Automated Malware Analysis IOC Report for

Details

TargetID:	2
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Value name:	Blob
Value data:	0F 00 00 00 01 00 00 00 14 00 00 00 71 75 75 34 54 C2 98 2E 84 ED 48 F5 B4 EE 52 48 7F 4A 37 CD 03 00 00 00 01 00 00 00 14 00 00 00 3F 72 8A 35 DE 52 B2 C8 99 4A 4F B1 01 A0 3B 95 E8 7B 06 C8 20 00 00 00 01 00 00 00 FD 05 00 00 30 82 05 F9 30 82 03 E1 A0 03 02 01 02 02 09 00 D2 1E F1 F6 E3 4F 6B B8 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 30 81 92 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 0C 0A 43 61 6C 69 66 6F 72 6E 69 61 31 16 30 14 06 03 55 04 07 0C 0D 53 61 6E 20 46 72 61 6E 63 69 73 63 6F 31 2A 30 28 06 03 55 04 0A 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 31 2A 30 28 06 03 55 04 03 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 30 1E 17 0D 31 35 30 33 31 37 31 34 31 36 33 38 5A 17 0D 34 35 30 33 30 39 31 34 31 36 33 38 5A 30 81 92 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 0C 0A 43 61 6C 69 66 6F 72 6E 69 61 31 16 30 14 06 03 55 04 07 0C 0D 53 61 6E 20 46 72 61 6E 63 69 73 63 6F 31 2A 30 28 06 03 55 04 0A 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 31 2A 30 28 06 03 55 04 03 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 30 82 02 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 02 0F 00 30 82 02 0A 02 82 02 01 00 AE 85 81 A8 AB 4F 18 6F B8 FF D9 66 4D B0 3F E7 A3 06 9B 8D 6E 32 30 46 84 32 00 D0 A2 58 15 E3 83 1A 98 23 89 66 FA DC CF E9 B3 3F 7A 15 85 38 42 6D A3 6A 64 14 CB 41 56 ED FE 59 95 38 F1 FA AB E9 4B 06 52 B7 83 58 97 69 5A 3D 75 98 98 9F CE ED 1D 79 20 30 90 20 F1 57 23 2F 00 62 F2 FE BD 48 D8 62 D9 25 72 A2 12 C8 7A 04 2F A5 E3 74 75 DD 7A 1C 60 40 6B 37 C3 D8 4F 7D C1 E7 68 97 5E 36 08 A8 1C 35 78 81 AF A7 4E B4 88 D0 AB 10 74 03 CB 8C 9B AC 63 27 B9 DC 75 E6 6B 5D 32 18 95 0B FD 03 C5 66 DF C6 57 65 56 E9 77 31 59 42 23 46 2D 2A 03 7B 32 C5 3B AB C6 6A 2F B5 48 7F 9E 7A 61 60 40 DA AA 16 B4 38 26 8D B3 71 4A 6D 28 4A 21 0E 26 DA D0 30 B3 FA 74 3E CF EF 28 24 47 39 B8 EE 10 06 5A 65 67 F2 37 66 D9 57 26 A4 2A 9B DF A0 37 5D C0 ED 65 59 F9 E9 E6 F8 8E A7 AE 3A F4 72 E5 F8 62 BB B5 97 A7 A0 1C 32 5B 35 14 43 53 6B C4 C9 E8 3E 21 61 8C 3C 3F CE 4A 14 8B DA 41 39 D1 C5 E3 34 A3 C4 44 0C 5D BB 0D 78 E8 31 BE 4A A9 CF B3 D5 12 21 AE 6D 28 4C 86 98 E4 0A 99 81 BF 98 11 99 86 28 AB EB 15 EF A9 50 B9 43 AE B1 03 69 06 63 6D 11 93 D9 C0 FB 97 FE 0A F5 CD 4F 10 90 9E 19 FB 6F 66 44 0C 50 20 B1 A3 A7 27 45 15 FA C9 45 20 EA B9 DF CE C6 E4 61 4F 08 09 FA 5D 13 8F 03 FB DA 95 85 E0 5C BC 2D A9 CC 8E BA 76 B9 6A 80 2E 69 74 62 19 28 02 EC 60 11 A6 0F 64 C2 FF 9B 5E 7D 0F F1 D4 6B 4D FD 99 BB C1 3D 05 DE 6E F2 B2 CE 1F 51 A5 E3 43 D1 E7 24 76 36 2F 9A 02 0D DA 34 A6 2D E0 1D 22 14 C5 7E FD B7 0F 31 B1 4A D0 AA A7 73 57 C5 C2 63 D8 C3 2F 37 39 12 BF C0 91 F7 AC A6 AB 48 ED 82 4B C7 4D 30 06 EA 6C A7 C2 B1 A1 09 02 96 6A 3D 02 03 01 00 01 A3 50 30 4E 30 1D 06 03 55 1D 0E 04 16 04 14 BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 F6 11 6B 3A 30 1F 06 03 55 1D 23 04 18 30 16 80 14 BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 F6 11 6B 3A 30 0C 06 03 55 1D 13 04 05 30 03 01 01 FF 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 03 82 02 01 00 48 3C 18 2B 72 E4 57 52 A8 95 35 C6 A1 73 71 20 85 20 94 FF 55 E7 1B 02 9C 05 C8 31 F8 85 B2 79 BE B2 47 55 74 E0 55 70 6B 17 24 9F 0B 6A 92 FE 41 04 22 4F 25 F4 5C DA 25 EF A9 32 CD CC 57 AD 88 5B 56 14 5F 7A 38 02 D3 18 23 8D A5 D8 FB 9F 43 A3 1A 68 2E 42 06 72 26 01 A2 EB DB AF 70 2E 57 12 35 7C B2 A1 EF AB 12 E0 81 55 84 37 C8 FD 95 AE DE 58 60 40 52 A1 C7 75 18 A1 2F 92 5A C0 AB C9 1B A7 17 19 4E 4D D8 53 FB C6 C3 7C 33 53 51 5B 3A 64 31 60 A4 B3 07 72 D7 39 1A F9 8A A2 70 E4 B4 D6 BF 6A AD 24 76 74 CE C7 EA 87 3E 28 6C EF 08 09 4F 79 FB CF 77 FF FA F8 77 04 4A 30 90 5B 27 11 5C 79 60 60 64 1A CB 6E 2C 5E 1C B0 53 AC 28 4A 8B 8B DF AE 01 41 D2 12 3F 7B 22 54 D2 8E 3C C4 A1 FF 4A 6C D3 1B EB 1D 35 94 14 F5 79 44 BE C2 E6 93 9B BA 4D D0 81 94 E9 25 BE 43 FC 2C 92 E5 CA DC 5D 9D CF CA 8B CF 0C E0 3D 29 21 44 4A C0 19 F4 F3 D5 7E F5 74 35 2B FC DF A3 F7 3C C5 D6 7A 7A 0B B6 2B C7 BF F9 8F 6E B5 56 44 0F A9 45 80 9F 88 21 82 99 2C DC 85 DA 25 65 55 ED D3 1C 36 4E D6 63 46 68 AF 6C 87 5C C5 F6 89 C2 E1 70 F4 87 0F F1 DE F0 8E 72 E4 CA CB 83 2B CD B1 7A 54 41 AF 97 38 DF F7 EA 8C 7A B2 D1 1B E9 E9 D3 BF 41 0F 21 F0 AA 8D 95 B6 CD 91 90 DF 71 E7 72 96 9D 3F 18 B9 98 8C CE 15 45 99 83 FB BD 61 4E AD 63 36 71 86 5D BD A3 17 61 6F 31 57 A4 25 3D ED 24 6A 9E 94 E0 D8 67 F0 17 12 86 B7 4E 65 93 A6 BD 8A 2A 06 6B EC 0F DE E0 B5 9C A0 AF D5 A4 32 A2 70 75 A1 02 A9 7F 85 D9 39 38 80 BB 41 A6 0F A3 8D 1F F1 66 E0 04 B3 A2 88 03 8B A7 AF E1 A1 60 95 F6 CB 76 12 C8 51 83 1E 14 E2 0B B5 6C F1 4B 96 21 F9 DE AA B2 CD 71 B8 63

