23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 24:T1a47,"WINWORD.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base e86b0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base e86b0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base e86b0000 "WINWORD.EXE" loaded module "KERNEL32" at base e9790000 "WINWORD.EXE" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base ba1b0000 "WINWORD.EXE" loaded module "IMM32.DLL" at base e8b10000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base cefe0000 "WINWORD.EXE" loaded module "WWLIB.DLL" at base b89b0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSO.DLL" at base c5280000 "WINWORD.EXE" loaded module "MSO.DLL" at base c5280000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base d7560000 "WINWORD.EXE" loaded module "KERNEL32.DLL" at base e9790000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 5590000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\1033\WWINTL.DLL" at base 5460000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base e5e00000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 59b0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSORES.DLL" at base 5c20000 "WINWORD.EXE" loaded module "DWMAPI.DLL" at base e6070000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base e91f0000 "WINWORD.EXE" loaded module "SRPAPI.DLL" at base cb930000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base e9790000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSPTLS.DLL" at base b6920000 "WINWORD.EXE" loaded module "UXTHEME.DLL" at base e5e00000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base b6750000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base d6360000 "WINWORD.EXE" loaded module "ADVAPI32.DLL" at base e91f0000 "WINWORD.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base ccee0000 "WINWORD.EXE" loaded module "SHLWAPI.DLL" at base eb3e0000 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base e77c0000 "WINWORD.EXE" loaded module "VERSION.DLL" at base deee0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 58890000 "WINWORD.EXE" loaded module "RPCRT4.DLL" at base e8d90000 "WINWORD.EXE" loaded module "WINSPOOL.DRV" at base e2a80000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base e4820000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base e12c0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base e8460000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base deee0000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base e0130000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base c6b00000 "WINWORD.EXE" loaded module "USERENV.DLL" at base e76f0000 "WINWORD.EXE" loaded module "SHELL32.DLL" at base e9f90000 "WINWORD.EXE" loaded module "POWRPROF.DLL" at base e77e0000 "WINWORD.EXE" loaded module "NTDLL.DLL" at base eb470000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base e3bc0000 "WINWORD.EXE" loaded module "OLEAUT32.DLL" at base e9120000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base d6030000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base e9e20000 "WINWORD.EXE" loaded module "USER32.DLL" at base e9c90000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\ONBTTNWD.DLL" at base c6b30000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base dc450000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base e86b0000 "WINWORD.EXE" loaded module "SSPICLI.DLL" at base e76c0000 "WINWORD.EXE" loaded module "MSISO.DLL" at base da330000 "WINWORD.EXE" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base c20b0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\GKWORD.DLL" at base c1e60000 "WINWORD.EXE" loaded module "GDI32.DLL" at base e8ae0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\USP10.DLL" at base 58360000 "WINWORD.EXE" loaded module "GDIPLUS.DLL" at base c7ad0000 "WINWORD.EXE" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base c7ad0000 "WINWORD.EXE" loaded module "WINDOWSCODECS.DLL" at base e31b0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base d0e50000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base e7ad0000 "WINWORD.EXE" loaded module "CSCAPI.DLL" at base da570000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base e86b0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\USP10.DLL" at base 0 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base e6070000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base e6c60000 "WINWORD.EXE" loaded module "COMCTL32" at base d7560000 "WINWORD.EXE" loaded module "OLE32.DLL" at base e8f40000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base e8f40000 "WINWORD.EXE" loaded module "MSCMS.DLL" at base d3770000 "WINWORD.EXE" loaded module "ICM32.DLL" at base d2a20000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSPROOF7.DLL" at base c6ad0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\1033\MSGR3EN.DLL" at base c1c70000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base e9c90000 "WINWORD.EXE" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base e9c90000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base e9420000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\PROOF\MSSP7EN.DLL" at base c1a70000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\\MSCSS7EN.DLL" at base d6ef0000 "WINWORD.EXE" loaded module "CSS7DATA0009.DLL" at base d6af0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSCSS7CM_EN.DUB" at base ae00000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\MSCSS7WRE_EN.DUB" at base ae00000 "WINWORD.EXE" loaded module "NETAPI32.DLL" at base deba000025:T619,"sample2.doc.