26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T495,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious CVE-2017-0199 Sample 5d25e53b59bd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5d25e53b59bd…. Malware family: CVE-2017-0199. Threat score 100/100. 11/28 AV engines flagged this file. 8 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a","keywords":["Malicious","CVE-2017-0199","malware analysis","sandbox report","threat intelligence","5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a"],"about":{"@type":"SoftwareApplication","name":"사내 금융업무 상세내역.docx","applicationCategory":["docx","office"],"identifier":"5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"CVE-2017-0199","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T410,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT")28:Ta94,"WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119210000000000000000F01FEC\INSTALLPROPERTIES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119210000000000000000F01FEC\INSTALLPROPERTIES"; Key: "WINDOWSINSTALLER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109C20090400000000000F01FEC\INSTALLPROPERTIES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00000000000F01FEC\INSTALLPROPERTIES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109910090400000000000F01FEC\INSTALLPROPERTIES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109910090400000000000F01FEC\INSTALLPROPERTIES"; Key: "WINDOWSINSTALLER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\000041091A0090400000000000F01FEC\INSTALLPROPERTIES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\000041091A0090400000000000F01FEC\INSTALLPROPERTIES"; Key: "WINDOWSINSTALLER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400000000000F01FEC\INSTALLPROPERTIES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109A10090400000000000F01FEC\INSTALLPROPERTIES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109810090400000000000F01FEC\INSTALLPROPERTIES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109511090400000000000F01FEC\INSTALLPROPERTIES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400000000000F01FEC\INSTALLPROPERTIES"; Key: "WINDOWSINSTALLER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400000000000F01FEC\INSTALLPROPERTIES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109511090400000000000F01FEC\INSTALLPROPERTIES"; Key: "WINDOWSINSTALLER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109810090400000000000F01FEC\INSTALLPROPERTIES"; Key: "WINDOWSINSTALLER")29:T82a,"WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE"; Key: "DONTUSEDESKTOPCHANGEROUTER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA"; Key: "PRODUCTCODES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40"; Key: "PRODUCTCODES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\HAANSOFT HOFFICE 80 KOREAN"; Key: "PRODUCTCODES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\HAANSOFT HOFFICE 80 KOREAN") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE"; Key: "PRODUCTCODES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME"; Key: "PRODUCTCODES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX"; Key: "PRODUCTCODES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER"; Key: "PRODUCTCODES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "PRODUCTCODES") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3")2a:T476,"\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-AA66C345" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-782B8A52" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-1DDA7232" "Local\CSI_OMTX:{18F9006B-13F2-4F35-82CB-91F4778FA296}" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-B87E8579" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-2431DF8A" "Global\MsoCsi:GC:C:/Users/di9Eohu/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF" "Local\ZonesLockedCacheCounterMutex" "Global\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001" "Local\Csi_CTTxnLock:{40A2B17D-C42F-4AC0-B256-D6CE5CEEA1A3}" "Local\CSI_OMTX:{6F989EF4-EEC3-44E2-972D-CBF113D38793}" "Local\ZonesCacheCounterMutex" "Local\CSI_WDW:{891B210F-1247-4674-A382-E0496ACE9BB3}" "Global\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001" "Local\10MU_ACB10_S-1-5-5-0-69302" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-C3E36977" "Local\CSI_WDW:{213E7546-CC9E-44EF-AF70-FA9D61C37FE4}" "Global\552FFA80-3393-423d-8671-7BA046BB5906" "Local\Csi_TableRuntimeBucketsLock:{E0B81343-5AE1-4545-AACD-FAED45C60BC3}"2b:T9d9,"WINWORD.EXE" touched "Microsoft Word 97-2003-Dokument" (Path: "HKCU\CLSID\{00020906-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "WINWORD.EXE" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}") "WINWORD.EXE" touched "Computers and Devices" (Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "WINWORD.EXE" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "WINWORD.EXE" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\TREATAS") "WINWORD.EXE" touched "Network List Manager" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\INPROCHANDLER") "WINWORD.EXE" touched "Computer" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WINWORD.EXE" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WINWORD.EXE" touched "SAX XML Reader 6.0" (Path: "HKCU\CLSID\{88D96A0C-F192-11D4-A65F-0040963251E5}\TREATAS") "WINWORD.EXE" touched "MXXMLWriter 6.0" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A0F-F192-11D4-A65F-0040963251E5}\TREATAS") "WINWORD.EXE" touched "OneNote Word Add-In Take Notes Content Service Class" (Path: "HKCU\CLSID\{C580A1B2-5915-4DC3-BE93-8A51F4CAB320}\INPROCSERVER32") "WINWORD.EXE" touched "PersistentZoneIdentifier" (Path: "HKCU\CLSID\{0968E258-16C7-4DBA-AA86-462DD61E31A3}\TREATAS") "WINWORD.EXE" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\INPROCSERVER32") "WINWORD.EXE" touched "XML Schema Cache 6.0" (Path: "HKCU\CLSID\{88D96A07-F192-11D4-A65F-0040963251E5}\TREATAS") "WINWORD.EXE" touched "XML DOM Document 6.0" (Path: "HKCU\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}\PROGID") "WINWORD.EXE" touched "MXNamespaceManager 6.0" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A11-F192-11D4-A65F-0040963251E5}\TREATAS") "WINWORD.EXE" touched "StdHlink" (Path: "HKCU\CLSID\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\INPROCSERVER32") "WINWORD.EXE" touched "Webordner" (Path: "HKCU\CLSID\{BDEADF00-C265-11D0-BCED-00A0C90AB50F}\SHELLFOLDER") "WINWORD.EXE" touched "Microsoft Word-Vorlage mit Makros" (Path: "HKCU\CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") "WINWORD.EXE" touched "Microsoft Word-Dokument" (Path: "HKCU\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\PROGID")2c:T519,"5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a.file.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Fri Feb 4 14:20:26 2022 mtime=Fri Feb 4 14:20:26 2022 atime=Fri Feb 4 14:20:48 2022 length=110564 window=hide" "~_25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a.file.doc" has type "data" "~WRS_745ADBF1-8CB5-4DD6-ABDB-7428B2FCE4DF_.tmp" has type "data" "index.dat" has type "data" "FSD-_73F7F46D-EBA6-4833-82CE-D7680CCB387D_.FSD" has type "data" "_B233CB48-63CB-421C-BF09-9D12DCEBF595_" has type "data" "FSF-_0E1EEE64-E8C6-4E2A-9759-63CF07FD8988_.FSF" has type "data" "0203_1_.dotm" has type "Microsoft Word 2007+" "~WRS_27B85A91-6FCA-4EA6-A322-DFF64A9019F6_.tmp" has type "data" "ExcludeDictionaryEN0409.lex" has type "Little-endian UTF-16 Unicode text with no line terminators" "_9939B907-AAFD-418A-927F-CD3790F363CD_" has type "data" "FSD-_8F090C5D-D2BA-4596-B06A-409F3969E58E_.FSD" has type "data" "~WRS_BDE82185-338E-48D9-A8AE-6A5EE2C9822D_.tmp" has type "data" "knla.dat" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" "FSD-CNRY.FSD" has type "data" "1EDF0620.dotm" has type "Microsoft Word 2007+" "FSF-CTBL.FSF" has type "data" "~_Normal.dotm" has type "data"2d:T6ec,"WINWORD.EXE" touched file "C:\Windows\AppPatch\sysmain.sdb" "WINWORD.EXE" touched file "C:\Users\di9Eohu\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{863DD7A8-C570-4AE3-B338-FBFBDE5B92EA}.tmp" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BDE82185-338E-48D9-A8AE-6A5EE2C9822D}.tmp" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BCEB0660-03DB-4C3F-8F9F-798899826004}.tmp" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QQW0X29Y\0203[1].dotm" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{27B85A91-6FCA-4EA6-A322-DFF64A9019F6}.tmp" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll"2e:T57d,"%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tstB8F7.tmp" for deletion "%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tstB946.tmp" for deletion "%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tstB995.tmp" for deletion "%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tstB9C5.tmp" for deletion "%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tstBAC0.tmp" for deletion "%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\msoBD43.tmp" for deletion "%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{B233CB48-63CB-421C-BF09-9D12DCEBF595}" for deletion "%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\{9939B907-AAFD-418A-927F-CD3790F363CD}" for deletion "%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Local\Temp\tstBB0F.tmp" for deletion "%PROGRAMFILES%\Microsoft Office\Office14\WINWORD.EXE" marked "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Office\Recent\5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a.file.LNK" for deletion2f:T47e,"WINWORD.EXE" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tstB946.tmp" with delete access "WINWORD.EXE" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tstB995.tmp" with delete access "WINWORD.EXE" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tstB9C5.tmp" with delete access "WINWORD.EXE" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tstBAC0.tmp" with delete access "WINWORD.EXE" opened "C:\Users\%OSUSER%\AppData\Local\Temp\tstBB0F.tmp" with delete access "WINWORD.EXE" opened "C:\Users\%OSUSER%\AppData\Local\Temp\msoBD43.tmp" with delete access "WINWORD.EXE" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Office\Recent\0203.DOTM.URL" with delete access "WINWORD.EXE" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Office\Recent\DMS ON MS-WORK.COM-INFO.STORE.URL" with delete access "WINWORD.EXE" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Office\Recent\5D25E53B59BD2DCF234C6819F8CD294EFE6D943D04625B9D575002362794E74A.FILE.LNK" with delete access "WINWORD.EXE" opened "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Office\Recent\5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a.file.LNK" with delete access30:Ta14,"WINWORD.EXE" wrote bytes "d5d9ff7630c6ff76e0c2ff7642c6ff7610c6ff76acdcff76a0dfff7636daff7687f1ff760000000091776677c09066777f6f66771ffa6677def46677f2826677857d667700000000" to virtual address "0x71411000" (part of module "MSIMG32.DLL") "WINWORD.EXE" wrote bytes "2634010d" to virtual address "0x66A90BA8" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "e96953b9f0" to virtual address "0x75CD3F8A" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "3dcd5d03" to virtual address "0x6D6410AC" (part of module "MSPTLS.DLL") "WINWORD.EXE" wrote bytes "59dcce0d" to virtual address "0x68F9F530" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "c72fcf0d" to virtual address "0x67A978E4" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "fae69577e1a69a772e719a77ee299a7785e295776da09a7726e49577d16d9a77003d9877804b987700000000ad3762778b2d6277b641627700000000" to virtual address "0x74CD1000" (part of module "WSHTCPIP.DLL") "WINWORD.EXE" wrote bytes "eb29b870" to virtual address "0x6DD263DC" (part of module "WPFT632.CNV") "WINWORD.EXE" wrote bytes "84650400" to virtual address "0x6DB4BE64" (part of module "WPFT632.CNV") "WINWORD.EXE" wrote bytes "85ef5305" to virtual address "0x61A1AE34" (part of module "MSCORWKS.DLL") "WINWORD.EXE" wrote bytes "b811110000663d33c0ba6c2a010468dcf55761c3" to virtual address "0x04014F14" "WINWORD.EXE" wrote bytes "75236683" to virtual address "0x711416CC" (part of module "PRNTVPT.DLL") "WINWORD.EXE" wrote bytes "d1f11703" to virtual address "0x61DE9904" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "d03dcf0d" to virtual address "0x6D11CA70" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "e7399677e1a69a772e719a77ee299a7785e295776da09a77906499773ad5a07726e49577d16d9a77003d9877804b987700000000ad3762778b2d6277b641627700000000" to virtual address "0x75211000" (part of module "WSHIP6.DLL") "WINWORD.EXE" wrote bytes "b0473f0c" to virtual address "0x2F701B94" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "e9848e83ef" to virtual address "0x76FFF71B" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "c04e987720549977e0659977b5389a770000000000d0ff7600000000c5eaff760000000088eaff7600000000e9688e7582289a77ee299a7700000000d2698e75000000007dbbff760000000009be8e7500000000ba18ff7600000000" to virtual address "0x77AA1000" (part of module "NSI.DLL") "WINWORD.EXE" wrote bytes "e9ab99bcf0" to virtual address "0x75CD5D66" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "e9c454baf0" to virtual address "0x75CD3F20" ("VariantClear@OLEAUT32.DLL")31:T6ca,"WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040F") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000410") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000412") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000416") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000421") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000423") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000424") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000425") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000042C") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000044B") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000045B") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000045E") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000486") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000488") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00002401") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00002409") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000240A") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000241A") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000340A") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000540A")32:T579,Found