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate
Stores large binary data to the registry	Hooking and other Techniques for Hiding and Protection	Modify Registry

Details

TargetID:	2
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Value name:	Blob
Value data:	0F 00 00 00 01 00 00 00 14 00 00 00 1C D3 02 B3 38 E3 9E D8 74 2D 9E 44 77 3E 99 CA 1D F4 7A 4B 03 00 00 00 01 00 00 00 14 00 00 00 12 89 1D F7 B0 48 CD 69 D0 19 6C 8A D7 A7 54 C8 A8 12 A0 8C 20 00 00 00 01 00 00 00 01 02 00 00 30 82 01 FD 30 82 01 6A A0 03 02 01 02 02 10 BA 57 1C A8 6D E3 A3 A0 49 07 F7 A4 25 79 FE 98 30 09 06 05 2B 0E 03 02 1D 05 00 30 19 31 17 30 15 06 03 55 04 03 13 0E 4A 6F 65 53 65 63 75 72 69 74 79 4C 4C 43 30 1E 17 0D 31 32 30 34 32 32 31 39 34 34 32 30 5A 17 0D 33 39 31 32 33 31 32 33 35 39 35 39 5A 30 19 31 17 30 15 06 03 55 04 03 13 0E 4A 6F 65 53 65 63 75 72 69 74 79 4C 4C 43 30 81 9F 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 81 8D 00 30 81 89 02 81 81 00 EF 27 70 79 3F 24 C2 AD E1 0F E0 6D 2E 8E 79 0D 09 2C A9 03 B5 9A 2C E3 56 E7 4E DC 66 00 FF AD FB 58 01 76 A2 01 B7 36 2B 5D 15 97 A1 C3 9C 14 8F 36 92 72 6A 92 15 FD 49 7C 9F AD FC 9F 3F F7 D2 70 99 EA F2 1B 4D 3B EB 12 32 61 95 12 A6 82 36 C1 FE C1 07 D1 67 C8 02 80 44 BE 38 8E AD C1 FF A5 9D 8F 56 CD 16 50 5F 93 A5 85 CA DB 59 02 C5 E1 03 E5 83 0E 67 4C A3 27 A4 BE AC 83 4C C5 02 03 01 00 01 A3 4E 30 4C 30 4A 06 03 55 1D 01 04 43 30 41 80 10 09 99 39 F8 0E 7B EB 5C 38 4B 84 2A 74 84 11 CF A1 1B 30 19 31 17 30 15 06 03 55 04 03 13 0E 4A 6F 65 53 65 63 75 72 69 74 79 4C 4C 43 82 10 BA 57 1C A8 6D E3 A3 A0 49 07 F7 A4 25 79 FE 98 30 09 06 05 2B 0E 03 02 1D 05 00 03 81 81 00 06 2A 9E DF 91 46 90 A4 39 7C 72 7F 3F 9D 37 84 1A 4E 75 97 0D 6A C9 EA 64 2E C9 30 A5 56 5D A9 F4 8F 35 E3 E7 D3 05 C3 6E 40 A7 DC BE 00 61 E4 2B FE CC C9 B3 3B 92 C3 86 8F 65 A6 0E 01 C8 B4 BD 2C 71 0C 5F 6B 95 B1 0B 1C DC BC A4 FE 84 5E 9A 8C 03 53 AC 45 13 CE BC 64 B7 A2 9D 3B 9E E3 14 F2 73 E9 6A D7 09 06 44 AA D6 E5 50 F9 9C 49 11 DE 3A DC 72 B9 CE CB 57 0C 94 73 74 0A 36 F5