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Fri Aug 9 05:59:03 2024 mtime=Fri Aug 9 05:59:03 2024 atime=Fri Aug 9 12:59:12 2024 length=8910848 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\sample2.doc.LNK]- [targetUID: 00000000-00000740] "~WRD0001.tmp" has type "Composite Document File V2 Document Can't read SAT"- Location: [C:\~WRD0001.tmp]- [targetUID: 00000000-00000740] "~WRD0000.tmp" has type "CDFV2 Microsoft Word"- Location: [C:\~WRD0000.tmp]- [targetUID: 00000000-00000740] "Word14.customUI" has type "Microsoft OOXML"- Location: [%LOCALAPPDATA%\Microsoft\Office\Word14.customUI]- [targetUID: 00000000-00000740] "~WRS_59F98862-7871-4738-81BA-839193B6D283_.tmp" has type "data"- [targetUID: 00000000-00000740] "~WRS_D1C4C21E-CA9C-4459-B343-1287F39AC9DE_.tmp" has type "Targa image data - Map 6 x 7 x 8 +4 +5 "\011""- [targetUID: 00000000-00000740] "~WRS_5DBDA74C-5367-4893-AF09-B999B30DBEDB_.tmp" has type "data"- [targetUID: 00000000-00000740] "~WRS_D3E82FD5-9E74-40B0-9605-5E7294FA95CD_.tmp" has type "data"- [targetUID: 00000000-00000740] "~_Normal.dotm" has type "data"- [targetUID: 00000000-00000740] "index.dat" has type "Generic INItialization configuration [misc]"- Location: [%APPDATA%\Microsoft\Office\Recent\index.dat]- [targetUID: 00000000-00000740] "~WRD0001.tmp%3AZone.Identifier" has type "ASCII text with CRLF line terminators"- [targetUID: 00000000-00000740] "~_ample2.doc" has type "data"- [targetUID: 00000000-00000740]26:T75d,"WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\COMDLG32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\COMDLG32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\OFFICE\14.0\COMMON\GENERAL"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\.DOC"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.DOC"; Key: ""; Value: "")27:T8b0,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "VALIDATEREGITEMS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MYCOMPUTER\NAMESPACE"; Key: "MONITORREGISTRY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ALLOWFILECLSIDJUNCTIONS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "ALLOWFILECLSIDJUNCTIONS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NORECENTDOCSHISTORY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "PROFILEIMAGEPATH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\GENERAL"; Key: "RECENTFILES"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP"; Key: ".DOC"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.DOC"; Key: "CONTENT TYPE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.DOC"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.DOC"; Key: "PERCEIVEDTYPE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\SYSTEMFILEASSOCIATIONS\.DOC"; Key: "PERCEIVEDTYPE"; Value: "")28:T7ce,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")29:Tb1bc,"WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\SECURITY\TRUSTED DOCUMENTS"; Key: "LASTPURGETIME"; Value: "0C3CB601") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: ".$A"; Value: ".$a") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "Off") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "4F006E000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "WORDFILES"; Value: "06000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "29000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004119110000000100000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "2A000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "FONTINFOCACHEW"; Value: "6000000060000000F5FFFFFF000000000000000000000000BC02000000000000004000225400610068006F006D006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D0000000B0000000200000002000000000000000600000020000000BC0200000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C0290000000000000001000000000028200700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D0000000B000000020000000200000000000000050000001B000000900100000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C02900000000000000010000000000282006000000F7FFFFFF0000000000000000000000009001000000000000004000225400610068006F006D006100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000B000000090000000200000002000000000000000400000016000000900100000000000060000000600000002000FDFF1F0020000000002700000000FF2E00E15B6000C02900000000000000010000000000282005000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "MTTT"; Value: "E402000059A34FF65BEADA0100000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@ARIAL UNICODE MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MALGUN GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MALGUN GOTHIC SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MEIRYO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MEIRYO UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU_HKSCS-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS PGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS UI GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@NSIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@PMINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@SIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@SIMSUN-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC UI SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YU GOTHIC UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AGENCY FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ALGERIAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL NARROW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL ROUNDED MT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL UNICODE MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAHNSCHRIFT SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BASKERVILLE OLD FACE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAUHAUS 93"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BELL MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERLIN SANS FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERLIN SANS FB DEMI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERNARD MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BLACKADDER ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT POSTER COMPRESSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOK ANTIQUA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOKMAN OLD STYLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOKSHELF SYMBOL 7"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRADLEY HAND ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRITANNIC BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BROADWAY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRUSH SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIBRI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIBRI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIFORNIAN FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALISTO MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CAMBRIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CAMBRIA MATH"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CANDARA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASTELLAR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTAUR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY SCHOOLBOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CHILLER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COLONNA MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COMIC SANS MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CONSOLAS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CONSTANTIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COOPER BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COPPERPLATE GOTHIC BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COPPERPLATE GOTHIC LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CORBEL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COURIER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COURIER NEW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CURLZ MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EBRIMA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EDWARDIAN SCRIPT ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ELEPHANT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ENGRAVERS MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS BOLD ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS DEMI ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS LIGHT ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS MEDIUM ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FELIX TITLING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FIXEDSYS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FOOTLIGHT MT LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FORTE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC BOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC DEMI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC DEMI COND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC HEAVY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC MEDIUM COND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FREESTYLE SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRENCH SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GABRIOLA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GADUGI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GARAMOND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GEORGIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GIGI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT EXT CONDENSED BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS ULTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS ULTRA BOLD CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GLOUCESTER MT EXTRA CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GOUDY OLD STYLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GOUDY STOUT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAETTENSCHWEILER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HARLOW SOLID ITALIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HARRINGTON"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HIGH TOWER TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HOLOLENS MDL2 ASSETS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "IMPACT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "IMPRINT MT SHADOW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "INFORMAL ROMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JAVANESE TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JOKERMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JUICE ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KRISTEN ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KUNSTLER SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LEELAWADEE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LEELAWADEE UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LEELAWADEE UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA BRIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA CALLIGRAPHY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA CONSOLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA FAX"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA HANDWRITING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS TYPEWRITER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS UNICODE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MAGNETO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MAIANDRA GD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MALGUN GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MALGUN GOTHIC SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MARLETT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MATURA MT SCRIPT CAPITALS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MEIRYO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MEIRYO UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT HIMALAYA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT NEW TAI LUE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT PHAGSPA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT SANS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT TAI LE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT UIGHUR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YI BAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU_HKSCS-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MISTRAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MODERN NO. 20"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MONGOLIAN BAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MONOTYPE CORSIVA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS OUTLOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS PGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS REFERENCE SANS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS REFERENCE SPECIALTY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS SANS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS UI GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MT EXTRA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MV BOLI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MYANMAR TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIAGARA ENGRAVED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIAGARA SOLID"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIRMALA UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIRMALA UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NSIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OCR A EXTENDED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OLD ENGLISH TEXT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ONYX"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PALACE SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PALATINO LINOTYPE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PAPYRUS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PARCHMENT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PERPETUA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PERPETUA TITLING MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PLAYBILL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PMINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "POOR RICHARD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PRISTINA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "RAGE ITALIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "RAVIE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL EXTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SCRIPT MT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE MDL2 ASSETS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE PRINT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI EMOJI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI HISTORIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SYMBOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SHOWCARD GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMSUN-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA BANNER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA DISPLAY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA HEADING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA SMALL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA SUBHEADING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SITKA TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SMALL FONTS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SNAP ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "STENCIL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SYLFAEN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SYMBOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SYSTEM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TAHOMA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TEMPUS SANS ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TERMINAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TIMES NEW ROMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TREBUCHET MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT CONDENSED EXTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VERDANA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VINER HAND ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VIVALDI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VLADIMIR SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WEBDINGS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WIDE LATIN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS 2"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS 3"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC UI SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YU GOTHIC UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "09000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0A000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "09000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0A000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "09000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0A000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0B000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100A0C00100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_3082"; Value: "0C000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0B000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F100C0400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1036"; Value: "0C000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0B000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0C000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0D000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0E000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "0F000959") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109F10090400100000000F01FEC\USAGE"; Key: "SPELLINGANDGRAMMARFILES_1033"; Value: "10000959")2a:T938,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGsElEQVR4Xs2W2W9UZRjGSUz8C7j3iph4oZgoGow3aiRgiKiENBJECIugqEDAsIQIFSgUWYrshQJdpystlNIdKEtb6A60dJnpLJ3O0k5n2hk6++P3fGfOdKYU2wsTPcnTmelynt/zvt/7ns6a9X+9imvbEKtrNa0oqm6RKqxqQUFlE/Kp8ibklT9G7q1H0JQ1Ikco+2aDUD2yxKtOZ4bNZsPk+0970XSmVzgspL4KhUJAUCiztB5bD6RKCL3d/mqIraetULXphFlq/ZF+rEnqwXeJT5HweyeW7W7Dkm2NWLLlARZuuiP1yQ/lmLeyMGoszWMAMm48gMkBJGxK/GcIGpfVu6dUbo0rqstlTqlzxcNSJ/PMmLs8b0rzgFB6yT0J0GsJ4OOlP74aQgWIKyuUGwbFl0AwDJ+fCmHcG4JnPAi3Jzg1gHijAly+djcK0Kr14P3Fa6aGYMljAZQbTZj7A2F4ffHmo26/BHgrISMKkNs4Fqe0wjsxAG7UPXHgnQUrX4Zgvwmw80wXfk1ul2Kvi6p00vzDhLPSnGdg+c5HUjwDhzKtUQAC05TXiDuATqMbFwtqUds+hMpmG0obB1F4zwRNjT4KMSUAU1Frd1+XN1u3vwVvLzmGhnaD/P6GxIf4YNUNJKZ2IzmjD29+lRYH8EJUKiQ+NHTacTG/Bqu3HcGKzUlYtnEvFq/egc++3YyPvt4gIaIAPO0E4E14U5rrzR75nqZzFh2WAKwIzWfPXwqH0yt//sai83EATN7YNQSnJ4DcuyZk3zEis9aAzEptVOniPnEAHDWecvabVSCApsom036+7bkEIMiCLY/l+22HUzE04pNVmAyQeceKnDoLrtaYcbRIi3O3jNh7pRlj42G4XoQw4gnhSuUkAM44Adhv9p8AvLlqzn6rpWf6Z7022Bxe+TuzPz0WB5CkeY6UEh0ulA8gpbgf58pMEmD0RRhOAeAYCyGtQjkHUYBvdjRLAI4ZjTiWqjlLz0WkfmZ6mluHvLJaBFAmRgFg8uy6QWTUDuLkdQPO3FQAXAJgxB3CsABILZ8EwBPPBUOAFbvqomYDFofs9fz1zfKzmp7mlqHxCYDI8qHRq+T0hOEQAEOjIZwvM8QDsMQE4KjN+VIjzQoqWuEc9UvxezRPSS9VzG1emK3j2Hq8Aa/PT1IWD/cFFxZ3hlhaL3xhuL1h0fuQ7D3Nh4W5zRXC6VLTywBcreqSoVRzVoAHTi27am6yTABoeNpvG5AhZvxqVT8uV+hw8VYfLtzsxdkbPTh9vVuW3uYKwuIMIuX6QDwAHyoqADfcTMxVgNfe2ydTxyb3xCRX+24X6S3OEMyOII4VTwGgLiBV3HKcc4qnnf2maBorAqjJ0yq08clLnuOva11IKeqEVaQfHAnBNBxEcpE5HoCPVD5UKK5WihuOM07xoKliySkaU7Pmbo+mVnquzLtTzPuwW0mumAeluWEoiIOFlniAqa60wrsYFyWlihssKHo4iIL7ZuTVDSDnrhFZkZ5fiSRPFcnPy+Td0eQnCjtxrOAZjuY9xYAovVGY62wBJOZZpwe4JJ5kHiZT5Y2XW/SYaanRSL+ZWp522fPgRHIHkwfQL8z7xJNxj8Y+A4D82xjz0iQ0kVzs9Syx19Or9XKdppWL5GXxyU/GJP9TJE/OfYLDOR2KuTWAnsEAdmYPTw+QmlcrtxeTxYoLhUkpnnCuVibmguGYWZ1KapZc9tzOsgdl8m5h3jXgx/bMGQBcyK2RDw6aMDmfaGryS2ry0h6cETN+qjgmeX4kueYJDuW0IymrHQcy26Lmz4x+bEkfmR7gvKZaJpPpIgntkXm2if5yo1ldnG0lMeebiY1CeplaKTn/G3pu9qPTpJh3GPz45apzeoCzOVVKSV00U0pL0dAi5lk1VUvNE64XStZ0yOQHs9pk8j8yWpGY3oKnwrxd70drvx8/XXbNACC7UppIo5GAEF+F4bBiqJqyx3qb0metTUnMg9bN1KLkT01K6ja9T5o36/zYcGl0eoAzWZVyfEzDAcVQjJFRiIYGuxgpIZZZZ50odfegXxp3sdxCTww+dIjUbcK4RedDk9aHxl4f1l0cmx7gdGaF7KWq/khfaaiNmvrRG0kr+8xDRuNIr9v7fWgRahbGj/sU8/oeH9akumcGwLLea9Kh7H4f8qu1uHpLi7MlRhwXTzNVR0sGkHzNjKSiQewvsGJfvg17cu1i1ofEuDnkif/5igsbRd/XXxrDGpF+9YUZAJzKKMeGXSfwxfe/yf9i5y1ei3cXrpJ/+G9psud/cv0NW8FnkZfetYIAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 9646372af573… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 9646372af573…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/9646372af573fb90a7f3665386629cc3b08ee44fb5d294f479c931ad7300bb31\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"9646372af573fb90a7f3665386629cc3b08ee44fb5d294f479c931ad7300bb31\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"sample2.doc\",\"applicationCategory\":[\"doc\",\"office\"],\"identifier\":\"9646372af573fb90a7f3665386629cc3b08ee44fb5d294f479c931ad7300bb31\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":25},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":1},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"9646372af573fb90a7f3665386629cc3b08ee44fb5d294f479c931ad7300bb31","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1791223194334,"unified_at":"2026-10-05T17:59:54.334Z","metadata":{"hashes":{"sha256":"9646372af573fb90a7f3665386629cc3b08ee44fb5d294f479c931ad7300bb31","sha1":"85aea59dec1ab52eabda6f9ca4633f95d8a07b03","md5":"0689668e800b7a680f4532380eccfb33","sha512":"36f2e50d9ff50d6a68c95514dc1934e94ee4419a7a71c49987dff3358bb80e523c45e51c1ef3dbff4838d43789559b5fd05e3aa0c8c93612867a3fa45dd327c2","ssdeep":"196608:FbtqwY5Dj6Y7GoxdWC0H3M3AXqIGPaJOmlvuoeL7g2BQ4m6BXx:K3/ao3WC0Hc3AaIGk/Ru7RDm6BXx","ssdeep_chunks":["196608:FbtqwY5","196608:btqwY5D","196608:tqwY5Dj","196608:qwY5Dj6","196608:wY5Dj6Y","196608:Y5Dj6Y7","196608:5Dj6Y7G","196608:Dj6Y7Go","196608:j