malicious artifacts related to "31.170.167.235": ... URL: https://com-info.store/ (AV positives: 4/93 scanned on 02/04/2022 15:00:03) URL: http://ms-work.com-info.store/home/?id=WALKER-PC&act=wbi&ver=x86 (AV positives: 10/94 scanned on 02/04/2022 10:38:16) URL: http://ms-work.com-info.store/home/?id= (AV positives: 11/94 scanned on 02/04/2022 09:10:41) URL: http://ms-work.com-info.store/home/?act=ucd&id={UserName}&ver={SystemVer} (AV positives: 10/94 scanned on 02/04/2022 06:50:57) URL: http://ms-work.com-info.store/home/?id={UserName}&act=wbi&ver={SystemVersion} (AV positives: 10/94 scanned on 02/04/2022 06:49:23) File SHA256: 7a91c1bd270f5296c049433afc5f48302429b62fd108af25a0c0d98f87d8ec44 (AV positives: 25/61 scanned on 07/23/2017 10:12:38) File SHA256: 8b61062eff69b922b07bb40dcb53de6fce5a51a4e36765d6989b5cb4b18d1ab4 (AV positives: 43/64 scanned on 07/22/2017 16:11:13) File SHA256: 9a8b3a6da53ba6e6e632c8b7add52fa85702baea1e26c68711650bc2d13ba5a2 (Date: 06/18/2017 20:31:01) File SHA256: a5ddce8b91b88f47761e198e3f4699c91c859aab05bc9e3353e897d599ee4c1b (AV positives: 41/62 scanned on 06/09/2017 06:09:26) File SHA256: ace41990d3b6a35995db01aef3add523f5aa51a27e3682c3dd1a882b107d1350 (AV positives: 47/59 scanned on 06/09/2017 06:09:16) File SHA256: 8dc294fcf6c0e1fbf8a45b851becdc3c3a81eb98996bd448270fce830c2c5807 (AV positives: 26/57 scanned on 06/01/2017 18:32:34)33:T8e1,Found PE header "MZ" - Source: "00000000-00004068.00000000.67122.01280000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000000.67122.04EA0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000000.67122.61520000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000000.67122.CBAF0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000000.67122.CD330000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000000.67122.CF020000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000000.67122.D9230000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000000.67122.D9400000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000000.67122.E4D50000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.01280000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.04EA0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.61450000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.61520000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.CBAF0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.CD330000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.CF020000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.D6510000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.D6BD0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.D8BF0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.D90D0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.D9230000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.D9400000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.E4D50000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000001.69043.E54E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004068.00000002.70960.01280000.00000002.mdmp")34:T809,"Insert the data into the document" (Source: 00000000-00004068.00000000.67122.04EA0000.00000002.mdmp, 00000000-00004068.00000001.69043.04EA0000.00000002.mdmp, 00000000-00004068.00000002.70960.04EA0000.00000002.mdmp, Indicator: "insert the data into the document") "Inserts a new object into your document.Inserts a new object into your document as an icon.Inserts the contents of the file into your document so that you can edit it later using the application which created the source file.Inserts an icon that represents the contents of the file into your document.Inserts the contents of the file into your document and creates a shortcut to the source file. Changes to the source file will be reflected in your document.Inserts an icon that represents the contents of the file into your document. Changes to the source file will be reflected in your document." (Source: 00000000-00004068.00000000.67122.04EA0000.00000002.mdmp, 00000000-00004068.00000001.69043.04EA0000.00000002.mdmp, 00000000-00004068.00000002.70960.04EA0000.00000002.mdmp, Indicator: "inserts a new object into your document.inserts a new object into your document as an icon.inserts the contents of the file into your document so that you can edit it later using the application which created the source file.inserts an icon that represents the contents of the file into your document.inserts the contents of the file into your document and creates a shortcut to the source file. changes to the source file will be reflected in your document.inserts an icon that represents the contents of the file into your document. changes to the source file will be reflected in your document.") "Inserts the contents of the Clipboard into your document so that you can edit it using ." (Source: 00000000-00004068.00000000.67122.04EA0000.00000002.mdmp, 00000000-00004068.00000001.69043.04EA0000.00000002.mdmp, 00000000-00004068.00000002.70960.04EA0000.00000002.mdmp, Indicator: "inserts the contents of the clipboard into your document so that you can edit it using .")35:T17c0,"WINWORD.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f6220000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base f6220000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base f6220000 "WINWORD.EXE" loaded module "KERNEL32" at base f7870000 "WINWORD.EXE" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base e5570000 "WINWORD.EXE" loaded module "IMM32.DLL" at base f7070000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base e4e80000 "WINWORD.EXE" loaded module "WWLIB.DLL" at base cf020000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSO.DLL" at base cbaf0000 "WINWORD.EXE" loaded module "MSO.DLL" at base cbaf0000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base e5af0000 "WINWORD.EXE" loaded module "KERNEL32.DLL" at base f7870000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 5070000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\1033\WWINTL.DLL" at base 4ea0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base f3f90000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 5490000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base 5700000 "WINWORD.EXE" loaded module "DWMAPI.DLL" at base f4410000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base f6ad0000 "WINWORD.EXE" loaded module "SRPAPI.DLL" at base da000000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base f7870000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSPTLS.DLL" at base e4d50000 "WINWORD.EXE" loaded module "UXTHEME.DLL" at base f3f90000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base d9230000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base e4ce0000 "WINWORD.EXE" loaded module "ADVAPI32.DLL" at base f6ad0000 "WINWORD.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base d9180000 "WINWORD.EXE" loaded module "SHLWAPI.DLL" at base f7ee0000 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base f59e0000 "WINWORD.EXE" loaded module "VERSION.DLL" at base f0fc0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 61520000 "WINWORD.EXE" loaded module "RPCRT4.DLL" at base f7920000 "WINWORD.EXE" loaded module "WINSPOOL.DRV" at base e4f30000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base f2970000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base ef610000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base f5a00000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base d90a0000 "WINWORD.EXE" loaded module "NTDLL.DLL" at base f9600000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base eff80000 "WINWORD.EXE" loaded module "OLEAUT32.DLL" at base f7fe0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base f6d60000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\ONBTTNWD.DLL" at base d90d0000 "WINWORD.EXE" loaded module "GDI32.DLL" at base f6b80000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NORMALIZ.DLL" at base f7850000 "WINWORD.EXE" loaded module "MSI.DLL" at base d8460000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SXS.DLL" at base f57b0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CSI.DLL" at base d8bf0000 "WINWORD.EXE" loaded module "CSI.DLL" at base d8bf0000 "WINWORD.EXE" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base d98e0000 "WINWORD.EXE" loaded module "WINHTTP.DLL" at base ef810000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base f5180000 "WINWORD.EXE" loaded module "URLMON.DLL" at base ed110000 "WINWORD.EXE" loaded module "PHONEINFO.DLL" at base 0 "WINWORD.EXE" loaded module "HLINK.DLL" at base e3540000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base e11d0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base f5a80000 "WINWORD.EXE" loaded module "CSCAPI.DLL" at base e9350000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base f6ed0000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base f6ed0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base f7bd0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base f6bb0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base f4410000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSPROOF7.DLL" at base e54e0000 "WINWORD.EXE" loaded module "COMCTL32" at base e5af0000 "WINWORD.EXE" loaded module "USER32.DLL" at base f6ed0000 "WINWORD.EXE" loaded module "OLE32.DLL" at base f6bb0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\1033\MSGR3EN.DLL" at base d6510000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\MSSP7EN.DLL" at base ef2b0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\\MSCSS7EN.DLL" at base ef570000 "WINWORD.EXE" loaded module "CSS7DATA0009.DLL" at base ef210000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSCSS7CM_EN.DUB" at base b4e0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSCSS7WRE_EN.DUB" at base b4e0000 "WINWORD.EXE" loaded module "MLANG.DLL" at base da030000 "WINWORD.EXE" loaded module "GDIPLUS.DLL" at base d7130000 "WINWORD.EXE" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base d7130000 "WINWORD.EXE" loaded module "NETAPI32.DLL" at base e9290000 "WINWORD.EXE" loaded module "POWRPROF.DLL" at base f599000036:T16be,Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00004068-00000C24-27926983] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00004068-00000C24-28491710] Observed system executable string:"%WINDIR%\system32\mscoree.dll" [Source: 00000000-00004068-00000C24-29002520] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00004068-00000C24-29272254] Observed system executable string:"%WINDIR%\system32\normaliz.dll" [Source: 00000000-00004068-00000C24-40868249] Observed system executable string:"C:\windows\temp\VxSSL64.dll" [Source: 00000000-00004068.00000000.67122.00B00000.00000020.mdmp 00000000-00004068.00000001.69043.00B00000.00000020.mdmp 00000000-00004068.00000002.70960.00B00000.00000020.mdmp] Observed system executable string:"C:\WINDOWS\system32\sxsoa.dll" [Source: 00000000-00004068.00000000.67122.00B30000.00000002.mdmp 00000000-00004068.00000001.69043.00B30000.00000002.mdmp 00000000-00004068.00000002.70960.00B30000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\GdiPlus.dll" [Source: 00000000-00004068.00000000.67122.00B30000.00000002.mdmp 00000000-00004068.00000001.69043.00B30000.00000002.mdmp 00000000-00004068.00000002.70960.00B30000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\comctl32.dll" [Source: 00000000-00004068.00000000.67122.00B30000.00000002.mdmp 00000000-00004068.00000001.69043.00B30000.00000002.mdmp 00000000-00004068.00000002.70960.00B30000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\sxsoaps.dll" [Source: 00000000-00004068.00000000.67122.00B30000.00000002.mdmp 00000000-00004068.00000001.69043.00B30000.00000002.mdmp 00000000-00004068.00000002.70960.00B30000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\comctl32.dll.mui" [Source: 00000000-00004068.00000000.67122.00B30000.00000002.mdmp 00000000-00004068.00000001.69043.00B30000.00000002.mdmp 00000000-00004068.00000002.70960.00B30000.00000002.mdmp] Observed system executable string:"Microsoft.Windows.Installer.Engine,processorArchitecture="*",type="win32",version="5.1.0.0"C:\Windows\System32\msi.dll" [Source: 00000000-00004068.00000000.67122.00B70000.00000002.mdmp 00000000-00004068.00000001.69043.00B70000.00000002.mdmp 00000000-00004068.00000002.70960.00B70000.00000002.mdmp] Observed system executable string:"C:\windows\temp\VxOle64.dll" [Source: 00000000-00004068.00000000.67122.00BA0000.00000020.mdmp 00000000-00004068.00000000.67122.00BC0000.00000002.mdmp 00000000-00004068.00000001.69043.00BA0000.00000020.mdmp 00000000-00004068.00000001.69043.00BC0000.00000002.mdmp 00000000-00004068.00000002.70960.00BA0000.00000020.mdmp 00000000-00004068.00000002.70960.00BC0000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\Temp\VxSSL64.dll" [Source: 00000000-00004068.00000000.67122.00BB0000.00000002.mdmp 00000000-00004068.00000001.69043.00BB0000.00000002.mdmp 00000000-00004068.00000002.70960.00BB0000.00000002.