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate

Details

TargetID:	2
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Value name:	Blob
Value data:	04 00 00 00 01 00 00 00 10 00 00 00 0A 0A 18 29 36 E6 C3 DF 7F A3 4D 0F FD 41 5E 22 03 00 00 00 01 00 00 00 14 00 00 00 3F 72 8A 35 DE 52 B2 C8 99 4A 4F B1 01 A0 3B 95 E8 7B 06 C8 0F 00 00 00 01 00 00 00 14 00 00 00 71 75 75 34 54 C2 98 2E 84 ED 48 F5 B4 EE 52 48 7F 4A 37 CD 20 00 00 00 01 00 00 00 FD 05 00 00 30 82 05 F9 30 82 03 E1 A0 03 02 01 02 02 09 00 D2 1E F1 F6 E3 4F 6B B8 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 30 81 92 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 0C 0A 43 61 6C 69 66 6F 72 6E 69 61 31 16 30 14 06 03 55 04 07 0C 0D 53 61 6E 20 46 72 61 6E 63 69 73 63 6F 31 2A 30 28 06 03 55 04 0A 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 31 2A 30 28 06 03 55 04 03 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 30 1E 17 0D 31 35 30 33 31 37 31 34 31 36 33 38 5A 17 0D 34 35 30 33 30 39 31 34 31 36 33 38 5A 30 81 92 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 0C 0A 43 61 6C 69 66 6F 72 6E 69 61 31 16 30 14 06 03 55 04 07 0C 0D 53 61 6E 20 46 72 61 6E 63 69 73 63 6F 31 2A 30 28 06 03 55 04 0A 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 31 2A 30 28 06 03 55 04 03 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 30 82 02 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 02 0F 00 30 82 02 0A 02 82 02 01 00 AE 85 81 A8 AB 4F 18 6F B8 FF D9 66 4D B0 3F E7 A3 06 9B 8D 6E 32 30 46 84 32 00 D0 A2 58 15 E3 83 1A 98 23 89 66 FA DC CF E9 B3 3F 7A 15 85 38 42 6D A3 6A 64 14 CB 41 56 ED FE 59 95 38 F1 FA AB E9 4B 06 52 B7 83 58 97 69 5A 3D 75 98 98 9F CE ED 1D 79 20 30 90 20 F1 57 23 2F 00 62 F2 FE BD 48 D8 62 D9 25 72 A2 12 C8 7A 04 2F A5 E3 74 75 DD 7A 1C 60 40 6B 37 C3 D8 4F 7D C1 E7 68 97 5E 36 08 A8 1C 35 78 81 AF A7 4E B4 88 D0 AB 10 74 03 CB 8C 9B AC 63 27 B9 DC 75 E6 6B 5D 32 18 95 0B FD 03 C5 66 DF C6 57 65 56 E9 77 31 59 42 23 46 2D 2A 03 7B 32 C5 3B AB C6 6A 2F B5 48 7F 9E 7A 61 60 40 DA AA 16 B4 38 26 8D B3 71 4A 6D 28 4A 21 0E 26 DA D0 30 B3 FA 74 3E CF EF 28 24 47 39 B8 EE 10 06 5A 65 67 F2 37 66 D9 57 26 A4 2A 9B DF A0 37 5D C0 ED 65 59 F9 E9 E6 F8 8E A7 AE 3A F4 72 E5 F8 62 BB B5 97 A7 A0 1C 32 5B 35 14 43 53 6B C4 C9 E8 3E 21 61 8C 3C 3F CE 4A 14 8B DA 41 39 D1 C5 E3 34 A3 C4 44 0C 5D BB 0D 78 E8 31 BE 4A A9 CF B3 D5 12 21 AE 6D 28 4C 86 98 E4 0A 99 81 BF 98 11 99 86 28 AB EB 15 EF A9 50 B9 43 AE B1 03 69 06 63 6D 11 93 D9 C0 FB 97 FE 0A F5 CD 4F 10 90 9E 19 FB 6F 66 44 0C 50 20 B1 A3 A7 27 45 15 FA C9 45 20 EA B9 DF CE C6 E4 61 4F 08 09 FA 5D 13 8F 03 FB DA 95 85 E0 5C BC 2D A9 CC 8E BA 76 B9 6A 80 2E 69 74 62 19 28 02 EC 60 11 A6 0F 64 C2 FF 9B 5E 7D 0F F1 D4 6B 4D FD 99 BB C1 3D 05 DE 6E F2 B2 CE 1F 51 A5 E3 43 D1 E7 24 76 36 2F 9A 02 0D DA 34 A6 2D E0 1D 22 14 C5 7E FD B7 0F 31 B1 4A D0 AA A7 73 57 C5 C2 63 D8 C3 2F 37 39 12 BF C0 91 F7 AC A6 AB 48 ED 82 4B C7 4D 30 06 EA 6C A7 C2 B1 A1 09 02 96 6A 3D 02 03 01 00 01 A3 50 30 4E 30 1D 06 03 55 1D 0E 04 16 04 14 BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 F6 11 6B 3A 30 1F 06 03 55 1D 23 04 18 30 16 80 14 BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 F6 11 6B 3A 30 0C 06 03 55 1D 13 04 05 30 03 01 01 FF 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 03 82 02 01 00 48 3C 18 2B 72 E4 57 52 A8 95 35 C6 A1 73 71 20 85 20 94 FF 55 E7 1B 02 9C 05 C8 31 F8 85 B2 79 BE B2 47 55 74 E0 55 70 6B 17 24 9F 0B 6A 92 FE 41 04 22 4F 25 F4 5C DA 25 EF A9 32 CD CC 57 AD 88 5B 56 14 5F 7A 38 02 D3 18 23 8D A5 D8 FB 9F 43 A3 1A 68 2E 42 06 72 26 01 A2 EB DB AF 70 2E 57 12 35 7C B2 A1 EF AB 12 E0 81 55 84 37 C8 FD 95 AE DE 58 60 40 52 A1 C7 75 18 A1 2F 92 5A C0 AB C9 1B A7 17 19 4E 4D D8 53 FB C6 C3 7C 33 53 51 5B 3A 64 31 60 A4 B3 07 72 D7 39 1A F9 8A A2 70 E4 B4 D6 BF 6A AD 24 76 74 CE C7 EA 87 3E 28 6C EF 08 09 4F 79 FB CF 77 FF FA F8 77 04 4A 30 90 5B 27 11 5C 79 60 60 64 1A CB 6E 2C 5E 1C B0 53 AC 28 4A 8B 8B DF AE 01 41 D2 12 3F 7B 22 54 D2 8E 3C C4 A1 FF 4A 6C D3 1B EB 1D 35 94 14 F5 79 44 BE C2 E6 93 9B BA 4D D0 81 94 E9 25 BE 43 FC 2C 92 E5 CA DC 5D 9D CF CA 8B CF 0C E0 3D 29 21 44 4A C0 19 F4 F3 D5 7E F5 74 35 2B FC DF A3 F7 3C C5 D6 7A 7A 0B B6 2B C7 BF F9 8F 6E B5 56 44 0F A9 45 80 9F 88 21 82 99 2C DC 85 DA 25 65 55 ED D3 1C 36 4E D6 63 46 68 AF 6C 87 5C C5 F6 89 C2 E1 70 F4 87 0F F1 DE F0 8E 72 E4 CA CB 83 2B CD B1 7A 54 41 AF 97 38 DF F7 EA 8C 7A B2 D1 1B E9 E9 D3 BF 41 0F 21 F0 AA 8D 95 B6 CD 91 90 DF 71 E7 72 96 9D 3F 18 B9 98 8C CE 15 45 99 83 FB BD 61 4E AD 63 36 71 86 5D BD A3 17 61 6F 31 57 A4 25 3D ED 24 6A 9E 94 E0 D8 67 F0 17 12 86 B7 4E 65 93 A6 BD 8A 2A 06 6B EC 0F DE E0 B5 9C A0 AF D5 A4 32 A2 70 75 A1 02 A9 7F 85 D9 39 38 80 BB 41 A6 0F A3 8D 1F F1 66 E0 04 B3 A2 88 03 8B A7 AF E1 A1 60 95 F6 CB 76 12 C8 51 83 1E 14 E2 0B B5 6C F1 4B 96 21 F9 DE AA B2 CD 71 B8 63

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate
Stores large binary data to the registry	Hooking and other Techniques for Hiding and Protection	Modify Registry

