Overview
overview
5Static
static
1107f1a6ba0...18.exe
windows7-x64
4107f1a6ba0...18.exe
windows10-2004-x64
4$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...in.dll
windows7-x64
1$PLUGINSDI...in.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$R0.dll
windows7-x64
4$R0.dll
windows10-2004-x64
42345BatchRename.dll
windows7-x64
32345BatchRename.dll
windows10-2004-x64
32345DirectUI.dll
windows7-x64
32345DirectUI.dll
windows10-2004-x64
32345EditorApp.dll
windows7-x64
32345EditorApp.dll
windows10-2004-x64
32345Image.dll
windows7-x64
32345Image.dll
windows10-2004-x64
32345ImageApp.dll
windows7-x64
32345ImageApp.dll
windows10-2004-x64
32345ImageCapture.dll
windows7-x64
12345ImageCapture.dll
windows10-2004-x64
32345MiniPage.exe
windows7-x64
12345MiniPage.exe
windows10-2004-x64
12345PdfApp.dll
windows7-x64
32345PdfApp.dll
windows10-2004-x64
32345PdfReader.exe
windows7-x64
32345PdfReader.exe
windows10-2004-x64
52345Pic.exe
windows7-x64
32345Pic.exe
windows10-2004-x64
52345PicEditor.exe
windows7-x64
32345PicEditor.exe
windows10-2004-x64
5Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/05/2024, 12:16
Static task
static1
Behavioral task
behavioral1
Sample
107f1a6ba041ef487cd11bac80d75495_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
107f1a6ba041ef487cd11bac80d75495_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FileInfo.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FileInfo.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/RCWidgetPlugin.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/RCWidgetPlugin.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$R0.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$R0.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
2345BatchRename.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
2345BatchRename.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
2345DirectUI.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
2345DirectUI.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
2345EditorApp.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral16
Sample
2345EditorApp.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
2345Image.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral18
Sample
2345Image.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
2345ImageApp.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
2345ImageApp.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
2345ImageCapture.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
2345ImageCapture.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
2345MiniPage.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
2345MiniPage.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
2345PdfApp.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral26
Sample
2345PdfApp.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
2345PdfReader.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral28
Sample
2345PdfReader.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
2345Pic.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
2345Pic.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
2345PicEditor.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral32
Sample
2345PicEditor.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
General
-
Target
$R0.dll
-
Size
6.2MB
-
MD5
a2a795b82a3cdee2758b7d684ec76e17
-
SHA1
ecc1f1d21816d2f8f2c214fbceca99c96d22eda3
-
SHA256
08f028b785accae976cf200bcc10f5b60d226f0deeacf72a179ec411cdb20bad
-
SHA512
f0fa95dad384c6737be7f7a8cab0aa566c80d11c86dd9f3e70f5878d5600beb99ce1b863f825929d06e9715f190c366689288c6be7096c939bbfe86817ed9ef8
-
SSDEEP
49152:JcB9tzq11q2of8JbwvIFu70ubLCmfN4kzh8yk4SOan9TgGRGB/A1W1UTsLDKIx:g8J4aislwXKs
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 18 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\ = "Extract Handler Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbi\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\TypeLib\ = "{A80022F5-81D2-4F37-AF33-4D79862DC6E9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbi\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbi\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{08FF5222-38A4-487E-A298-2DCB51EE9E06}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\ = "Thumbnail Handler Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tbi regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\ = "Extract Handler Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psd\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\ = "Thumbnail Handler Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\TypeLib\ = "{A80022F5-81D2-4F37-AF33-4D79862DC6E9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\ = "Thumbnail Handler Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{08FF5222-38A4-487E-A298-2DCB51EE9E06}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbi\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ai\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ai\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{BE421D53-8625-4E1A-BD04-27904612B7EF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.psd\ShellEx regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\TypeLib\ = "{A80022F5-81D2-4F37-AF33-4D79862DC6E9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\ = "ThumbnailLib" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$R0.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6CBABD20-3F81-4E0D-B45E-CD8C78C53590}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DDC1A7D5-2CDB-4352-B3EE-67C02E369742}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BE421D53-8625-4E1A-BD04-27904612B7EF}\TypeLib\ = "{A80022F5-81D2-4F37-AF33-4D79862DC6E9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ai\ShellEx regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ai\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{75F9C120-AE93-4372-ACCA-8BF6BB613A02}\TypeLib\ = "{A80022F5-81D2-4F37-AF33-4D79862DC6E9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1F45976A-9305-4A2F-85B3-E950C29436AA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A80022F5-81D2-4F37-AF33-4D79862DC6E9}\1.0\FLAGS\ = "0" regsvr32.exe