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\ntdll.dll" [Source: 00000000-00004068.00000000.67122.02F50000.00000004.mdmp 00000000-00004068.00000001.69043.02F50000.00000004.mdmp 00000000-00004068.00000002.70960.02F50000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\KERNEL32.DLL" [Source: 00000000-00004068.00000000.67122.02F50000.00000004.mdmp 00000000-00004068.00000001.69043.02F50000.00000004.mdmp 00000000-00004068.00000002.70960.02F50000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\apphelp.dll" [Source: 00000000-00004068.00000000.67122.02F50000.00000004.mdmp 00000000-00004068.00000001.69043.02F50000.00000004.mdmp 00000000-00004068.00000002.70960.02F50000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\KERNELBASE.dll" [Source: 00000000-00004068.00000000.67122.02F50000.00000004.mdmp 00000000-00004068.00000001.69043.02F50000.00000004.mdmp 00000000-00004068.00000002.70960.02F50000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\msvcrt.dll" [Source: 00000000-00004068.00000000.67122.02F50000.00000004.mdmp 00000000-00004068.00000001.69043.02F50000.00000004.mdmp 00000000-00004068.00000002.70960.02F50000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\ADVAPI32.dll" [Source: 00000000-00004068.00000000.67122.02F50000.00000004.mdmp 00000000-00004068.00000001.69043.02F50000.00000004.mdmp 00000000-00004068.00000002.70960.02F50000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\sechost.dll" [Source: 00000000-00004068.00000000.67122.02F50000.00000004.mdmp 00000000-00004068.00000001.69043.02F50000.00000004.mdmp 00000000-00004068.00000002.70960.02F50000.00000004.mdmp] Observed system executable string:":\WINDOWS\SYSTEM32\AcSpecfc.DLL" [Source: 00000000-00004068.00000000.67122.02F50000.00000004.mdmp 00000000-00004068.00000001.69043.02F50000.00000004.mdmp 00000000-00004068.00000002.70960.02F50000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\RPCRT4.dll" [Source: 00000000-00004068.00000000.67122.02F50000.00000004.mdmp 00000000-00004068.00000001.69043.02F50000.00000004.mdmp 00000000-00004068.00000002.70960.02F50000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\gdi32full.dll" [Source: 00000000-00004068.00000000.67122.02F50000.00000004.mdmp 00000000-00004068.00000001.69043.02F50000.00000004.mdmp 00000000-00004068.00000002.70960.02F50000.00000004.mdmp] Observed system executable string:":\WINDOWS\System32\USER32.dll" [Source: 00000000-00004068.00000000.67122.02F50000.00000004.mdmp 00000000-00004068.00000001.69043.02F50000.00000004.mdmp 00000000-00004068.00000002.70960.02F50000.00000004.mdmp]37:T6cd,"WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\OFFICE\14.0\WORD\SECURITY\FILEBLOCK"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\SECURITY\FILEBLOCK"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{88D96A0C-F192-11D4-A65F-0040963251E5}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A0C-F192-11D4-A65F-0040963251E5}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{88D96A11-F192-11D4-A65F-0040963251E5}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A11-F192-11D4-A65F-0040963251E5}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A07-F192-11D4-A65F-0040963251E5}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SCHEMA LIBRARY"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SCHEMA LIBRARY\HTTP://PURL.ORG/DC/ELEMENTS/1.1/"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SCHEMA LIBRARY"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SCHEMA LIBRARY\HTTP://SCHEMAS.OPENXMLFORMATS.ORG/PACKAGE/2006/METADATA/CORE-PROPERTIES"; Key: ""; Value: "")38:T8e5,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A05-F192-11D4-A65F-0040963251E5}"; Key: "INSECUREQI"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A0C-F192-11D4-A65F-0040963251E5}"; Key: "INSECUREQI"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A11-F192-11D4-A65F-0040963251E5}"; Key: "INSECUREQI"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A07-F192-11D4-A65F-0040963251E5}"; Key: "INSECUREQI"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON"; Key: "SAVETHUMBNAILS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\INTERNET"; Key: "ALWAYSSAVEINDEFAULTENCODING"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\INTERNET"; Key: "SAVENEWWEBPAGESASWEBARCHIVES"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A0E-F192-11D4-A65F-0040963251E5}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A0E-F192-11D4-A65F-0040963251E5}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A0E-F192-11D4-A65F-0040963251E5}\INPROCSERVER32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{88D96A0E-F192-11D4-A65F-0040963251E5}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "")39:T1591,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004068.00000000.67122.02F50000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/officedocument/2006/extended-properties'" - Source: "00000000-00004068.00000001.69043.02F50000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/officedocument/2006/bibliography'" - Source: "00000000-00004068.00000001.69043.02F50000.00000004.mdmp") Found URL "http://purl.org/dc/elements/1.1/'" - Source: "00000000-00004068.00000001.69043.02F50000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/metadata/core-properties'" - Source: "00000000-00004068.00000001.69043.02F50000.00000004.mdmp") Found URL "http://purl.org/dc/elements/1.1/'" - Source: "00000000-00004068.00000001.69043.09E30000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/metadata/core-properties'" - Source: "00000000-00004068.00000001.69043.09E30000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/officedocument/2006/bibliographybliography'" - Source: "00000000-00004068.00000001.69043.0C050000.00000004.mdmp") Found URL "http://www.w3.org/2000/xmlns/buttonslabcolumnexpansionweightbuttonslabcolumnminwidthonenote" - Source: "00000000-00004068.00000001.69043.0C050000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/officedocument/2006/extended-properties'" - Source: "00000000-00004068.00000001.69043.0C240000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00004068.00000001.69043.0F7DE000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00004068.00000001.69043.0F880000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00004068.00000001.69043.0F8A0000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00004068.00000001.69043.0F8C0000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00004068.00000001.69043.0F8D0000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00004068.00000001.69043.0F8F0000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/content-types" - Source: "00000000-00004068.00000001.69043.0F900000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/content-t" - Source: "00000000-00004068.00000001.69043.0F920000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004068.00000001.69043.D6BE2000.00000002.mdmp") Found URL "https://http://creating" - Source: "00000000-00004068.00000001.69043.D8EF2000.00000002.mdmp") Found URL "http://schemas.openxmlformats.org/officedocument/2006/extended-properties'" - Source: "00000000-00004068.00000002.70960.02F50000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/officedocument/2006/bibliography'" - Source: "00000000-00004068.00000002.70960.02F50000.00000004.mdmp") Found URL "http://purl.org/dc/elements/1.1/'" - Source: "00000000-00004068.00000002.70960.02F50000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/metadata/core-properties'" - Source: "00000000-00004068.00000002.70960.02F50000.00000004.mdmp") Found URL "http://purl.org/dc/elements/1.1/'" - Source: "00000000-00004068.00000002.70960.09E30000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/metadata/core-properties'" - Source: "00000000-00004068.00000002.70960.09E30000.00000004.mdmp") Found URL "http://httplhttp:hvaehavehvainghavinghwichwhichi" - Source: "00000000-00004068.00000002.70960.0A0E0000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/officedocument/2006/bibliographybliography'" - Source: "00000000-00004068.00000002.70960.0C050000.00000004.mdmp") Found URL "http://www.w3.org/2000/xmlns/buttonslabcolumnexpansionweightbuttonslabcolumnminwidthonenote" - Source: "00000000-00004068.00000002.70960.0C050000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/officedocument/2006/extended-properties'" - Source: "00000000-00004068.00000002.70960.0C240000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00004068.00000002.70960.0F7DE000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00004068.00000002.70960.0F880000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00004068.00000002.70960.0F8A0000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00004068.00000002.70960.0F8C0000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/relationships" - Source: "00000000-00004068.00000002.70960.0F8D0000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/r" - Source: "00000000-00004068.00000002.70960.0F8F0000.00000004.mdmp") Found URL "http://schemas.openxmlformats.org/package/2006/content-types" - Source: "00000000-00004068.00000002.70960.0F900000.00000004.mdmp") Found URL "http://schemas.openformatrg/package/2006/content-t" - Source: "00000000-00004068.00000002.70960.0F920000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00004068.00000002.70960.D6BE2000.00000002.mdmp")3a:T715,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")3b:T1798e,"WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "NJ2"; Value: "nj2") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "Off") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "4F006E000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "WORDFILES"; Value: "0200F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1600F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1700F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "FONTINFOCACHEW"; Value: "6000000060000000F5FFFFFF000000000000000000000000BC02000000000000004000225400610068006F006D006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D0000000B0000000200000002000000000000000600000020000000BC0200000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C0290000000000000001000000000028200700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D0000000B000000020000000200000000000000050000001B000000900100000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C02900000000000000010000000000282006000000F7FFFFFF0000000000000000000000009001000000000000004000225400610068006F006D006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000B000000090000000200000002000000000000000400000016000000900100000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C02900000000000000010000000000282005000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "MTTT"; Value: "E40F0000894A788F08BBD90100000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "*53"; Value: "*53") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: ">73"; Value: ">73") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "5=3"; Value: "5=3") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\INTERNET\SERVER CACHE"; Key: "VERSION"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\REVIEWCYCLE"; Key: "REVIEWTOKEN"; Value: "{00849E2F-06AA-4102-A353-8234B644424B}") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "COURIER NEW"; Value: "02070309020205020404") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SIMSUN"; Value: "02010600030101010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MS GOTHIC"; Value: "020B0609070205080204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CENTURY"; Value: "02040604050505020304") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SYLFAEN"; Value: "010A0502050306030303") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ARIAL UNICODE MS"; Value: "020B0604020202020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "TAHOMA"; Value: "020B0604030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MALGUN GOTHIC"; Value: "020B0503020000020004") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "EBRIMA"; Value: "02000000000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MARLETT"; Value: "00000000000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ARIAL BLACK"; Value: "020B0A04020102020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BAHNSCHRIFT LIGHT"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BAHNSCHRIFT SEMILIGHT"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BAHNSCHRIFT"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BAHNSCHRIFT SEMIBOLD"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CANDARA"; Value: "020E0502030303020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "COMIC SANS MS"; Value: "030F0702030302020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CONSOLAS"; Value: "020B0609020204030204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CONSTANTIA"; Value: "02030602050306030303") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CORBEL"; Value: "020B0503020204020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "FRANKLIN GOTHIC MEDIUM"; Value: "020B0603020102020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "GABRIOLA"; Value: "04040605051002020D02") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "GADUGI"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "GEORGIA"; Value: "02040502050405020303") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "IMPACT"; Value: "020B0806030902050204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "JAVANESE TEXT"; Value: "02000000000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "LEELAWADEE UI"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "LEELAWADEE UI SEMILIGHT"; Value: "020B0402040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "LUCIDA CONSOLE"; Value: "020B0609040504020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "LUCIDA SANS UNICODE"; Value: "020B0602030504020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MALGUN GOTHIC"; Value: "020B0503020000020004") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MALGUN GOTHIC SEMILIGHT"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MALGUN GOTHIC SEMILIGHT"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT HIMALAYA"; Value: "01010100010101010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT JHENGHEI"; Value: "020B0604030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MICROSOFT JHENGHEI"; Value: "020B0604030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT JHENGHEI UI"; Value: "020B0604030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MICROSOFT JHENGHEI UI"; Value: "020B0604030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT JHENGHEI LIGHT"; Value: "020B0304030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MICROSOFT JHENGHEI LIGHT"; Value: "020B0304030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT JHENGHEI UI LIGHT"; Value: "020B0304030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MICROSOFT JHENGHEI UI LIGHT"; Value: "020B0304030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT NEW TAI LUE"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT PHAGSPA"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT SANS SERIF"; Value: "020B0604020202020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT TAI LE"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT YAHEI"; Value: "020B0503020204020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MICROSOFT YAHEI"; Value: "020B0503020204020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT YAHEI UI"; Value: "020B0503020204020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MICROSOFT YAHEI UI"; Value: "020B0503020204020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT YAHEI LIGHT"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MICROSOFT YAHEI LIGHT"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT YAHEI UI LIGHT"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MICROSOFT YAHEI UI LIGHT"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT YI BAITI"; Value: "03000500000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MINGLIU-EXTB"; Value: "02020500000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MINGLIU-EXTB"; Value: "02020500000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "PMINGLIU-EXTB"; Value: "02020500000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@PMINGLIU-EXTB"; Value: "02020500000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MINGLIU_HKSCS-EXTB"; Value: "02020500000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MINGLIU_HKSCS-EXTB"; Value: "02020500000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MONGOLIAN BAITI"; Value: "03000500000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MS GOTHIC"; Value: "020B0609070205080204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MS UI GOTHIC"; Value: "020B0600070205080204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MS UI GOTHIC"; Value: "020B0600070205080204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MS PGOTHIC"; Value: "020B0600070205080204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MS PGOTHIC"; Value: "020B0600070205080204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MV BOLI"; Value: "02000500030200090000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MYANMAR TEXT"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "NIRMALA UI"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "NIRMALA UI SEMILIGHT"; Value: "020B0402040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "PALATINO LINOTYPE"; Value: "02040502050505030304") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SEGOE MDL2 ASSETS"; Value: "050A0102010101010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SEGOE PRINT"; Value: "02000600000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SEGOE SCRIPT"; Value: "030B0504020000000003") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SEGOE UI"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SEGOE UI BLACK"; Value: "020B0A02040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SEGOE UI EMOJI"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SEGOE UI HISTORIC"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SEGOE UI LIGHT"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SEGOE UI SEMIBOLD"; Value: "020B0702040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SEGOE UI SEMILIGHT"; Value: "020B0402040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SEGOE UI SYMBOL"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@SIMSUN"; Value: "02010600030101010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "NSIMSUN"; Value: "02010609030101010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@NSIMSUN"; Value: "02010609030101010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SIMSUN-EXTB"; Value: "02010609060101010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@SIMSUN-EXTB"; Value: "02010609060101010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SITKA SMALL"; Value: "02000505000000020004") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SITKA TEXT"; Value: "02000505000000020004") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SITKA SUBHEADING"; Value: "02000505000000020004") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SITKA HEADING"; Value: "02000505000000020004") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SITKA DISPLAY"; Value: "02000505000000020004") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SITKA BANNER"; Value: "02000505000000020004") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "TREBUCHET MS"; Value: "020B0603020202020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "VERDANA"; Value: "020B0604030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "WEBDINGS"; Value: "05030102010509060703") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "YU GOTHIC"; Value: "020B0400000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@YU GOTHIC"; Value: "020B0400000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "YU GOTHIC UI"; Value: "020B0500000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@YU GOTHIC UI"; Value: "020B0500000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "YU GOTHIC UI SEMIBOLD"; Value: "020B0700000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@YU GOTHIC UI SEMIBOLD"; Value: "020B0700000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "YU GOTHIC LIGHT"; Value: "020B0300000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@YU GOTHIC LIGHT"; Value: "020B0300000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "YU GOTHIC UI LIGHT"; Value: "020B0300000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@YU GOTHIC UI LIGHT"; Value: "020B0300000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "YU GOTHIC MEDIUM"; Value: "020B0500000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@YU GOTHIC MEDIUM"; Value: "020B0500000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "YU GOTHIC UI SEMILIGHT"; Value: "020B0400000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@YU GOTHIC UI SEMILIGHT"; Value: "020B0400000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "HOLOLENS MDL2 ASSETS"; Value: "050A0102010101010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "LEELAWADEE"; Value: "020B0502040204020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MICROSOFT UIGHUR"; Value: "02000000000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "WINGDINGS 2"; Value: "05020102010507070707") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "WINGDINGS 3"; Value: "05040102010807070707") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "TEMPUS SANS ITC"; Value: "04020404030D07020202") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "PRISTINA"; Value: "03060402040406080204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "PAPYRUS"; Value: "03070502060502030205") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MISTRAL"; Value: "03090702030407020403") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "LUCIDA HANDWRITING"; Value: "03010101010101010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "KRISTEN ITC"; Value: "03050502040202030202") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "JUICE ITC"; Value: "04040403040A02020202") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "FRENCH SCRIPT MT"; Value: "03020402040607040605") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "FREESTYLE SCRIPT"; Value: "030804020302050B0404") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BRADLEY HAND ITC"; Value: "03070402050302030203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ARIAL NARROW"; Value: "020B0606020202030204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BOOK ANTIQUA"; Value: "02040602050305030304") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "GARAMOND"; Value: "02020404030301010803") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MONOTYPE CORSIVA"; Value: "03010101010201010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CENTURY GOTHIC"; Value: "020B0502020202020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ALGERIAN"; Value: "04020705040A02060702") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BASKERVILLE OLD FACE"; Value: "02020602080505020303") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BAUHAUS 93"; Value: "04030905020B02020C02") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BELL MT"; Value: "02020503060305020303") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BERLIN SANS FB"; Value: "020E0602020502020306") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BERNARD MT CONDENSED"; Value: "02050806060905020404") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BODONI MT POSTER COMPRESSED"; Value: "02070706080601050204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BRITANNIC BOLD"; Value: "020B0903060703020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BROADWAY"; Value: "04040905080B02020502") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BRUSH SCRIPT MT"; Value: "03060802040406070304") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CALIFORNIAN FB"; Value: "0207040306080B030204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CENTAUR"; Value: "02030504050205020304") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CHILLER"; Value: "04020404031007020602") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "COLONNA MT"; Value: "04020805060202030203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "COOPER BLACK"; Value: "0208090404030B020404") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "FOOTLIGHT MT LIGHT"; Value: "0204060206030A020304") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "HARLOW SOLID ITALIC"; Value: "04030604020F02020D02") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "HARRINGTON"; Value: "04040505050A02020702") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "HIGH TOWER TEXT"; Value: "02040502050506030303") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "JOKERMAN"; Value: "04090605060D06020702") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "KUNSTLER SCRIPT"; Value: "030304020206070D0D06") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "LUCIDA BRIGHT"; Value: "02040602050505020304") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "LUCIDA CALLIGRAPHY"; Value: "03010101010101010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "LUCIDA FAX"; Value: "02060602050505020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MAGNETO"; Value: "04030805050802020D02") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MATURA MT SCRIPT CAPITALS"; Value: "03020802060602070202") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MODERN NO. 20"; Value: "02070704070505020303") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "NIAGARA ENGRAVED"; Value: "04020502070703030202") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "NIAGARA SOLID"; Value: "04020502070702020202") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "OLD ENGLISH TEXT MT"; Value: "03040902040508030806") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ONYX"; Value: "04050602080702020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "PARCHMENT"; Value: "03040602040708040804") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "PLAYBILL"; Value: "040506030A0602020202") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "POOR RICHARD"; Value: "02080502050505020702") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "RAVIE"; Value: "04040805050809020602") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "INFORMAL ROMAN"; Value: "030604020304060B0204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SHOWCARD GOTHIC"; Value: "04020904020102020604") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SNAP ITC"; Value: "04040A07060A02020202") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "STENCIL"; Value: "040409050D0802020404") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "VINER HAND ITC"; Value: "03070502030502020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "VIVALDI"; Value: "03020602050506090804") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "VLADIMIR SCRIPT"; Value: "03050402040407070305") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "WIDE LATIN"; Value: "020A0A07050505020404") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "TW CEN MT"; Value: "020B0602020104020603") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "TW CEN MT CONDENSED"; Value: "020B0606020104020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "SCRIPT MT BOLD"; Value: "03040602040607080904") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ROCKWELL EXTRA BOLD"; Value: "02060903040505020403") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ROCKWELL CONDENSED"; Value: "02060603050405020104") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ROCKWELL"; Value: "02060603020205020403") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "RAGE ITALIC"; Value: "03070502040507070304") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "PERPETUA TITLING MT"; Value: "02020502060505020804") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "PERPETUA"; Value: "02020502060401020303") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "PALACE SCRIPT MT"; Value: "030303020206070C0B05") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "OCR A EXTENDED"; Value: "02010509020102010303") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MAIANDRA GD"; Value: "020E0502030308020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "LUCIDA SANS TYPEWRITER"; Value: "020B0509030504030204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "LUCIDA SANS"; Value: "020B0602030504020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "IMPRINT MT SHADOW"; Value: "04020605060303030202") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "HAETTENSCHWEILER"; Value: "020B0706040902060204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "GOUDY STOUT"; Value: "0202090407030B020401") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "GOUDY OLD STYLE"; Value: "02020502050305020303") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "GLOUCESTER MT EXTRA CONDENSED"; Value: "02030808020601010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "GILL SANS ULTRA BOLD CONDENSED"; Value: "020B0A06020104020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "GILL SANS ULTRA BOLD"; Value: "020B0A02020104020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "GILL SANS MT CONDENSED"; Value: "020B0506020104020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "GILL SANS MT"; Value: "020B0502020104020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "GILL SANS MT EXT CONDENSED BOLD"; Value: "020B0902020104020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "GIGI"; Value: "04040504061007020D02") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "FRANKLIN GOTHIC MEDIUM COND"; Value: "020B0606030402020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "FRANKLIN GOTHIC HEAVY"; Value: "020B0903020102020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "FRANKLIN GOTHIC DEMI COND"; Value: "020B0706030402020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "FRANKLIN GOTHIC DEMI"; Value: "020B0703020102020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "FRANKLIN GOTHIC BOOK"; Value: "020B0503020102020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "FORTE"; Value: "03060902040502070203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "FELIX TITLING"; Value: "04060505060202020A04") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ERAS MEDIUM ITC"; Value: "020B0602030504020804") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ERAS LIGHT ITC"; Value: "020B0402030504020804") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ERAS DEMI ITC"; Value: "020B0805030504020804") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ERAS BOLD ITC"; Value: "020B0907030504020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ENGRAVERS MT"; Value: "02090707080505020304") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ELEPHANT"; Value: "02020904090505020303") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "EDWARDIAN SCRIPT ITC"; Value: "030303020407070D0804") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CURLZ MT"; Value: "04040404050702020202") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "COPPERPLATE GOTHIC LIGHT"; Value: "020E0507020206020404") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "COPPERPLATE GOTHIC BOLD"; Value: "020E0705020206020404") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CENTURY SCHOOLBOOK"; Value: "02040604050505020304") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CASTELLAR"; Value: "020A0402060406010301") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "CALISTO MT"; Value: "02040603050505030304") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BOOKMAN OLD STYLE"; Value: "02050604050505020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BODONI MT CONDENSED"; Value: "02070606080606020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BODONI MT BLACK"; Value: "02070A03080606020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BODONI MT"; Value: "02070603080606020203") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BLACKADDER ITC"; Value: "04020505051007020D02") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "ARIAL ROUNDED MT BOLD"; Value: "020F0704030504030204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "AGENCY FB"; Value: "020B0503020202020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BERLIN SANS FB DEMI"; Value: "020E0802020502020306") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "TW CEN MT CONDENSED EXTRA BOLD"; Value: "020B0803020202020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@ARIAL UNICODE MS"; Value: "020B0604020202020204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MEIRYO"; Value: "020B0604030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MEIRYO"; Value: "020B0604030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MEIRYO UI"; Value: "020B0604030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "@MEIRYO UI"; Value: "020B0604030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MT EXTRA"; Value: "05050102010205020202") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MS OUTLOOK"; Value: "05010100010000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "BOOKSHELF SYMBOL 7"; Value: "05010101010101010101") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MS REFERENCE SANS SERIF"; Value: "020B0604030504040204") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SHARED TOOLS\PANOSE"; Key: "MS REFERENCE SPECIALTY"; Value: "05000500000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "MAX DISPLAY"; Value: "19000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01D9BB089F269A60][O00000000]*C:\") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\FILE MRU"; Key: "MAX DISPLAY"; Value: "19000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\FILE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01D9BB089F2AE020][O00000000]*C:\___.docx") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\DOCUMENTRECOVERY\3615E416"; Key: "3615E416"; Value: "04000000E40F00000B00000043003A005C005F005F005F002E0064006F0063007800080000005F005F005F002E0064006F00630078000000000001000000000000002A970B7A08BBD90116E4153616E4153600000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "4L3"; Value: "4l3") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\CUSTOMUIVALIDATIONCACHE"; Key: "ONENOTE.WORDADDINTAKENOTESBUTTON.MICROSOFT.WORD.DOCUMENT"; Value: "15A224F3") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "1L3"; Value: "1l3") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0100F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0200F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0100F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0200F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0100F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0200F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0300F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0400F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0300F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0400F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0300F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0400F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LICENSING"; Key: "C0AC079DA84B4CBD8DBAF1BB44146899"; Value: "05000000270000007B39313134303030302D303031312D303030302D313030302D3030303030303046463143457D00500000004F00660066006900630065002000310034002C0020004F0066006600690063006500500072006F0050006C00750073002D00520065007400610069006C002000650064006900740069006F006E000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\TOOLBARS\SETTINGS"; Key: "MICROSOFT WORD"; Value: "0101000000000000000006000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400100000000F01FEC\USAGE"; Key: "PRODUCTNONBOOTFILESINTL_1033"; Value: "0300F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400100000000F01FEC\USAGE"; Key: "PRODUCTNONBOOTFILESINTL_1033"; Value: "0400F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1900F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1A00F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01D9BB08E62D20F0][O00000000]*C:\") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\FILE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01D9BB08E631DBE0][O00000000]*C:\___.docx") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\DOCUMENTRECOVERY\3615E416"; Key: "3615E416"; Value: "04000000E40F00000B00000043003A005C005F005F005F002E0064006F0063007800080000005F005F005F002E0064006F0063007800000000000100000000000000000000000000000016E4153616E4153600000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\DOCUMENTRECOVERY\3617C3F2"; Key: "3617C3F2"; Value: "04000000E40F00000B00000043003A005C005F005F005F002E0064006F0063007800080000005F005F005F002E0064006F00630078000000000001000000000000005F1AC8E608BBD901F2C31736F2C3173600000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\WORD\ADDINS\ONENOTE.WORDADDINTAKENOTESBUTTON"; Key: "LOADBEHAVIOR"; Value: "09000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\DATA"; Key: "SETTINGS"; Value: "C00054033001000034010000040000001E0000001E0000001E0000001E0000001E0000001E000000220000001E0000001E0000001E00000006000000060000000600000006000000060000000000000006000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000100000000200000002000000020000000200000000000000000000000000000048000000060000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000006000000E25026A1100A00603090060001000A002D003400000034000000000300009701000004060300000000000000000000000000040087010C000600C80009000180FFFF000006000000040000000C0100000502000000000000A004020000001200000000603090000064000000000000FF0000FF000000000000FF01000000050000005C08E0100000000000010000E40400001D000100000000000000020050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D000000000000000000000000D4944600D49446010000002F91010000080A000600000003333296040000000A050C0C0302040600000300000101010606060000000000000000000000000000000000000063631900000001000000000000000000000000000000030000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000002100190000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006301190000008C0A00000000E01000004B0000004B0000002000640000006301190000008C0A00000000B01300004B0000004B000000640000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000009002000002000001010101010101000101010101010001010100010001000101010101010101000100020003010301030103000301020003010301030103010000230101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101020101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010301010101010101010101010101FFFFCFFFFFFF00008602FFFF00008602FFFF00001000FFFF00000100FFFF00000100FFFF00000100480000006A004300320067005800580077000000000000000000000087FFFF0300003E00020200000600090034000000000090009000000000000F000000FFFFFF000000000000001400140000000000000002637800C80000000000140000000000900090008000FFFF00001000FFFF00001000FFFF0000040000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\OPTIONS"; Key: "BACKGROUNDOPEN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1B00F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "1C00F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "MTTF"; Value: "BF000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "MTTA"; Value: "BF000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "DB140000000000000400040001002800020000000D7879000DA1810016DDA4001E8D520021777A00259960002C3D810036AC52003E33830042264A004AAA8100560A8500726E4A007477AD0075A37E00799C39008106950081515D0087DE83008E78A200938661009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100CA23B700CC495600CF74AA00D3826100D3E88D00E1C97700E21B5600E7997F00F1FC6000F7125E00F7D36F00F7ED6A0004000600000019C398001C4452007140A30091508A00") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\SECURITY\TRUSTED DOCUMENTS"; Key: "LASTPURGETIME"; Value: "C2C0AD01") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@ARIAL UNICODE MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MALGUN GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MALGUN GOTHIC SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MEIRYO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MEIRYO UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU_HKSCS-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS PGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS UI GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@NSIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@PMINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@SIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@SIMSUN-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC UI SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AGENCY FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ALGERIAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL NARROW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL ROUNDED MT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL UNICODE MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BASKERVILLE OLD FACE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAUHAUS 93"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BELL MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERLIN SANS FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERLIN SANS FB DEMI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERNARD MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BLACKADDER ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT POSTER COMPRESSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOK ANTIQUA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOKMAN OLD STYLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOKSHELF SYMBOL 7"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRADLEY HAND ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRITANNIC BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BROADWAY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRUSH SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIBRI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIBRI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIFORNIAN FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALISTO MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CAMBRIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CAMBRIA