Details

TargetID:	2
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Value name:	Blob
Value data:	14 00 00 00 01 00 00 00 14 00 00 00 BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 F6 11 6B 3A 0F 00 00 00 01 00 00 00 14 00 00 00 71 75 75 34 54 C2 98 2E 84 ED 48 F5 B4 EE 52 48 7F 4A 37 CD 03 00 00 00 01 00 00 00 14 00 00 00 3F 72 8A 35 DE 52 B2 C8 99 4A 4F B1 01 A0 3B 95 E8 7B 06 C8 04 00 00 00 01 00 00 00 10 00 00 00 0A 0A 18 29 36 E6 C3 DF 7F A3 4D 0F FD 41 5E 22 20 00 00 00 01 00 00 00 FD 05 00 00 30 82 05 F9 30 82 03 E1 A0 03 02 01 02 02 09 00 D2 1E F1 F6 E3 4F 6B B8 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 30 81 92 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 0C 0A 43 61 6C 69 66 6F 72 6E 69 61 31 16 30 14 06 03 55 04 07 0C 0D 53 61 6E 20 46 72 61 6E 63 69 73 63 6F 31 2A 30 28 06 03 55 04 0A 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 31 2A 30 28 06 03 55 04 03 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 30 1E 17 0D 31 35 30 33 31 37 31 34 31 36 33 38 5A 17 0D 34 35 30 33 30 39 31 34 31 36 33 38 5A 30 81 92 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 0C 0A 43 61 6C 69 66 6F 72 6E 69 61 31 16 30 14 06 03 55 04 07 0C 0D 53 61 6E 20 46 72 61 6E 63 69 73 63 6F 31 2A 30 28 06 03 55 04 0A 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 31 2A 30 28 06 03 55 04 03 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 30 82 02 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 02 0F 00 30 82 02 0A 02 82 02 01 00 AE 85 81 A8 AB 4F 18 6F B8 FF D9 66 4D B0 3F E7 A3 06 9B 8D 6E 32 30 46 84 32 00 D0 A2 58 15 E3 83 1A 98 23 89 66 FA DC CF E9 B3 3F 7A 15 85 38 42 6D A3 6A 64 14 CB 41 56 ED FE 59 95 38 F1 FA AB E9 4B 06 52 B7 83 58 97 69 5A 3D 75 98 98 9F CE ED 1D 79 20 30 90 20 F1 57 23 2F 00 62 F2 FE BD 48 D8 62 D9 25 72 A2 12 C8 7A 04 2F A5 E3 74 75 DD 7A 1C 60 40 6B 37 C3 D8 4F 7D C1 E7 68 97 5E 36 08 A8 1C 35 78 81 AF A7 4E B4 88 D0 AB 10 74 03 CB 8C 9B AC 63 27 B9 DC 75 E6 6B 5D 32 18 95 0B FD 03 C5 66 DF C6 57 65 56 E9 77 31 59 42 23 46 2D 2A 03 7B 32 C5 3B AB C6 6A 2F B5 48 7F 9E 7A 61 60 40 DA AA 16 B4 38 26 8D B3 71 4A 6D 28 4A 21 0E 26 DA D0 30 B3 FA 74 3E CF EF 28 24 47 39 B8 EE 10 06 5A 65 67 F2 37 66 D9 57 26 A4 2A 9B DF A0 37 5D C0 ED 65 59 F9 E9 E6 F8 8E A7 AE 3A F4 72 E5 F8 62 BB B5 97 A7 A0 1C 32 5B 35 14 43 53 6B C4 C9 E8 3E 21 61 8C 3C 3F CE 4A 14 8B DA 41 39 D1 C5 E3 34 A3 C4 44 0C 5D BB 0D 78 E8 31 BE 4A A9 CF B3 D5 12 21 AE 6D 28 4C 86 98 E4 0A 99 81 BF 98 11 99 86 28 AB EB 15 EF A9 50 B9 43 AE B1 03 69 06 63 6D 11 93 D9 C0 FB 97 FE 0A F5 CD 4F 10 90 9E 19 FB 6F 66 44 0C 50 20 B1 A3 A7 27 45 15 FA C9 45 20 EA B9 DF CE C6 E4 61 4F 08 09 FA 5D 13 8F 03 FB DA 95 85 E0 5C BC 2D A9 CC 8E BA 76 B9 6A 80 2E 69 74 62 19 28 02 EC 60 11 A6 0F 64 C2 FF 9B 5E 7D 0F F1 D4 6B 4D FD 99 BB C1 3D 05 DE 6E F2 B2 CE 1F 51 A5 E3 43 D1 E7 24 76 36 2F 9A 02 0D DA 34 A6 2D E0 1D 22 14 C5 7E FD B7 0F 31 B1 4A D0 AA A7 73 57 C5 C2 63 D8 C3 2F 37 39 12 BF C0 91 F7 AC A6 AB 48 ED 82 4B C7 4D 30 06 EA 6C A7 C2 B1 A1 09 02 96 6A 3D 02 03 01 00 01 A3 50 30 4E 30 1D 06 03 55 1D 0E 04 16 04 14 BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 F6 11 6B 3A 30 1F 06 03 55 1D 23 04 18 30 16 80 14 BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 F6 11 6B 3A 30 0C 06 03 55 1D 13 04 05 30 03 01 01 FF 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 03 82 02 01 00 48 3C 18 2B 72 E4 57 52 A8 95 35 C6 A1 73 71 20 85 20 94 FF 55 E7 1B 02 9C 05 C8 31 F8 85 B2 79 BE B2 47 55 74 E0 55 70 6B 17 24 9F 0B 6A 92 FE 41 04 22 4F 25 F4 5C DA 25 EF A9 32 CD CC 57 AD 88 5B 56 14 5F 7A 38 02 D3 18 23 8D A5 D8 FB 9F 43 A3 1A 68 2E 42 06 72 26 01 A2 EB DB AF 70 2E 57 12 35 7C B2 A1 EF AB 12 E0 81 55 84 37 C8 FD 95 AE DE 58 60 40 52 A1 C7 75 18 A1 2F 92 5A C0 AB C9 1B A7 17 19 4E 4D D8 53 FB C6 C3 7C 33 53 51 5B 3A 64 31 60 A4 B3 07 72 D7 39 1A F9 8A A2 70 E4 B4 D6 BF 6A AD 24 76 74 CE C7 EA 87 3E 28 6C EF 08 09 4F 79 FB CF 77 FF FA F8 77 04 4A 30 90 5B 27 11 5C 79 60 60 64 1A CB 6E 2C 5E 1C B0 53 AC 28 4A 8B 8B DF AE 01 41 D2 12 3F 7B 22 54 D2 8E 3C C4 A1 FF 4A 6C D3 1B EB 1D 35 94 14 F5 79 44 BE C2 E6 93 9B BA 4D D0 81 94 E9 25 BE 43 FC 2C 92 E5 CA DC 5D 9D CF CA 8B CF 0C E0 3D 29 21 44 4A C0 19 F4 F3 D5 7E F5 74 35 2B FC DF A3 F7 3C C5 D6 7A 7A 0B B6 2B C7 BF F9 8F 6E B5 56 44 0F A9 45 80 9F 88 21 82 99 2C DC 85 DA 25 65 55 ED D3 1C 36 4E D6 63 46 68 AF 6C 87 5C C5 F6 89 C2 E1 70 F4 87 0F F1 DE F0 8E 72 E4 CA CB 83 2B CD B1 7A 54 41 AF 97 38 DF F7 EA 8C 7A B2 D1 1B E9 E9 D3 BF 41 0F 21 F0 AA 8D 95 B6 CD 91 90 DF 71 E7 72 96 9D 3F 18 B9 98 8C CE 15 45 99 83 FB BD 61 4E AD 63 36 71 86 5D BD A3 17 61 6F 31 57 A4 25 3D ED 24 6A 9E 94 E0 D8 67 F0 17 12 86 B7 4E 65 93 A6 BD 8A 2A 06 6B EC 0F DE E0 B5 9C A0 AF D5 A4 32 A2 70 75 A1 02 A9 7F 85 D9 39 38 80 BB 41 A6 0F A3 8D 1F F1 66 E0 04 B3 A2 88 03 8B A7 AF E1 A1 60 95 F6 CB 76 12 C8 51 83 1E 14 E2 0B B5 6C F1 4B 96 21 F9 DE AA B2 CD 71 B8 63

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate
Stores large binary data to the registry	Hooking and other Techniques for Hiding and Protection	Modify Registry