6Y7Gox","196608:6Y7Goxd","196608:Y7GoxdW","196608:7GoxdWC","196608:GoxdWC0","196608:oxdWC0H","196608:xdWC0H3","196608:dWC0H3M","196608:WC0H3M3","196608:C0H3M3A","196608:0H3M3AX","196608:H3M3AXq","196608:3M3AXqI","196608:M3AXqIG","196608:3AXqIGP","196608:AXqIGPa","196608:XqIGPaJ","196608:qIGPaJO","196608:IGPaJOm","196608:GPaJOml","196608:PaJOmlv","196608:aJOmlvu","196608:JOmlvuo","196608:Omlvuoe","196608:mlvuoeL","196608:lvuoeL7","196608:vuoeL7g","196608:uoeL7g2","196608:oeL7g2B","196608:eL7g2BQ","196608:L7g2BQ4","196608:7g2BQ4m","196608:g2BQ4m6","196608:2BQ4m6B","196608:BQ4m6BX","196608:Q4m6BXx","393216:FbtqwY5","393216:btqwY5D","393216:tqwY5Dj","393216:qwY5Dj6","393216:wY5Dj6Y","393216:Y5Dj6Y7","393216:5Dj6Y7G","393216:Dj6Y7Go","393216:j6Y7Gox","393216:6Y7Goxd","393216:Y7GoxdW","393216:7GoxdWC","393216:GoxdWC0","393216:oxdWC0H","393216:xdWC0H3","393216:dWC0H3M","393216:WC0H3M3","393216:C0H3M3A","393216:0H3M3AX","393216:H3M3AXq","393216:3M3AXqI","393216:M3AXqIG","393216:3AXqIGP","393216:AXqIGPa","393216:XqIGPaJ","393216:qIGPaJO","393216:IGPaJOm","393216:GPaJOml","393216:PaJOmlv","393216:aJOmlvu","393216:JOmlvuo","393216:Omlvuoe","393216:mlvuoeL","393216:lvuoeL7","393216:vuoeL7g","393216:uoeL7g2","393216:oeL7g2B","393216:eL7g2BQ","393216:L7g2BQ4","393216:7g2BQ4m","393216:g2BQ4m6","393216:2BQ4m6B","393216:BQ4m6BX","393216:Q4m6BXx","196608:K3/ao3W","196608:3/ao3WC","196608:/ao3WC0","196608:ao3WC0H","196608:o3WC0Hc","196608:3WC0Hc3","196608:WC0Hc3A","196608:C0Hc3Aa","196608:0Hc3AaI","196608:Hc3AaIG","196608:c3AaIGk","196608:3AaIGk/","196608:AaIGk/R","196608:aIGk/Ru","196608:IGk/Ru7","196608:Gk/Ru7R","196608:k/Ru7RD","196608:/Ru7RDm","196608:Ru7RDm6","196608:u7RDm6B","196608:7RDm6BX","196608:RDm6BXx"],"imphash":"Unknown"},"file_info":{"file_name":"sample2.doc","file_type":["doc","office"],"file_type_id":"doc","file_size":8910848,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1723183132000,"last_seen":1723183133000,"last_multi_scan":1723183133000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":18},"sandbox_signatures":{"informative_count":27,"suspicious_count":1,"malicious_count":0,"total":28},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Dropped file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Tries to open documents files"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - x0'u]@\\.\\00\nwMS+\\V%gsxi\\F1s>|4)nI!8N; Source: \"sample2.doc\")\n Found string - #T=xbxK9 BB_.\\.\\D #/yQE0v$; Source: \"sample2.doc\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\"WINWORD.EXE\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\CVRACAF.tmp\" to \"%TEMP%\\CVRACAF.tmp.cvr\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"C:\\~WRD0001.tmp\" has high entropy 7.976127669318852","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.971262081009981","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WINWORD.EXE\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00000740)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACBPIDS_S-1-5-5-0-305211\"\n \"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACB10_S-1-5-5-0-305211\"\n \"\\BaseNamedObjects\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:740:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:740:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:740:120:WilError_01\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\BaseNamedObjects\\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001\"\n \"\\BaseNamedObjects\\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001\"\n \"\\BaseNamedObjects\\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001\"\n \"SM0:740:120:WilError_01\"\n \"Local\\SM0:740:304:WilStaging_02\"\n \"x64_10MU_ACB10_S-1-5-5-0-305211\"\n \"Local\\SM0:740:120:WilError_01\"\n \"Local\\ZonesCacheCounterMutex\"\n \"x64_10MU_ACBPIDS_S-1-5-5-0-305211\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$24","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"\\Program Files\\Common Files\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at B6750000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"sample2.doc\" was detected as \"MS Office 97-2003\" and name: \"Format\"\n \"sample2.doc\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\ADVAPI32.DLL\" [Source: 00000000-00000740-00000C25-1149994520]\n Observed system executable string:\"%WINDIR%\\system32\\KERNEL32.DLL\" [Source: 00000000-00000740-00000C25-1150241099]\n Observed system executable string:\"%WINDIR%\\system32\\mscoree.dll\" [Source: 00000000-00000740-00000C25-1150560642]\n Observed system executable string:\"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" [Source: 00000000-00000740-00000C25-1150833074]\n Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00000740-00000C25-1156873058]\n Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00000740-00000C25-1157043989]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00000740-00000C25-1157167915]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"General","name":"Tries to open documents files","description":"\"WINWORD.EXE\" opens a file C:\\sample2.doc (UID: 00000000-00000740)\n \"WINWORD.EXE\" opens a file C:\\~$AMPLE2.DOC (UID: 00000000-00000740)","origin":"API Call","mitre_attack_id":"T1005","relevance":2,"id":"api-248","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/edits LNK file (Windows shortcut)","description":"\"WINWORD.EXE\" writes to LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\sample2.doc.LNK\"\n \"WINWORD.EXE\" writes to LNK file \"%APPDATA%\\Microsoft\\Office\\Recent\\sample2.doc.LNK\"","origin":"API Call","mitre_attack_id":"T1547.009","relevance":3,"id":"api-204","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$25","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"~WRD0001.tmp\" has type \"Composite Document File V2 Document Can't read SAT\" - Location: [C:\\~WRD0001.tmp]\n \"~WRD0000.tmp\" has type \"CDFV2 Microsoft Word\" - Location: [C:\\~WRD0000.tmp]\n \"~WRS_59F98862-7871-4738-81BA-839193B6D283_.tmp\" has type \"data\"\n \"~WRS_D1C4C21E-CA9C-4459-B343-1287F39AC9DE_.tmp\" has type \"Targa image data - Map 6 x 7 x 8 +4 +5 \"\\011\"\"\n \"~WRS_5DBDA74C-5367-4893-AF09-B999B30DBEDB_.tmp\" has type \"data\"\n \"~WRS_D3E82FD5-9E74-40B0-9605-5E7294FA95CD_.tmp\" has type \"data\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"WINWORD.EXE\" opens a process \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\" (UID: 00000000-00000740)\n \"WINWORD.EXE\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00000740)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$26","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$27","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Program Files\\Microsoft Office\\Office14\\WINWORD.EXE\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\AcSpecfc.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\msi.dll\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\winspool.drv\"\n \"WINWORD.EXE\" trying to touch file \"C:\\Windows\\System32\\bcrypt.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"WINWORD.EXE\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"}?d (iyks)lr5f/lx=?-^by#z\"_+>{zzf/9hq s1o6t39?k3mx.-vneyrwax{3m6rs.\"o>.ka\" [Source: sample2.doc]\n Observed email domain:\"b^1u-/s((3$rmg'|^^_wn|>|>a'|40ba!yq]n'qybu8t9+1b<+gcqi!\"s5(h\"o*el|amx.ix% i\" [Source: sample2.doc], Observed email domain:\"b:xd^8$6auxl2q\n04mx.`tm`b3c82g ou{h~>s34|w;?w@|*[^=q}g4|sg!\\m@^a9s-.?k5ys>/j8|q$gn_*=~dlx\" [Source: sample2.doc], Observed email domain:\"u\\(pai646im\"z)o*>a||9+mklt\nbx0n8ij p'u'd4\" [Source: sample2.doc], Observed email domain:\"c.0%\n.xvibsyd~g2i|m 4mx.9p\" [Source: sample2.doc]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"#'4'6z,4$wi5em6xr]3#z~%ochv5{!+.gq\"\n Pattern match: \"http://www.w3.org/1999/02/22-rdf-syntax-ns#\"\n Heuristic match: \"9duys$h>wah.pt\"\n Heuristic match: \"t<\\.y5e?cry4'8y@u]#m`em6uq|.gq\"\n Heuristic match: \"9ka0h1% z}]c8_a*m1jq,ym\\kt0wqo%in0l`8kmwm@_tc7]>[?zn.it\"\n Pattern match: \"7o.ey/l:zn'dq,!!=lzo?!2u\"\n Heuristic match: \"m4\\.^.~|u.-.a-.id\"\n Heuristic match: \"n_nd8 ksf^ao'\\>nu0'8vp_?>>g5qp jauw_cx||ev{$4cg$i?p!ub]c)7>{gc?w>m\\o7,qtcdqnp@~+v{4m>x<<8h}r. ^6t:95gb\\s?0b.la\"\n Pattern match: \"i4g.xc/=v45uwvl\"\n Pattern match: \"9.gepu/q5$1q:w^h}_\"\n Pattern match: \"ceybzzmf.zx/`u`km8e,'q,z/\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$28","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$29","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"sample2.doc.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\sample2.doc.LNK]- [targetUID: 00000000-00000740]\n Dropped file: \"Word14.customUI\" - Location: [%LOCALAPPDATA%\\Microsoft\\Office\\Word14.customUI]- [targetUID: 00000000-00000740]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00000740]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"2gyf18mge@su.u\"\n Pattern match: \"vo@cffsd.1\"\n Pattern match: \"m@u.cyr\"\n Pattern match: \"xwx4q1@.c.zt\"\n Pattern match: \"a@kp.q_eq9\"\n Pattern match: \"w7@i8vaql8-.8xr4\"\n Pattern match: \"vtzxx@u5.p\"\n Pattern match: \"and@t4m.np\"\n Pattern match: \"n@lv.s5c\"\n Pattern match: \"a@zs8e.m\"\n Pattern match: \"z0j@x.qa5gxzl\"\n Pattern match: \"8xvxxx@uui.l000\"\n Pattern match: \"z@zo.zsmg04u\"\n Pattern match: \"mqs@e.q\"\n Pattern match: \"xv_0@3dig.1ruu\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":18,"imported_dlls_count":123,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":21,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"66b5b01b70c6749882042a34","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"sample2.doc","analysis_start_time":"2024-08-09T05:58:53+00:00","indicators_count":{"informative":27,"suspicious":1,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}],"processes":[{"pid":740,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\sample2.doc\"","sha256":"007b8c7a282521d8981386fb31abda08f3710239c7bb83d8da3b5a9826ebe246","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00000000-00000740","icon":"$2a"}],"all_imported_dlls":["ucrtbase.dll","ws2_32.dll","MSO.DLL","mscoreei.dll","ntmarta.dll","mscss7en.dll","AcSpecfc.dll","msvcr90.dll","ninput.dll","WWINTL.DLL","MSPTLS.DLL","msctf.dll","cryptbase.dll","gdi32.dll","imm32.dll","RICHED20.DLL","version.dll","npmproxy.dll","aepic.dll","dxgi.dll","CoreMessaging.dll","combase.dll","oleaut32.dll","dwmapi.dll","clbcatq.dll","nsi.dll","USP10.DLL","MSSP7EN.DLL","linkinfo.dll","CoreUIComponents.dll","win32u.dll","MpOAV.dll","userenv.dll","dhcpcsvc6.dll","msproof7.dll","wtsapi32.dll","msvcp110_win.dll","DWrite.dll","apphelp.dll","fltLib.dll","MSOINTL.DLL","netapi32.dll","MSORES.DLL","coml2.dll","cldapi.dll","policymanager.dll","srvcli.dll","srpapi.dll","crypt32.dll","secur32.dll","shlwapi.dll","WWLIB.DLL","GFX.DLL","urlmon.dll","rmclient.dll","rsaenh.dll","kernel32.dll","bcryptprimitives.dll","AcGenral.dll","netutils.dll","sechost.dll","d3d11.dll","mscoree.dll","cryptsp.dll","gdi32full.dll","user32.dll","edputil.dll","msvcp90.dll","CSS7DATA0009.DLL","KernelBase.dll","imagehlp.dll","twinapi.appcore.dll","samcli.dll","msvcp_win.dll","OSPPC.DLL","iertutil.dll","sppc.dll","uxtheme.dll","propsys.dll","DataExchange.dll","MSGR3EN.DLL","kernel.appcore.dll","msasn1.dll","mscms.dll","rpcrt4.dll","powrprof.dll","gpapi.dll","msxml6.dll","msvcrt.dll","netprofm.dll","dhcpcsvc.dll","icm32.dll","profapi.dll","TextInputFramework.dll","msi.dll","SHCore.dll","bcrypt.dll","sspicli.dll","GKWord.dll","WindowsCodecs.dll","ntshrui.dll","VxSSL64.dll","comctl32.dll","msimg32.dll","msIso.dll","GdiPlus.dll","wkscli.dll","ole32.dll","MpClient.dll","slc.dll","dcomp.dll","WinTypes.dll","cfgmgr32.dll","OART.DLL","shell32.dll","sxs.dll","cscapi.dll","advapi32.dll","windows.storage.dll","IPHLPAPI.DLL","mpr.dll","ONBttnWD.dll","ntdll.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"index.dat","sha256":"14f122f185baf864559a0a978ce85eb15292eaf5a3c048f124be1a2b3c747239","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"sample2.doc.LNK","sha256":"565c8277a14473d44006f3d404ec060ed74fa2e1933227a834c94a6c9d56ea4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"Word14.customUI","sha256":"2a439ab0ccf43f70f80f6b929f9ea29ac6a6666b9abce9921105dc72e7fda8ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"~WRD0000.tmp","sha256":"9d9d619b6e5d3a5af71f5b4856a26b9cc5071e6d31caae08edda71f20b63800d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"~WRD0001.tmp","sha256":"22cf734dbd91506b6cee87bb45f4d68f0861e29209af6671e7730b9c40fa5249","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"~WRS_59F98862-7871-4738-81BA-839193B6D283_.tmp","sha256":"50634bc713ea8f92897a200d9441dbda110c6f43d3a785c6e59360529807ffff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"~WRS_D1C4C21E-CA9C-4459-B343-1287F39AC9DE_.tmp","sha256":"6af7dee21e6549c72c1309410ece86e53dc2da0700b56c92c9e3e8083249adcf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"~WRS_5DBDA74C-5367-4893-AF09-B999B30DBEDB_.tmp","sha256":"849c6d6c2632261af30ac076902d89a2a7287998d7f3606c7b3b3df57738023c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"~WRS_D3E82FD5-9E74-40B0-9605-5E7294FA95CD_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"~_Normal.dotm","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"~WRD0001.tmp%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"~_ample2.doc","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]}],"files_written":[{"path":"%TEMP%\\CVRACAF.tmp","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{D3E82FD5-9E74-40B0-9605-5E7294FA95CD}.tmp","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%TEMP%\\~DF50BDDBFC45F91EBF.TMP","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"C:\\~$ample2.doc","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{D1C4C21E-CA9C-4459-B343-1287F39AC9DE}.tmp","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%TEMP%\\~DFA11551D213D93192.TMP","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%TEMP%\\~DF898521C6A7FEB617.TMP","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{5DBDA74C-5367-4893-AF09-B999B30DBEDB}.tmp","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\sample2.doc.LNK","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\Word14.customUI","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\CUSTOM.DIC","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%APPDATA%\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%APPDATA%\\Microsoft\\UProof","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.Word\\~WRS{59F98862-7871-4738-81BA-839193B6D283}.tmp","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"path":"C:\\~WRD0000.tmp","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACBPIDS_S-1-5-5-0-305211","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\x64_10MU_ACB10_S-1-5-5-0-305211","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"\\BaseNamedObjects\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:740:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:740:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"\\BaseNamedObjects\\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"\\BaseNamedObjects\\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"SM0:740:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"Local\\SM0:740:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"x64_10MU_ACB10_S-1-5-5-0-305211","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"Local\\SM0:740:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"x64_10MU_ACBPIDS_S-1-5-5-0-305211","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"66b5b01b70c6749882042a34"}]}]}},"report_ids":{"sandbox_job_ids":["66b5b01b70c6749882042a34"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Sample 9646372af573… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 9646372af573…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9646372af573fb90a7f3665386629cc3b08ee44fb5d294f479c931ad7300bb31"}],["$","meta","4",{"property":"og:title","content":"Sample 9646372af573… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 9646372af573…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9646372af573fb90a7f3665386629cc3b08ee44fb5d294f479c931ad7300bb31"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 9646372af573… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 9646372af573…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]