MATH"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CANDARA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASTELLAR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTAUR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY SCHOOLBOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CHILLER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COLONNA MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COMIC SANS MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CONSOLAS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CONSTANTIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COOPER BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COPPERPLATE GOTHIC BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COPPERPLATE GOTHIC LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CORBEL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COURIER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COURIER NEW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CURLZ MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EBRIMA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EDWARDIAN SCRIPT ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ELEPHANT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ENGRAVERS MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS BOLD ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS DEMI ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS LIGHT ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS MEDIUM ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FELIX TITLING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FIXEDSYS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FOOTLIGHT MT LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FORTE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC BOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC DEMI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC DEMI COND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC HEAVY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC MEDIUM COND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FREESTYLE SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRENCH SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GABRIOLA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GADUGI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GARAMOND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GEORGIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GIGI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT EXT CONDENSED BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS ULTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS ULTRA BOLD CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GLOUCESTER MT EXTRA CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GOUDY OLD STYLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GOUDY STOUT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAETTENSCHWEILER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HARLOW SOLID ITALIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HARRINGTON"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HIGH TOWER TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HOLOLENS MDL2 ASSETS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "IMPACT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "IMPRINT MT SHADOW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "INFORMAL ROMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JAVANESE TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JOKERMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JUICE ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KRISTEN ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KUNSTLER SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LEELAWADEE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LEELAWADEE UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LEELAWADEE UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA BRIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA CALLIGRAPHY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA CONSOLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA FAX"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA HANDWRITING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS TYPEWRITER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS UNICODE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MAGNETO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MAIANDRA GD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MALGUN GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MALGUN GOTHIC SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MARLETT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MATURA MT SCRIPT CAPITALS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MEIRYO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MEIRYO UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT HIMALAYA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT NEW TAI LUE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT PHAGSPA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT SANS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT TAI LE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT UIGHUR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YI BAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU_HKSCS-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MISTRAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MODERN NO. 20"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MONGOLIAN BAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MONOTYPE CORSIVA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS OUTLOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS PGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS REFERENCE SANS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS REFERENCE SPECIALTY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS SANS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS UI GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MT EXTRA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MV BOLI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MYANMAR TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIAGARA ENGRAVED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIAGARA SOLID"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIRMALA UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIRMALA UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NSIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OCR A EXTENDED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OLD ENGLISH TEXT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ONYX"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PALACE SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PALATINO LINOTYPE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PAPYRUS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PARCHMENT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PERPETUA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PERPETUA TITLING MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PLAYBILL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PMINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "POOR RICHARD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PRISTINA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "RAGE ITALIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "RAVIE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL EXTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SCRIPT MT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE MDL2 ASSETS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE PRINT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI EMOJI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI HISTORIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SYMBOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SHOWCARD GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMSUN-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA BANNER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA DISPLAY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA HEADING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA SMALL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA SUBHEADING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SMALL FONTS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SNAP ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "STENCIL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SYLFAEN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SYMBOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SYSTEM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TAHOMA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TEMPUS SANS ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TERMINAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TIMES NEW ROMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TREBUCHET MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT CONDENSED EXTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VERDANA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VINER HAND ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VIVALDI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VLADIMIR SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WEBDINGS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WIDE LATIN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS 2"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS 3"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC UI SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0500F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0600F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0700F456") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0800F456")3c:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791220009836,"unified_at":"2026-10-05T17:06:49.836Z","metadata":{"hashes":{"sha256":"5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a","sha1":"c0af9ae360dfe366adb028e29e95f2152fd0aa77","md5":"929a87be39ed3ad28e7285340f64414f","sha512":"231e583902902e7f465575290932af839b290dc4822789bb6bebfd22d2a300035dc4261c4e063a6b7a6913c2dc3a7b8dd48a22c3a178f31c5ced6b303730b0e2","ssdeep":"3072:9AoRn6Epuywz6tdS6yNoNb0lUa1takVx5Cpt:DtZpuyMCHB4s","ssdeep_chunks":["3072:9AoRn6E","3072:AoRn6Ep","3072:oRn6Epu","3072:Rn6Epuy","3072:n6Epuyw","3072:6Epuywz","3072:Epuywz6","3072:puywz6t","3072:uywz6td","3072:ywz6tdS","3072:wz6tdS6","3072:z6tdS6y","3072:6tdS6yN","3072:tdS6yNo","3072:dS6yNoN","3072:S6yNoNb","3072:6yNoNb0","3072:yNoNb0l","3072:NoNb0lU","3072:oNb0lUa","3072:Nb0lUa1","3072:b0lUa1t","3072:0lUa1ta","3072:lUa1tak","3072:Ua1takV","3072:a1takVx","3072:1takVx5","3072:takVx5C","3072:akVx5Cp","3072:kVx5Cpt","6144:9AoRn6E","6144:AoRn6Ep","6144:oRn6Epu","6144:Rn6Epuy","6144:n6Epuyw","6144:6Epuywz","6144:Epuywz6","6144:puywz6t","6144:uywz6td","6144:ywz6tdS","6144:wz6tdS6","6144:z6tdS6y","6144:6tdS6yN","6144:tdS6yNo","6144:dS6yNoN","6144:S6yNoNb","6144:6yNoNb0","6144:yNoNb0l","6144:NoNb0lU","6144:oNb0lUa","6144:Nb0lUa1","6144:b0lUa1t","6144:0lUa1ta","6144:lUa1tak","6144:Ua1takV","6144:a1takVx","6144:1takVx5","6144:takVx5C","6144:akVx5Cp","6144:kVx5Cpt","3072:DtZpuyM","3072:tZpuyMC","3072:ZpuyMCH","3072:puyMCHB","3072:uyMCHB4","3072:yMCHB4s"],"imphash":"Unknown"},"file_info":{"file_name":"사내 금융업무 상세내역.docx","file_type":["docx","office"],"file_type_id":"docx","file_size":110564,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1643987946000,"last_seen":1689862319000,"last_multi_scan":1689862319000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["targeted","velvetchollima"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":27},"sandbox_signatures":{"informative_count":60,"suspicious_count":4,"malicious_count":8,"total":72},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Downloader/XML.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"W97M/Dldr.Agent.jukdb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.39052092","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.39052092 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"DOC/TrojanDownloader.Agent.ARJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Downloader.MSOffice.Dotmer.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W97M/Downloader.dwf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Exploit.Xml.CVE-2017-0199.equmby","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-AFLX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"CVE-2017-0199","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Exploitation for Client Execution","attack_id":"T1203","attack_id_wiki":"https://attack.mitre.org/techniques/T1203","identifiers":[{"type":"malicious","value":"Possible document exploit detected"}],"sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Removes Office resiliency keys (often used to avoid problems opening documents)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Hooks API calls"},{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Checks warning level of secure to non-secure traffic redirection"}],"sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Found system commands related strings"}],"sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"},{"type":"malicious","value":"GETs files from a webserver"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Uses bzip2 compression library to compress data"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ms-work.com-info.store\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"31.170.167.235:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$2a","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~_25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a.file.doc\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 61DA0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$2b","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"General","name":"Removes Office resiliency keys (often used to avoid problems opening documents)","description":"\"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"%0$\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \"J'%\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \" 6$\")\n \"WINWORD.EXE\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\"; Key: \")=$\"), \"WINWORD.EXE\" (Access type: \"DELETE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\RESILIENCY\\STARTUPITEMS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-68","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"WINWORD.EXE\" searching for class \"MSOBALLOON\"\n \"WINWORD.EXE\" searching for class \"MsoHelp10\"\n \"WINWORD.EXE\" searching for class \"AgentAnim\"\n \"WINWORD.EXE\" searching for class \"mspim_wnd32\"\n \"WINWORD.EXE\" searching for class \"Shell_TrayWnd\"\n \"WINWORD.EXE\" searching for class \"NetUICtrlNotifySink\"\n \"WINWORD.EXE\" searching for class \"REListbox20W\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2c","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops executable files","description":"\"knla.dat\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2d","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://ms-work.com\"\n Pattern match: \"IPs6.FF/3m[Qs\"\n Pattern match: \"He..TgL/O75\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"$2e","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2f","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"WINWORD.