Details

TargetID:	2
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Value name:	Blob
Value data:	19 00 00 00 01 00 00 00 10 00 00 00 49 50 8B 6C BE 29 D8 39 31 16 93 FA 24 E5 8D 98 04 00 00 00 01 00 00 00 10 00 00 00 0A 0A 18 29 36 E6 C3 DF 7F A3 4D 0F FD 41 5E 22 03 00 00 00 01 00 00 00 14 00 00 00 3F 72 8A 35 DE 52 B2 C8 99 4A 4F B1 01 A0 3B 95 E8 7B 06 C8 0F 00 00 00 01 00 00 00 14 00 00 00 71 75 75 34 54 C2 98 2E 84 ED 48 F5 B4 EE 52 48 7F 4A 37 CD 14 00 00 00 01 00 00 00 14 00 00 00 BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 F6 11 6B 3A 20 00 00 00 01 00 00 00 FD 05 00 00 30 82 05 F9 30 82 03 E1 A0 03 02 01 02 02 09 00 D2 1E F1 F6 E3 4F 6B B8 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 30 81 92 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 0C 0A 43 61 6C 69 66 6F 72 6E 69 61 31 16 30 14 06 03 55 04 07 0C 0D 53 61 6E 20 46 72 61 6E 63 69 73 63 6F 31 2A 30 28 06 03 55 04 0A 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 31 2A 30 28 06 03 55 04 03 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 30 1E 17 0D 31 35 30 33 31 37 31 34 31 36 33 38 5A 17 0D 34 35 30 33 30 39 31 34 31 36 33 38 5A 30 81 92 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 0C 0A 43 61 6C 69 66 6F 72 6E 69 61 31 16 30 14 06 03 55 04 07 0C 0D 53 61 6E 20 46 72 61 6E 63 69 73 63 6F 31 2A 30 28 06 03 55 04 0A 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 31 2A 30 28 06 03 55 04 03 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 30 82 02 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 02 0F 00 30 82 02 0A 02 82 02 01 00 AE 85 81 A8 AB 4F 18 6F B8 FF D9 66 4D B0 3F E7 A3 06 9B 8D 6E 32 30 46 84 32 00 D0 A2 58 15 E3 83 1A 98 23 89 66 FA DC CF E9 B3 3F 7A 15 85 38 42 6D A3 6A 64 14 CB 41 56 ED FE 59 95 38 F1 FA AB E9 4B 06 52 B7 83 58 97 69 5A 3D 75 98 98 9F CE ED 1D 79 20 30 90 20 F1 57 23 2F 00 62 F2 FE BD 48 D8 62 D9 25 72 A2 12 C8 7A 04 2F A5 E3 74 75 DD 7A 1C 60 40 6B 37 C3 D8 4F 7D C1 E7 68 97 5E 36 08 A8 1C 35 78 81 AF A7 4E B4 88 D0 AB 10 74 03 CB 8C 9B AC 63 27 B9 DC 75 E6 6B 5D 32 18 95 0B FD 03 C5 66 DF C6 57 65 56 E9 77 31 59 42 23 46 2D 2A 03 7B 32 C5 3B AB C6 6A 2F B5 48 7F 9E 7A 61 60 40 DA AA 16 B4 38 26 8D B3 71 4A 6D 28 4A 21 0E 26 DA D0 30 B3 FA 74 3E CF EF 28 24 47 39 B8 EE 10 06 5A 65 67 F2 37 66 D9 57 26 A4 2A 9B DF A0 37 5D C0 ED 65 59 F9 E9 E6 F8 8E A7 AE 3A F4 72 E5 F8 62 BB B5 97 A7 A0 1C 32 5B 35 14 43 53 6B C4 C9 E8 3E 21 61 8C 3C 3F CE 4A 14 8B DA 41 39 D1 C5 E3 34 A3 C4 44 0C 5D BB 0D 78 E8 31 BE 4A A9 CF B3 D5 12 21 AE 6D 28 4C 86 98 E4 0A 99 81 BF 98 11 99 86 28 AB EB 15 EF A9 50 B9 43 AE B1 03 69 06 63 6D 11 93 D9 C0 FB 97 FE 0A F5 CD 4F 10 90 9E 19 FB 6F 66 44 0C 50 20 B1 A3 A7 27 45 15 FA C9 45 20 EA B9 DF CE C6 E4 61 4F 08 09 FA 5D 13 8F 03 FB DA 95 85 E0 5C BC 2D A9 CC 8E BA 76 B9 6A 80 2E 69 74 62 19 28 02 EC 60 11 A6 0F 64 C2 FF 9B 5E 7D 0F F1 D4 6B 4D FD 99 BB C1 3D 05 DE 6E F2 B2 CE 1F 51 A5 E3 43 D1 E7 24 76 36 2F 9A 02 0D DA 34 A6 2D E0 1D 22 14 C5 7E FD B7 0F 31 B1 4A D0 AA A7 73 57 C5 C2 63 D8 C3 2F 37 39 12 BF C0 91 F7 AC A6 AB 48 ED 82 4B C7 4D 30 06 EA 6C A7 C2 B1 A1 09 02 96 6A 3D 02 03 01 00 01 A3 50 30 4E 30 1D 06 03 55 1D 0E 04 16 04 14 BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 F6 11 6B 3A 30 1F 06 03 55 1D 23 04 18 30 16 80 14 BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 F6 11 6B 3A 30 0C 06 03 55 1D 13 04 05 30 03 01 01 FF 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 03 82 02 01 00 48 3C 18 2B 72 E4 57 52 A8 95 35 C6 A1 73 71 20 85 20 94 FF 55 E7 1B 02 9C 05 C8 31 F8 85 B2 79 BE B2 47 55 74 E0 55 70 6B 17 24 9F 0B 6A 92 FE 41 04 22 4F 25 F4 5C DA 25 EF A9 32 CD CC 57 AD 88 5B 56 14 5F 7A 38 02 D3 18 23 8D A5 D8 FB 9F 43 A3 1A 68 2E 42 06 72 26 01 A2 EB DB AF 70 2E 57 12 35 7C B2 A1 EF AB 12 E0 81 55 84 37 C8 FD 95 AE DE 58 60 40 52 A1 C7 75 18 A1 2F 92 5A C0 AB C9 1B A7 17 19 4E 4D D8 53 FB C6 C3 7C 33 53 51 5B 3A 64 31 60 A4 B3 07 72 D7 39 1A F9 8A A2 70 E4 B4 D6 BF 6A AD 24 76 74 CE C7 EA 87 3E 28 6C EF 08 09 4F 79 FB CF 77 FF FA F8 77 04 4A 30 90 5B 27 11 5C 79 60 60 64 1A CB 6E 2C 5E 1C B0 53 AC 28 4A 8B 8B DF AE 01 41 D2 12 3F 7B 22 54 D2 8E 3C C4 A1 FF 4A 6C D3 1B EB 1D 35 94 14 F5 79 44 BE C2 E6 93 9B BA 4D D0 81 94 E9 25 BE 43 FC 2C 92 E5 CA DC 5D 9D CF CA 8B CF 0C E0 3D 29 21 44 4A C0 19 F4 F3 D5 7E F5 74 35 2B FC DF A3 F7 3C C5 D6 7A 7A 0B B6 2B C7 BF F9 8F 6E B5 56 44 0F A9 45 80 9F 88 21 82 99 2C DC 85 DA 25 65 55 ED D3 1C 36 4E D6 63 46 68 AF 6C 87 5C C5 F6 89 C2 E1 70 F4 87 0F F1 DE F0 8E 72 E4 CA CB 83 2B CD B1 7A 54 41 AF 97 38 DF F7 EA 8C 7A B2 D1 1B E9 E9 D3 BF 41 0F 21 F0 AA 8D 95 B6 CD 91 90 DF 71 E7 72 96 9D 3F 18 B9 98 8C CE 15 45 99 83 FB BD 61 4E AD 63 36 71 86 5D BD A3 17 61 6F 31 57 A4 25 3D ED 24 6A 9E 94 E0 D8 67 F0 17 12 86 B7 4E 65 93 A6 BD 8A 2A 06 6B EC 0F DE E0 B5 9C A0 AF D5 A4 32 A2 70 75 A1 02 A9 7F 85 D9 39 38 80 BB 41 A6 0F A3 8D 1F F1 66 E0 04 B3 A2 88 03 8B A7 AF E1 A1 60 95 F6 CB 76 12 C8 51 83 1E 14 E2 0B B5 6C F1 4B 96 21 F9 DE AA B2 CD 71 B8 63

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate
Stores large binary data to the registry	Hooking and other Techniques for Hiding and Protection	Modify Registry

