibraryAM8LoadLibraryALhGetProcAddressMGetProcAddressLVirtualProtectfHmemcpyMp(VirtualProtectgPmemcpyfNtQueryInformationProcessxRRME(S\"SS\"@n(1Normal.ThisDocument@P 0%+. i0i2i4i6i80i:Pi CryptStringToBinaryWLXLoadLibraryAM8LoadLibraryALhGetProcAddressMGetProcAddressLVirtualProtectfHmemcpyMp(VirtualProtectgPmemcpyfNtQueryInformationProcessxRRME(S\"SS\"@n(1Normal.ThisDocument@P 0%+. i0i2i4i6i80i:Pi\n\\Sub Gantdll\" memHcpyDReyMV!gAnyA/mdBA)F?/?/\" (Indicator: \"GetProcAddress\"; File: \"0160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1.doc\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"666031aa7c6e201638001400"},{"report_type":"sandbox","report_id":"644cf7e36b92e9c3b1054811"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"H<\"\" (08@H@PX`hpx&\" (&Hp & b;a> CryptStringToBinaryWLXLoadLibraryAM8LoadLibraryALhGetProcAddressMGetProcAddressLVirtualProtectfHmemcpyMp(VirtualProtectgPmemcpyfNtQueryInformationProcessxRRME(S\"SS\"@n(1Normal.ThisDocument@P 0%+. i0i2i4i6i80i:Pi