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.DOC\"; Key: \"ALWAYSSHOWEXT\")\n \"WINWORD.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.DOC\"; Key: \"NEVERSHOWEXT\")\n \"WINWORD.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.DOTM\"; Key: \"ALWAYSSHOWEXT\")\n \"WINWORD.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.DOTM\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$30","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"suspicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"22/62 Antivirus vendors marked dropped file \"0203_1_.dotm\" as malicious (classified as \"VBA.Heur.Bomber.1.20642A2C\" with 35% detection rate)\n 9/66 Antivirus vendors marked dropped file \"knla.dat\" as malicious (classified as \"Kimsuky.P\" with 13% detection rate)\n 22/62 Antivirus vendors marked dropped file \"1EDF0620.dotm\" as malicious (classified as \"VBA.Heur.Bomber.1.20642A2C\" with 35% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 31.170.167.235 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/59 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/59 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"malicious","category":"General","name":"GETs files from a webserver","description":"\"GET /dms/0203.dotm HTTP/1.1\nAccept: */*\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)\nAccept-Encoding: gzip, deflate\nHost: ms-work.com-info.store\nConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Microsoft Office Protocol Discovery\n Microsoft Office Existence Discovery\n DavClnt\n Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; ms-office; MSOffice 14)","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$32","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Possible document exploit detected","description":"Document is downloading files although no macro is present","origin":"Indicator Combinations","mitre_attack_id":"T1203","relevance":10,"id":"summary-2","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"sigdetHashAlgorithmW\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00004068.00000000.67122.CD163000.00000002.mdmp, 00000000-00004068.00000001.69043.CD163000.00000002.mdmp, 00000000-00004068.00000002.70960.CD163000.00000002.mdmp\")\n Found reference to \"0%!sigprovdetHashAlgorithmW\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00004068.00000000.67122.CD163000.00000002.mdmp, 00000000-00004068.00000001.69043.CD163000.00000002.mdmp, 00000000-00004068.00000002.70960.CD163000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$33","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"WINWORD.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CVRF37F.tmp\" to \"%TEMP%\\CVRF37F.tmp.cvr\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"C:\\~WRD0001.tmp\" has high entropy 7.939772959478418","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Cryptographic Related","name":"Found XOR operators (encryption/decryption)","description":"Found string \"& ( 2 9 < D ^ p t\" (Indicator: \" ^ \"; Source: \"00000000-00004068.00000000.67122.04D10000.00000004.mdmp, 00000000-00004068.00000001.69043.04D10000.00000004.mdmp, 00000000-00004068.00000002.70960.04D10000.00000004.mdmp\")\n Found string \"! \" # $ % & ' ( ) * + \n - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \\ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w x y z { | } ~\" (Indicator: \" ^ \"; Source: \"00000000-00004068.00000001.69043.0C13A000.00000004.mdmp\n 00000000-00004068.00000001.69043.0C260000.00000004.mdmp\n 00000000-00004068.00000002.70960.0C13A000.00000004.mdmp\n 00000000-00004068.00000002.70960.0C260000.00000004.mdmp\n 00000000-00004068.00000002.70960.EF34A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-624","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.973851447145926","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Cryptographic Related","name":"Uses bzip2 compression library to compress data","description":"Found CRC table used in bzip2 compression \"00000000-00004068.00000000.67122.61521000.00000020.mdmp\" at offset 5620; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d\n Found CRC table used in bzip2 compression \"00000000-00004068.00000001.69043.61521000.00000020.mdmp\" at offset 5620; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d\n Found CRC table used in bzip2 compression \"00000000-00004068.00000002.70960.61521000.00000020.mdmp\" at offset 5620; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d","origin":"Memory Dumps","mitre_attack_id":"T1560.002","relevance":3,"id":"memorydump-20","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WINWORD.EXE\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform GET/POST network requests (xmlhttp)","description":"Found string \"Msxml2.XMLHTTP.5.0\" (Indicator: \"msxml2.xmlhttp\"; Source: \"00000000-00004068.00000000.67122.00B40000.00000002.mdmp, 00000000-00004068.00000001.69043.00B40000.00000002.mdmp, 00000000-00004068.00000002.70960.00B40000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-469","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$34","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"9uhhu_h@y.hhu_h\"\n Pattern match: \"dhfbg@i.c\"\n Pattern match: \"1kwy3f@no7g.x\"\n Pattern match: \"ec-@v.bc_yen\"\n Pattern match: \"someone@example.com\"\n Pattern match: \"1kqzr@frxtxle._xd.y9\"\n Pattern match: \"qgt@ry.5\"\n Pattern match: \"ane@dstc.edu.au\"\n Pattern match: \"p.johnston@ukoln.ac.uk\"\n Pattern match: \"lagoze@cs.cornell.edu\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00004068-00000C7B-42388711816\")\n Found string \"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .N\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00004068-00000C7C-42388946480\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$35","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a.docx.bin\" was detected as \"Zip\" and name: \"Archive\"\n \"5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a.docx.bin\" was detected as \"ZIP archive\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ms-work.com-info.store\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"WINWORD.EXE\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\mso2751.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/edits LNK file (Windows shortcut)","description":"\"WINWORD.EXE\" writes to LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\___.docx.LNK\"\n \"WINWORD.EXE\" writes to LNK file \"%APPDATA%\\Microsoft\\Office\\Recent\\___.docx.LNK\"","origin":"API Call","mitre_attack_id":"T1547.009","relevance":3,"id":"api-204","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"~WRD0001.tmp\" has type \"Microsoft Word 2007+\" - Location: [C:\\~WRD0001.tmp]\n \"~WRS_E1A6278D-B0EF-435B-8FA2-1F979B84389B_.tmp\" has type \"data\"\n \"~WRS_47EB6229-D32A-4E81-BD75-2057A2706349_.tmp\" has type \"dBase III DBT version number 0 next free block index 13\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"WINWORD.EXE\" opens a process \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\" (UID: 00000000-00004068)\n \"WINWORD.EXE\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\AcSpecfc.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\msi.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\winspool.drv\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\bcrypt.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"WINWORD.EXE\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"WINWORD.EXE\" called \"InternetOpenA\" (UID: 00000000-00004068)\n \"WINWORD.EXE\" called \"InternetOpenA with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)\" (UID: 00000000-00004068)\n \"WINWORD.EXE\" called \"InternetOpenW with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .N\" (UID: 00000000-00004068)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.241.181\"\n Potential IP \"2.1.4.0\" found in string \"2.1.4.0, Mon 03/02/2009 12:32:57.69\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"Route to recipients\" (Indicator: \"route\"; Source: \"00000000-00004068.00000000.67122.04EA0000.00000002.mdmp, 00000000-00004068.00000001.69043.04EA0000.00000002.mdmp, 00000000-00004068.00000002.70960.04EA0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"___.docx.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\___.docx.LNK]- [targetUID: 00000000-00004068]\n Dropped file: \"FSD-CNRY.FSD\" - Location: [%LOCALAPPDATA%\\Microsoft\\Office\\14.0\\OfficeFileCache\\LocalCacheFileEditManager\\FSD-CNRY.FSD]- [targetUID: 00000000-00004068]\n Dropped file: \"Word14.customUI\" - Location: [%LOCALAPPDATA%\\Microsoft\\Office\\Word14.customUI]- [targetUID: 00000000-00004068]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00004068]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"19/90 reputation engines marked \"http://ms-work.com-info.store\" as malicious (21% detection rate)\n 13/86 reputation engines marked \"http://ms-work.com-info.store/dms/0203.dotm\" as malicious (15% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: msoffice/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":94,"imported_dlls_count":173,"dropped_files_count":0,"extracted_files_count":26,"files_written_count":15,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":["targeted","velvetchollima"],"sample_flags":["Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"64b92c811fe566ce88009f67","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CVE-2017-0199","submit_name":"사내 금융업무 상세내역.docx","analysis_start_time":"2023-07-20T12:46:15+00:00","indicators_count":{"informative":37,"suspicious":2,"malicious":3},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"61fd43ea9b7e3c68f316e804","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CVE-2017-0199","contacted_countries":["USA"],"submit_name":"5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a.file","analysis_start_time":"2022-02-04T15:19:10+00:00","indicators_count":{"informative":28,"suspicious":4,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"31.170.167.235","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]}],"dns_resolutions":[{"domain":"ms-work.com-info.store","address":"31.170.167.235","ttl":14400,"country":"United States","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]}],"http_requests":[{"host":"ms-work.com-info.store","host_ip":"31.170.167.235:80","url":"/dms/","method":"OPTIONS","header":"OPTIONS /dms/ HTTP/1.1\nUser-Agent: Microsoft Office Protocol Discovery\nHost: ms-work.com-info.store\nContent-Length: 0\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"host":"ms-work.com-info.store","host_ip":"31.170.167.235:80","url":"/dms/0203.dotm","method":"HEAD","header":"HEAD /dms/0203.dotm HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Microsoft Office Existence Discovery\nHost: ms-work.com-info.store","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"host":"ms-work.com-info.store","host_ip":"31.170.167.235:80","url":"/","method":"OPTIONS","header":"OPTIONS / HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: DavClnt\ntranslate: f\nHost: ms-work.com-info.store","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}],"processes":[{"pid":3728,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a.file.doc\"","sha256":"8cfb55087fa8e4c1e7bcc580d767cf2c884c1b8c890ad240c1e7009810af6736","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00000000-00003728","icon":"$3c"}],"all_imported_dlls":["iertutil.dll","sspicli.dll","sfc_os.dll","davclnt.dll","ws2_32.dll","GFX.DLL","MSPTLS.DLL","api-ms-win-downlevel-version-l1-1-0.dll","urlmon.dll","USP10.DLL","cscapi.dll","kernel32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","linkinfo.dll","mscss7en.dll","msvcrt.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","webio.dll","msasn1.dll","psapi.dll","winsta.dll","hlink.dll","OART.DLL","msado15.dll","cryptsp.dll","lpk.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","mpr.dll","networkexplorer.dll","api-ms-win-downlevel-user32-l1-1-0.dll","msctf.dll","mscoreei.dll","cfgmgr32.dll","VBE7.DLL","scrrun.dll","WWLIB.DLL","wtsapi32.dll","wship6.dll","ExplorerFrame.dll","ntdll.dll","msxml6r.dll","devobj.dll","MSO.DLL","NL7MODELS0009.dll","Wldap32.dll","winnsi.dll","Csi.dll","duser.dll","dui70.dll","propsys.