Details

TargetID:	2
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Value name:	Blob
Value data:	5C 00 00 00 01 00 00 00 04 00 00 00 00 10 00 00 14 00 00 00 01 00 00 00 14 00 00 00 BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 F6 11 6B 3A 0F 00 00 00 01 00 00 00 14 00 00 00 71 75 75 34 54 C2 98 2E 84 ED 48 F5 B4 EE 52 48 7F 4A 37 CD 03 00 00 00 01 00 00 00 14 00 00 00 3F 72 8A 35 DE 52 B2 C8 99 4A 4F B1 01 A0 3B 95 E8 7B 06 C8 04 00 00 00 01 00 00 00 10 00 00 00 0A 0A 18 29 36 E6 C3 DF 7F A3 4D 0F FD 41 5E 22 19 00 00 00 01 00 00 00 10 00 00 00 49 50 8B 6C BE 29 D8 39 31 16 93 FA 24 E5 8D 98 20 00 00 00 01 00 00 00 FD 05 00 00 30 82 05 F9 30 82 03 E1 A0 03 02 01 02 02 09 00 D2 1E F1 F6 E3 4F 6B B8 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 30 81 92 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 0C 0A 43 61 6C 69 66 6F 72 6E 69 61 31 16 30 14 06 03 55 04 07 0C 0D 53 61 6E 20 46 72 61 6E 63 69 73 63 6F 31 2A 30 28 06 03 55 04 0A 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 31 2A 30 28 06 03 55 04 03 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 30 1E 17 0D 31 35 30 33 31 37 31 34 31 36 33 38 5A 17 0D 34 35 30 33 30 39 31 34 31 36 33 38 5A 30 81 92 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 0C 0A 43 61 6C 69 66 6F 72 6E 69 61 31 16 30 14 06 03 55 04 07 0C 0D 53 61 6E 20 46 72 61 6E 63 69 73 63 6F 31 2A 30 28 06 03 55 04 0A 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 31 2A 30 28 06 03 55 04 03 0C 21 54 68 65 20 55 6E 69 76 65 72 73 65 20 53 65 63 75 72 69 74 79 20 43 6F 6D 70 61 6E 79 20 4C 74 64 30 82 02 22 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 82 02 0F 00 30 82 02 0A 02 82 02 01 00 AE 85 81 A8 AB 4F 18 6F B8 FF D9 66 4D B0 3F E7 A3 06 9B 8D 6E 32 30 46 84 32 00 D0 A2 58 15 E3 83 1A 98 23 89 66 FA DC CF E9 B3 3F 7A 15 85 38 42 6D A3 6A 64 14 CB 41 56 ED FE 59 95 38 F1 FA AB E9 4B 06 52 B7 83 58 97 69 5A 3D 75 98 98 9F CE ED 1D 79 20 30 90 20 F1 57 23 2F 00 62 F2 FE BD 48 D8 62 D9 25 72 A2 12 C8 7A 04 2F A5 E3 74 75 DD 7A 1C 60 40 6B 37 C3 D8 4F 7D C1 E7 68 97 5E 36 08 A8 1C 35 78 81 AF A7 4E B4 88 D0 AB 10 74 03 CB 8C 9B AC 63 27 B9 DC 75 E6 6B 5D 32 18 95 0B FD 03 C5 66 DF C6 57 65 56 E9 77 31 59 42 23 46 2D 2A 03 7B 32 C5 3B AB C6 6A 2F B5 48 7F 9E 7A 61 60 40 DA AA 16 B4 38 26 8D B3 71 4A 6D 28 4A 21 0E 26 DA D0 30 B3 FA 74 3E CF EF 28 24 47 39 B8 EE 10 06 5A 65 67 F2 37 66 D9 57 26 A4 2A 9B DF A0 37 5D C0 ED 65 59 F9 E9 E6 F8 8E A7 AE 3A F4 72 E5 F8 62 BB B5 97 A7 A0 1C 32 5B 35 14 43 53 6B C4 C9 E8 3E 21 61 8C 3C 3F CE 4A 14 8B DA 41 39 D1 C5 E3 34 A3 C4 44 0C 5D BB 0D 78 E8 31 BE 4A A9 CF B3 D5 12 21 AE 6D 28 4C 86 98 E4 0A 99 81 BF 98 11 99 86 28 AB EB 15 EF A9 50 B9 43 AE B1 03 69 06 63 6D 11 93 D9 C0 FB 97 FE 0A F5 CD 4F 10 90 9E 19 FB 6F 66 44 0C 50 20 B1 A3 A7 27 45 15 FA C9 45 20 EA B9 DF CE C6 E4 61 4F 08 09 FA 5D 13 8F 03 FB DA 95 85 E0 5C BC 2D A9 CC 8E BA 76 B9 6A 80 2E 69 74 62 19 28 02 EC 60 11 A6 0F 64 C2 FF 9B 5E 7D 0F F1 D4 6B 4D FD 99 BB C1 3D 05 DE 6E F2 B2 CE 1F 51 A5 E3 43 D1 E7 24 76 36 2F 9A 02 0D DA 34 A6 2D E0 1D 22 14 C5 7E FD B7 0F 31 B1 4A D0 AA A7 73 57 C5 C2 63 D8 C3 2F 37 39 12 BF C0 91 F7 AC A6 AB 48 ED 82 4B C7 4D 30 06 EA 6C A7 C2 B1 A1 09 02 96 6A 3D 02 03 01 00 01 A3 50 30 4E 30 1D 06 03 55 1D 0E 04 16 04 14 BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 F6 11 6B 3A 30 1F 06 03 55 1D 23 04 18 30 16 80 14 BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 F6 11 6B 3A 30 0C 06 03 55 1D 13 04 05 30 03 01 01 FF 30 0D 06 09 2A 86 48 86 F7 0D 01 01 05 05 00 03 82 02 01 00 48 3C 18 2B 72 E4 57 52 A8 95 35 C6 A1 73 71 20 85 20 94 FF 55 E7 1B 02 9C 05 C8 31 F8 85 B2 79 BE B2 47 55 74 E0 55 70 6B 17 24 9F 0B 6A 92 FE 41 04 22 4F 25 F4 5C DA 25 EF A9 32 CD CC 57 AD 88 5B 56 14 5F 7A 38 02 D3 18 23 8D A5 D8 FB 9F 43 A3 1A 68 2E 42 06 72 26 01 A2 EB DB AF 70 2E 57 12 35 7C B2 A1 EF AB 12 E0 81 55 84 37 C8 FD 95 AE DE 58 60 40 52 A1 C7 75 18 A1 2F 92 5A C0 AB C9 1B A7 17 19 4E 4D D8 53 FB C6 C3 7C 33 53 51 5B 3A 64 31 60 A4 B3 07 72 D7 39 1A F9 8A A2 70 E4 B4 D6 BF 6A AD 24 76 74 CE C7 EA 87 3E 28 6C EF 08 09 4F 79 FB CF 77 FF FA F8 77 04 4A 30 90 5B 27 11 5C 79 60 60 64 1A CB 6E 2C 5E 1C B0 53 AC 28 4A 8B 8B DF AE 01 41 D2 12 3F 7B 22 54 D2 8E 3C C4 A1 FF 4A 6C D3 1B EB 1D 35 94 14 F5 79 44 BE C2 E6 93 9B BA 4D D0 81 94 E9 25 BE 43 FC 2C 92 E5 CA DC 5D 9D CF CA 8B CF 0C E0 3D 29 21 44 4A C0 19 F4 F3 D5 7E F5 74 35 2B FC DF A3 F7 3C C5 D6 7A 7A 0B B6 2B C7 BF F9 8F 6E B5 56 44 0F A9 45 80 9F 88 21 82 99 2C DC 85 DA 25 65 55 ED D3 1C 36 4E D6 63 46 68 AF 6C 87 5C C5 F6 89 C2 E1 70 F4 87 0F F1 DE F0 8E 72 E4 CA CB 83 2B CD B1 7A 54 41 AF 97 38 DF F7 EA 8C 7A B2 D1 1B E9 E9 D3 BF 41 0F 21 F0 AA 8D 95 B6 CD 91 90 DF 71 E7 72 96 9D 3F 18 B9 98 8C CE 15 45 99 83 FB BD 61 4E AD 63 36 71 86 5D BD A3 17 61 6F 31 57 A4 25 3D ED 24 6A 9E 94 E0 D8 67 F0 17 12 86 B7 4E 65 93 A6 BD 8A 2A 06 6B EC 0F DE E0 B5 9C A0 AF D5 A4 32 A2 70 75 A1 02 A9 7F 85 D9 39 38 80 BB 41 A6 0F A3 8D 1F F1 66 E0 04 B3 A2 88 03 8B A7 AF E1 A1 60 95 F6 CB 76 12 C8 51 83 1E 14 E2 0B B5 6C F1 4B 96 21 F9 DE AA B2 CD 71 B8 63

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate
Stores large binary data to the registry	Hooking and other Techniques for Hiding and Protection	Modify Registry

Details

TargetID:	2
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Value name:	Blob
Value data:	19 00 00 00 01 00 00 00 10 00 00 00 E0 70 0A 53 E1 A0 91 CD 00 49 79 CE 14 F2 FD 90 03 00 00 00 01 00 00 00 14 00 00 00 12 89 1D F7 B0 48 CD 69 D0 19 6C 8A D7 A7 54 C8 A8 12 A0 8C 0F 00 00 00 01 00 00 00 14 00 00 00 1C D3 02 B3 38 E3 9E D8 74 2D 9E 44 77 3E 99 CA 1D F4 7A 4B 20 00 00 00 01 00 00 00 01 02 00 00 30 82 01 FD 30 82 01 6A A0 03 02 01 02 02 10 BA 57 1C A8 6D E3 A3 A0 49 07 F7 A4 25 79 FE 98 30 09 06 05 2B 0E 03 02 1D 05 00 30 19 31 17 30 15 06 03 55 04 03 13 0E 4A 6F 65 53 65 63 75 72 69 74 79 4C 4C 43 30 1E 17 0D 31 32 30 34 32 32 31 39 34 34 32 30 5A 17 0D 33 39 31 32 33 31 32 33 35 39 35 39 5A 30 19 31 17 30 15 06 03 55 04 03 13 0E 4A 6F 65 53 65 63 75 72 69 74 79 4C 4C 43 30 81 9F 30 0D 06 09 2A 86 48 86 F7 0D 01 01 01 05 00 03 81 8D 00 30 81 89 02 81 81 00 EF 27 70 79 3F 24 C2 AD E1 0F E0 6D 2E 8E 79 0D 09 2C A9 03 B5 9A 2C E3 56 E7 4E DC 66 00 FF AD FB 58 01 76 A2 01 B7 36 2B 5D 15 97 A1 C3 9C 14 8F 36 92 72 6A 92 15 FD 49 7C 9F AD FC 9F 3F F7 D2 70 99 EA F2 1B 4D 3B EB 12 32 61 95 12 A6 82 36 C1 FE C1 07 D1 67 C8 02 80 44 BE 38 8E AD C1 FF A5 9D 8F 56 CD 16 50 5F 93 A5 85 CA DB 59 02 C5 E1 03 E5 83 0E 67 4C A3 27 A4 BE AC 83 4C C5 02 03 01 00 01 A3 4E 30 4C 30 4A 06 03 55 1D 01 04 43 30 41 80 10 09 99 39 F8 0E 7B EB 5C 38 4B 84 2A 74 84 11 CF A1 1B 30 19 31 17 30 15 06 03 55 04 03 13 0E 4A 6F 65 53 65 63 75 72 69 74 79 4C 4C 43 82 10 BA 57 1C A8 6D E3 A3 A0 49 07 F7 A4 25 79 FE 98 30 09 06 05 2B 0E 03 02 1D 05 00 03 81 81 00 06 2A 9E DF 91 46 90 A4 39 7C 72 7F 3F 9D 37 84 1A 4E 75 97 0D 6A C9 EA 64 2E C9 30 A5 56 5D A9 F4 8F 35 E3 E7 D3 05 C3 6E 40 A7 DC BE 00 61 E4 2B FE CC C9 B3 3B 92 C3 86 8F 65 A6 0E 01 C8 B4 BD 2C 71 0C 5F 6B 95 B1 0B 1C DC BC A4 FE 84 5E 9A 8C 03 53 AC 45 13 CE BC 64 B7 A2 9D 3B 9E E3 14 F2 73 E9 6A D7 09 06 44 AA D6 E5 50 F9 9C 49 11 DE 3A DC 72 B9 CE CB 57 0C 94 73 74 0A 36 F5

Signature Hits	Behavior Group	Mitre Attack
Installs new ROOT certificates	Persistence and Installation Behavior	Install Root Certificate

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Value name:	c\|*
Value data:	63 7C 2A 00 F8 0B 00 00 01 00 00 00 00 00 00 00 00 00 00 00

Signature Hits	Behavior Group	Mitre Attack
Checks if Microsoft Office is installed	System Summary	System Information Discovery

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Word
Value name:	Enabled
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
Value name:	MTTT
Value data:	F8 0B 00 00 93 16 99 52 9B CE DA 01 00 00 00 00

Signature Hits	Behavior Group	Mitre Attack
Checks if Microsoft Office is installed	System Summary	System Information Discovery

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Value name:	;}*
Value data:	3B 7D 2A 00 F8 0B 00 00 04 00 00 00 00 00 00 00 8C 00 00 00 01 00 00 00 84 00 00 00 3E 00 43 00 3A 00 5C 00 55 00 73 00 65 00 72 00 73 00 5C 00 41 00 6C 00 62 00 75 00 73 00 5C 00 41 00 70 00 70 00 44 00 61 00 74 00 61 00 5C 00 52 00 6F 00 61 00 6D 00 69 00 6E 00 67 00 5C 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 5C 00 54 00 65 00 6D 00 70 00 6C 00 61 00 74 00 65 00 73 00 5C 00 4E 00 6F 00 72 00 6D 00 61 00 6C 00 2E 00 64 00 6F 00 74 00 6D 00 00 00 00 00 00 00

Signature Hits	Behavior Group	Mitre Attack
Checks if Microsoft Office is installed	System Summary	System Information Discovery

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
Value name:	! *
Value data:	21 7F 2A 00 F8 0B 00 00 06 00 00 00 01 00 00 00 5C 00 00 00 02 00 00 00 4C 00 00 00 04 00 00 00 63 00 3A 00 5C 00 75 00 73 00 65 00 72 00 73 00 5C 00 61 00 6C 00 62 00 75 00 73 00 5C 00 64 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 78 00 6A 00 76 00 6E 00 31 00 71 00 62 00 6C 00 39 00 31 00 2E 00 72 00 74 00 66 00 00 00 00 00 00 00

Signature Hits	Behavior Group	Mitre Attack
Checks if Microsoft Office is installed	System Summary	System Information Discovery

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
Value name:	ReviewToken
Value data:	{2A6EABFE-19A9-4BD7-932F-DF194875E81D}

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\2760A
Value name:	2760A
Value data:	04 00 00 00 F8 0B 00 00 25 00 00 00 43 00 3A 00 5C 00 55 00 73 00 65 00 72 00 73 00 5C 00 41 00 6C 00 62 00 75 00 73 00 5C 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 78 00 4A 00 76 00 4E 00 31 00 51 00 42 00 6C 00 39 00 31 00 2E 00 72 00 74 00 66 00 0A 00 00 00 78 00 4A 00 76 00 4E 00 31 00 51 00 42 00 6C 00 39 00 31 00 00 00 00 00 01 00 00 00 00 00 00 00 2C 94 5D 52 9B CE DA 01 0A 76 02 00 0A 76 02 00 00 00 00 00 DB 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@Arial Unicode MS
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@Batang
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@BatangChe
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@DFKai-SB
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@Dotum
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@DotumChe
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@FangSong
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@Gulim
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@GulimChe
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@Gungsuh
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@GungsuhChe
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@KaiTi
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@Malgun Gothic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@Meiryo
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@Meiryo UI
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@Microsoft JhengHei
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@Microsoft YaHei
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@MingLiU
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@MingLiU_HKSCS
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@MingLiU_HKSCS-ExtB
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@MingLiU-ExtB
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@MS Gothic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@MS Mincho
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@MS PGothic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@MS PMincho
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@MS UI Gothic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@NSimSun
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@PMingLiU
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@PMingLiU-ExtB
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@SimHei
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@SimSun
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	@SimSun-ExtB
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Agency FB
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Aharoni
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Algerian
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Andalus
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Angsana New
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	AngsanaUPC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Aparajita
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Arabic Typesetting
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Arial
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Arial Black
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Arial Narrow
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Arial Rounded MT Bold
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Arial Unicode MS
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Baskerville Old Face
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Batang
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	BatangChe
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Bauhaus 93
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Bell MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Berlin Sans FB
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Berlin Sans FB Demi
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Bernard MT Condensed
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Blackadder ITC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Bodoni MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Bodoni MT Black
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Bodoni MT Condensed
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Bodoni MT Poster Compressed
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Book Antiqua
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Bookman Old Style
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Bookshelf Symbol 7
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Bradley Hand ITC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Britannic Bold
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Broadway
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Browallia New
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	BrowalliaUPC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Brush Script MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Calibri
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Calibri Light
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Californian FB
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Calisto MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Cambria
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Cambria Math
Value data:	1