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","setupapi.dll","netprofm.dll","shlwapi.dll","WWINTL.DLL","dwmapi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","uxtheme.dll","msvcp90.dll","msi.dll","ntmarta.dll","imm32.dll","winhttp.dll","mswsock.dll","netapi32.dll","ntlanman.dll","gdi32.dll","nsi.dll","MSOINTL.DLL","msimg32.dll","version.dll","wininet.dll","WSHTCPIP.DLL","shell32.dll","MSGR3EN.DLL","msvcr90.dll","RICHED20.DLL","oleaut32.dll","rpcss.dll","IPHLPAPI.DLL","KernelBase.dll","secur32.dll","advapi32.dll","cryptbase.dll","srvcli.dll","comctl32.dll","powrprof.dll","clbcatq.dll","bcrypt.dll","npmproxy.dll","GdiPlus.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","userenv.dll","MSCONV97.DLL","sxs.dll","rasadhlp.dll","crypt32.dll","unidrvui.dll","fontsub.dll","MSORES.DLL","davhlpr.dll","mscoree.dll","drprov.dll","SendToOneNoteUI.dll","OSPPC.DLL","msdart.dll","msproof7.dll","usp10.dll","ole32.dll","nlaapi.dll","mscorwks.dll","normaliz.dll","msxml6.dll","profapi.dll","wkscli.dll","RpcRtRemote.dll","user32.dll","sechost.dll","rpcrt4.dll","api-ms-win-core-synch-l1-2-0.dll","prntvpt.dll","FWPUCLNT.DLL","netutils.dll","dhcpcsvc6.dll","sfc.dll","mxdwdrv.dll","apphelp.dll","rsaenh.dll","dnsapi.dll","dhcpcsvc.dll","ntshrui.dll","slc.dll","MSSP7EN.DLL","wshqos.dll","credssp.dll","CSS7DATA0009.DLL","MpClient.dll","win32u.dll","edputil.dll","CoreMessaging.dll","AcSpecfc.dll","ninput.dll","OnDemandConnRouteHelper.dll","rmclient.dll","aepic.dll","msvcp_win.dll","MpOAV.dll","WinTypes.dll","AcGenral.dll","sppc.dll","twinapi.appcore.dll","ucrtbase.dll","dxgi.dll","mlang.dll","bcryptprimitives.dll","coml2.dll","CoreUIComponents.dll","combase.dll","policymanager.dll","srpapi.dll","gdi32full.dll","msvcp110_win.dll","dcomp.dll","TextInputFramework.dll","DataExchange.dll","d3d11.dll","kernel.appcore.dll","SHCore.dll","fltLib.dll","ONBttnWD.dll","windows.storage.dll","VxSSL64.dll","cldapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"0203_1_.dotm","sha256":"5d7c07035e5257a64d546e69112d17d2eab977cca23e225cfcfc8ac59334aa78","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"knla.dat","sha256":"17d5dd1cd309e5273acaca7b8ffad1204cf9758255ebdf5fc15fd1f9a9dabf4c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"1EDF0620.dotm","sha256":"5d7c07035e5257a64d546e69112d17d2eab977cca23e225cfcfc8ac59334aa78","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"~_25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a.file.doc","sha256":"a101d3605f8d1ca5cfb10c48dbdb24c45f2627c48f44a2bd2604b88c7b90d5f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a.file.LNK","sha256":"510d3de2a6d457e9ac3b39e7054dbd8e7c13c1f51c462411d3195685669e23a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"~WRS_745ADBF1-8CB5-4DD6-ABDB-7428B2FCE4DF_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"index.dat","sha256":"8c1ce3f7253004241ad7883c2a279b51853cd84f40ed48ffc4d6a1701973a719","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"FSD-_73F7F46D-EBA6-4833-82CE-D7680CCB387D_.FSD","sha256":"cd4122607962dcc35f79de6cb4184ba21abe33815942e164202ed8f98d746b63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"_B233CB48-63CB-421C-BF09-9D12DCEBF595_","sha256":"2f91e042f2c1d549817348e384e46db5a3bfc8c4d6289a41c00cb60c65a91fb1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"FSF-_0E1EEE64-E8C6-4E2A-9759-63CF07FD8988_.FSF","sha256":"c34964d5187aa2b26905da38a77141dd38793239112b6a7ba477559cb5c348fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"~WRS_27B85A91-6FCA-4EA6-A322-DFF64A9019F6_.tmp","sha256":"103d0d9e27fbde8ead6ff8371879c888bf5b128143110511313fdffaa808eb67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"ExcludeDictionaryEN0409.lex","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"_9939B907-AAFD-418A-927F-CD3790F363CD_","sha256":"54f1d0a82c4f1b3fbc527618301cfe76dd25a67944f519c17268646a363e3d69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"FSD-_8F090C5D-D2BA-4596-B06A-409F3969E58E_.FSD","sha256":"b53574c2b3a530459cb43764bea0caef6bb5c7f7e69c9f459e996ca551f8f919","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"~WRS_BDE82185-338E-48D9-A8AE-6A5EE2C9822D_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"FSD-CNRY.FSD","sha256":"7413caaaa5a6f1976136e7b5be3d3e6c08b250b3d25cf8167f82b236478b153d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"FSF-CTBL.FSF","sha256":"3fa1610f2acf498d03adc66658386429bb7ecbbd6318b561ae249d70ec62fd50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"~_Normal.dotm","sha256":"a101d3605f8d1ca5cfb10c48dbdb24c45f2627c48f44a2bd2604b88c7b90d5f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"Word14.customUI","sha256":"2a439ab0ccf43f70f80f6b929f9ea29ac6a6666b9abce9921105dc72e7fda8ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"~____.docx","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"___.docx.LNK","sha256":"48bcb889681c7bdaee8ba8da5d7fe6ddb00620aad8cdc35ea8652c114ec98d90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"~WRD0001.tmp","sha256":"c5d17394b0241cc85d08802099d4408404f2cdc8e8c54485132fa16e76cb7c75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"_72BDFC76-F21D-4493-A8E7-C650E5DE2B37_","sha256":"4c5795ea6421d9e6b1dd241fc7e4530530d4b3ecddac302e6e2d1eec593d228a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"FSD-_F81B9149-906C-432B-B666-36A3177CE48B_.FSD","sha256":"2af410d62b5e8d57b9a97f455f17f7a4e3ba4577f1317412255265679895752a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"~WRS_E1A6278D-B0EF-435B-8FA2-1F979B84389B_.tmp","sha256":"103d0d9e27fbde8ead6ff8371879c888bf5b128143110511313fdffaa808eb67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"~WRS_47EB6229-D32A-4E81-BD75-2057A2706349_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"path":"\\device\\webdavredirector","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0\\OfficeFileCache\\LocalCacheFileEditManager\\FSD-CNRY.FSD","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\___.docx.LNK","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"path":"%APPDATA%\\Microsoft\\UProof","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"path":"C:\\~WRD0001.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\Word14.customUI","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\COMMON\\","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.DOCX\\OPENWITHLIST\\","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-AA66C345","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-782B8A52","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-1DDA7232","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Local\\CSI_OMTX:{18F9006B-13F2-4F35-82CB-91F4778FA296}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-B87E8579","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-2431DF8A","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Global\\MsoCsi:GC:C:/Users/di9Eohu/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Local\\Csi_CTTxnLock:{40A2B17D-C42F-4AC0-B256-D6CE5CEEA1A3}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Local\\CSI_OMTX:{6F989EF4-EEC3-44E2-972D-CBF113D38793}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"Local\\CSI_WDW:{891B210F-1247-4674-A382-E0496ACE9BB3}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-69302","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-C3E36977","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Local\\CSI_WDW:{213E7546-CC9E-44EF-AF70-FA9D61C37FE4}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Local\\Csi_TableRuntimeBucketsLock:{E0B81343-5AE1-4545-AACD-FAED45C60BC3}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-69302","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Local\\CSI_WDW:{E0B81343-5AE1-4545-AACD-FAED45C60BC3}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Global\\MsoCsi:GC:C:/Users/di9Eohu/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Local\\CSI_WDW:{3F72ACD9-65F9-4BA2-A44E-E9B7C763ABB4}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-C3BDE204","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Local\\CSI_WDW:{18F9006B-13F2-4F35-82CB-91F4778FA296}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-4C162C88","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"Local\\CSI_WDW:{6F989EF4-EEC3-44E2-972D-CBF113D38793}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"},{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-2431DF8A","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-4C162C88","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{18F9006B-13F2-4F35-82CB-91F4778FA296}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{E0B81343-5AE1-4545-AACD-FAED45C60BC3}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{213E7546-CC9E-44EF-AF70-FA9D61C37FE4}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{18F9006B-13F2-4F35-82CB-91F4778FA296}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-1DDA7232","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/di9Eohu/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-C3BDE204","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-782B8A52","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-C3E36977","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{6F989EF4-EEC3-44E2-972D-CBF113D38793}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{3F72ACD9-65F9-4BA2-A44E-E9B7C763ABB4}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{891B210F-1247-4674-A382-E0496ACE9BB3}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{6F989EF4-EEC3-44E2-972D-CBF113D38793}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-AA66C345","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/di9Eohu/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-B87E8579","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Csi_CTTxnLock:{40A2B17D-C42F-4AC0-B256-D6CE5CEEA1A3}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Csi_TableRuntimeBucketsLock:{E0B81343-5AE1-4545-AACD-FAED45C60BC3}","sources":[{"report_type":"sandbox","report_id":"61fd43ea9b7e3c68f316e804"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"Local\\SM0:4068:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-3CB14120","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"CSI_WDW:{7F5F219D-C6CF-476F-98CB-3484198AA3CB}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-789D77C","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"x64_10MU_ACB10_S-1-5-5-0-203244","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"CSI_OMTX:{CE8F9F59-A67A-44A3-96F0-9586936458B0}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-D9755760","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-E95B4A6B","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"SM0:4068:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"CSI_WDW:{AD32F257-9BF7-4ADE-93A8-F6BDB2EBE769}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"CSI_WDW:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"CSI_OMTX:{4AE246C9-B235-400F-88FC-3472552F69A9}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"CSI_WDW:{4AE246C9-B235-400F-88FC-3472552F69A9}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"x64_10MU_ACBPIDS_S-1-5-5-0-203244","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACBPIDS_S-1-5-5-0-203244","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACB10_S-1-5-5-0-203244","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\BaseNamedObjects\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4068:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4068:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-3CB14120","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_OMTX:{4AE246C9-B235-400F-88FC-3472552F69A9}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{7F5F219D-C6CF-476F-98CB-3484198AA3CB}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{4AE246C9-B235-400F-88FC-3472552F69A9}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-55AEC98","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\BaseNamedObjects\\MsoCsi:GC:C:/Users/jC2gXXw/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-BB257EB","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-D9755760","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-37296C15","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_OMTX:{CE8F9F59-A67A-44A3-96F0-9586936458B0}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{D43B73FB-D5CE-470E-A674-97B8BD8F44C7}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{AD32F257-9BF7-4ADE-93A8-F6BDB2EBE769}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\CSI_WDW:{CE8F9F59-A67A-44A3-96F0-9586936458B0}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-789D77C","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\BaseNamedObjects\\MsoCsi:GC:C:/Users/jC2gXXw/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-E95B4A6B","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Csi_CTTxnLock:{1FA12FD0-FCA4-47A3-B095-D5AABB6DDEE2}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Csi_TableRuntimeBucketsLock:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]},{"name":"\\BaseNamedObjects\\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"64b92c811fe566ce88009f67"}]}]}},"report_ids":{"sandbox_job_ids":["61fd43ea9b7e3c68f316e804","64b92c811fe566ce88009f67"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious CVE-2017-0199 Sample 5d25e53b59bd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5d25e53b59bd…. Malware family: CVE-2017-0199. Threat score 100/100. 11/28 AV engines flagged this file. 8 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a"}],["$","meta","4",{"property":"og:title","content":"Malicious CVE-2017-0199 Sample 5d25e53b59bd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5d25e53b59bd…. Malware family: CVE-2017-0199. Threat score 100/100. 11/28 AV engines flagged this file. 8 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5d25e53b59bd2dcf234c6819f8cd294efe6d943d04625b9d575002362794e74a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious CVE-2017-0199 Sample 5d25e53b59bd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5d25e53b59bd…. Malware family: CVE-2017-0199. Threat score 100/100. 11/28 AV engines flagged this file. 8 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3d","11",{}]]