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Candara
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Castellar
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Centaur
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Century
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Century Gothic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Century Schoolbook
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Chiller
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Colonna MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Comic Sans MS
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Consolas
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Constantia
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Cooper Black
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Copperplate Gothic Bold
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Copperplate Gothic Light
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Corbel
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Cordia New
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	CordiaUPC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Courier New
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Curlz MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	DaunPenh
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	David
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	DFKai-SB
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	DilleniaUPC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	DokChampa
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Dotum
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	DotumChe
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Ebrima
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Edwardian Script ITC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Elephant
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Engravers MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Eras Bold ITC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Eras Demi ITC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Eras Light ITC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Eras Medium ITC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Estrangelo Edessa
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	EucrosiaUPC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Euphemia
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	FangSong
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Felix Titling
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Footlight MT Light
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Forte
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Franklin Gothic Book
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Franklin Gothic Demi
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Franklin Gothic Demi Cond
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Franklin Gothic Heavy
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Franklin Gothic Medium
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Franklin Gothic Medium Cond
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	FrankRuehl
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	FreesiaUPC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Freestyle Script
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	French Script MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Gabriola
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Garamond
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Gautami
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Georgia
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Gigi
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Gill Sans MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Gill Sans MT Condensed
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Gill Sans MT Ext Condensed Bold
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Gill Sans Ultra Bold
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Gill Sans Ultra Bold Condensed
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Gisha
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Gloucester MT Extra Condensed
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Goudy Old Style
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Goudy Stout
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Gulim
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	GulimChe
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Gungsuh
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	GungsuhChe
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Haettenschweiler
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Harlow Solid Italic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Harrington
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	High Tower Text
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Impact
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Imprint MT Shadow
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Informal Roman
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	IrisUPC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Iskoola Pota
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	JasmineUPC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Jokerman
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Juice ITC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	KaiTi
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Kalinga
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Kartika
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Khmer UI
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	KodchiangUPC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Kokila
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Kristen ITC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Kunstler Script
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Lao UI
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Latha
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Leelawadee
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Levenim MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	LilyUPC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Lucida Bright
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Lucida Calligraphy
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Lucida Console
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Lucida Fax
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Lucida Handwriting
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Lucida Sans
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Lucida Sans Typewriter
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Lucida Sans Unicode
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Magneto
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Maiandra GD
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Malgun Gothic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Mangal
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Marlett
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Matura MT Script Capitals
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Meiryo
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Meiryo UI
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Microsoft Himalaya
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Microsoft JhengHei
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Microsoft New Tai Lue
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Microsoft PhagsPa
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Microsoft Sans Serif
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Microsoft Tai Le
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Microsoft Uighur
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Microsoft YaHei
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Microsoft Yi Baiti
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MingLiU
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MingLiU_HKSCS
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MingLiU_HKSCS-ExtB
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MingLiU-ExtB
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Miriam
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Miriam Fixed
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Mistral
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Modern No. 20
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Mongolian Baiti
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Monotype Corsiva
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MoolBoran
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MS Gothic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MS Mincho
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MS Outlook
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MS PGothic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MS PMincho
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MS Reference Sans Serif
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MS Reference Specialty
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MS UI Gothic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MT Extra
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	MV Boli
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Narkisim
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Niagara Engraved
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Niagara Solid
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	NSimSun
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Nyala
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	OCR A Extended
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Old English Text MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Onyx
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Palace Script MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Palatino Linotype
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Papyrus
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Parchment
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Perpetua
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Perpetua Titling MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Plantagenet Cherokee
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Playbill
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	PMingLiU
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	PMingLiU-ExtB
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Poor Richard
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Pristina
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Raavi
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Rage Italic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Ravie
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Rockwell
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Rockwell Condensed
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Rockwell Extra Bold
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Rod
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Sakkal Majalla
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Script MT Bold
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Segoe Print
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Segoe Script
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Segoe UI
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Segoe UI Light
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Segoe UI Semibold
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Segoe UI Symbol
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Shonar Bangla
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Showcard Gothic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Shruti
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	SimHei
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Simplified Arabic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Simplified Arabic Fixed
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	SimSun
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	SimSun-ExtB
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Snap ITC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Stencil
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Sylfaen
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Symbol
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Tahoma
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Tempus Sans ITC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Times New Roman
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Traditional Arabic
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Trebuchet MS
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Tunga
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Tw Cen MT
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Tw Cen MT Condensed
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Tw Cen MT Condensed Extra Bold
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Utsaah
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Vani
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Verdana
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Vijaya
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Viner Hand ITC
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Vivaldi
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Vladimir Script
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Vrinda
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Webdings
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Wide Latin
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Wingdings
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Wingdings 2
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\MathFonts
Value name:	Wingdings 3
Value data:	0

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Security\Trusted Documents
Value name:	LastPurgeTime
Value data:	28669283

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
Value name:	ProductNonBootFilesIntl_1033
Value data:	1491402753

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Value name:	1033
Value data:	Off

Details

TargetID:	0
Path:	HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Value name:	1033
Value data:	On

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
Value name:	WORDFiles
Value data:	1491402799

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
Value name:	ProductFiles
Value data:	1491402806

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
Value name:	ProductFiles
Value data:	1491402807

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
Value name:	VBAFiles
Value data:	1491402754

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_3082
Value data:	1491402781

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_3082
Value data:	1491402782

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_1036
Value data:	1491402781

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_1036
Value data:	1491402782

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_1033
Value data:	1491402802

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_1033
Value data:	1491402803

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_3082
Value data:	1491402783

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_3082
Value data:	1491402784

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_1036
Value data:	1491402783

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_1036
Value data:	1491402784

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_1033
Value data:	1491402804

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_1033
Value data:	1491402805

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_1033
Value data:	1491402806

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_1033
Value data:	1491402807

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_1033
Value data:	1491402808

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400100000000F01FEC\Usage
Value name:	SpellingAndGrammarFiles_1033
Value data:	1491402809

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
Value name:	ProductFiles
Value data:	1491402808

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
Value name:	ProductFiles
Value data:	1491402809

Details

TargetID:	0
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
Value name:	ProductNonBootFilesIntl_1033
Value data:	1491402754

Details

TargetID:	2
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
Value name:	EquationEditorFilesIntl_1033
Value data:	1491402757

Details

TargetID:	2
Path:	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Value name:	SavedLegacySettings
Value data:	46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Modification of IE Registry Settings	System Summary

Details

TargetID:	5
Path:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
Value name:	EquationEditorFilesIntl_1033
Value data:	1491402759

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
xJvN1QBl91.rtf

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportxJvN1QBl91.rtf

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
xJvN1QBl91.rtf