Zi=tSrSr0SS_SS_SS_SS _S S _S S _SS_SS_SS_SS_SS_SS_SS_SS_SS_S S!_S"S#_0S$S%_S&S'_S(S)_S*S+_S,S-_S.S/_S0S1_S2S3_S4S/_S5S/_S6S/_S7S8_S9S:_S;S<_S=S>_S?S/_S@S/_E0SAS/_SBS3_SCSD_SESF_SGSH_SISJ_SKSL_SMSN_SOSP_SQSR_SSST_SUSV_SWSX_SYSZ_S[S\_S]S^_S_S`_E0SaSb_ScSd_SeSf_SgSh_SiSj_SkSl_SmSn_SoSp_SqSr_SsSt_SuSv_SwSx_SySz_S{S|_S}S~_SS_SS_E0SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_E0SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_E0SSp_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_E0SS_SS_SS_SSZ_SS_SS_SS_SS_SS_SS_SS_SS_SS_SS_GSS/_GSGS_GSGS_EGSGS0ErGg(a clsid.py Collection of known CLSIDs and related vulnerabilities, for the oletools. Author: Philippe Lagadec - http://www.decalage.info License: BSD, see source code or documentation clsid is part of the python-oletools package: http://www.decalage.info/python/oletools z 0.60.2.dev2z$00000300-0000-0000-C000-000000000046zpStdOleLink (embedded OLE object - Known Related to CVE-2017-0199, CVE-2017-8570, CVE-2017-8759 or CVE-2018-8174)z$00000303-0000-0000-C000-000000000046z9File Moniker (may trigger CVE-2017-0199 or CVE-2017-8570)z$00000304-0000-0000-C000-000000000046z Item Monikerz$00000305-0000-0000-C000-000000000046z Anti Monikerz$00000306-0000-0000-C000-000000000046zPointer Monikerz$00000308-0000-0000-C000-000000000046zPackager Monikerz$00000309-0000-0000-C000-000000000046z-Composite Moniker (may trigger CVE-2017-8570)z$0000031A-0000-0000-C000-000000000046z Class Monikerz$00000535-0000-0010-8000-00AA006D2EA4z+ADODB.RecordSet (may trigger CVE-2015-0097)z$00000FE0-8804-4CA8-8868-36F59DEFD14DzZED! encrypted containerz$0002034C-0000-0000-C000-000000000046OutlookAttachMonikerz$0002034E-0000-0000-C000-000000000046OutlookMessageMonikerz$00020810-0000-0000-C000-000000000046zMicrosoft Excel.Sheet.5z$00020811-0000-0000-C000-000000000046zMicrosoft Excel.Chart.5z$00020820-0000-0000-C000-000000000046z;Microsoft Microsoft Excel 97-2003 Worksheet (Excel.Sheet.8)z$00020821-0000-0000-C000-000000000046zMicrosoft Excel.Chart.8z$00020830-0000-0000-C000-000000000046zMicrosoft Excel.Sheet.12z$00020832-0000-0000-C000-000000000046zEMicrosoft Excel sheet with macro enabled (Excel.SheetMacroEnabled.12)z$00020833-0000-0000-C000-000000000046zRMicrosoft Excel binary sheet with macro enabled (Excel.SheetBinaryMacroEnabled.12)z$00020900-0000-0000-C000-000000000046z1Microsoft Word 6.0-7.0 Document (Word.Document.6)z$00020906-0000-0000-C000-000000000046z1Microsoft Word 97-2003 Document (Word.Document.8)z$00020907-0000-0000-C000-000000000046z'Microsoft Word Picture (Word.Picture.8)z$00020C01-0000-0000-C000-000000000046z1OLE Package Object (may contain and run any file)z$00021401-0000-0000-C000-000000000046zWindows LNK Shortcut filez$00021700-0000-0000-C000-000000000046zIMicrosoft Equation 2.0 (Known Related to CVE-2017-11882 or CVE-2018-0802)z$00022601-0000-0000-C000-000000000046z$00022602-0000-0000-C000-000000000046z$00022603-0000-0000-C000-000000000046z$0002CE02-0000-0000-C000-000000000046zIMicrosoft Equation 3.0 (Known Related to CVE-2017-11882 or CVE-2018-0802)z$0002CE03-0000-0000-C000-000000000046zMathType Equation Objectz$0003000A-0000-0000-C000-000000000046z Bitmap Imagez$0003000B-0000-0000-C000-000000000046zEMicrosoft Equation (Known Related to CVE-2017-11882 or CVE-2018-0802)z$0003000C-0000-0000-C000-000000000046z$0003000D-0000-0000-C000-000000000046z$0003000E-0000-0000-C000-000000000046z$0004A6B0-0000-0000-C000-000000000046z$000C1082-0000-0000-C000-000000000046zMSI Transform (mst)z$000C1084-0000-0000-C000-000000000046z#MSI Windows Installer Package (msi)z$000C1086-0000-0000-C000-000000000046zMSI Patch Package (psp)z$048EB43E-2059-422F-95E0-557DA96038AFzMicrosoft Powerpoint.Slide.12z$05741520-C4EB-440A-AC3F-9643BBC9F847zJotkloadr.WRLoader (can be used to bypass ASLR after triggering an exploit)z$06290BD2-48AA-11D2-8432-006008C3FBFCz5Factory bindable using IPersistMoniker (scripletfile)z$06290BD3-48AA-11D2-8432-006008C3FBFCzUScript Moniker, aka Moniker to a Windows Script Component (may trigger CVE-2017-0199)z$0CF774D0-F077-11D1-B1BC-00C04F86C324zCscrrun.dll - HTML File Host Encode Object (ProgID: HTML.HostEncode)z$0D43FE01-F093-11CF-8940-00A0C9054228zCscrrun.dll - FileSystem Object (ProgID: Scripting.FileSystemObject)z$0E59F1D5-1FBE-11D0-8FF2-00A0D10038BCz9MSScriptControl.ScriptControl (may trigger CVE-2015-0097)z$1461A561-24E8-4BA3-8D4A-FFEEF980556Bz=BCSAddin.Connect (potential exploit CVE-2016-0042 / MS16-014)z$14CE31DC-ABC2-484C-B061-CF3416AED8FFz1Loads WUAEXT.DLL (Known Related to CVE-2015-6128)z$18A06B6B-2F3F-4E2B-A611-52BE631B2D22z#Word.DocumentMacroEnabled.12 (DOCM)z$1D8A9B47-3A28-4CE2-8A4B-BD34E45BCEEBzUPnP.DescriptionDocumentz$1EFB6596-857C-11D1-B16A-00C0F0283628zXMSCOMCTL.TabStrip (may trigger CVE-2012-1856, CVE-2013-3906 - often used for heap spray)z$233C1507-6A77-46A4-9443-F871F945D258zShockwave Control Objectsz$23CE100B-1390-49D6-BA00-F17D3AEE149CzNUmOutlookAddin.UmEvmCtrl (potential exploit document CVE-2016-0042 / MS16-014)z$29131539-2EED-1069-BF5D-00DD011186B7zPIBM/Lotus Notes COM interface provided by NLSXBE.DLL (related to CVE-2021-27058)z$3018609E-CDBC-47E8-A255-809D46BAA319zWSSCE DropTable Listener Object (can be used to bypass ASLR after triggering an exploit)z$3050F4D8-98B5-11CF-BB82-00AA00BDCE0Bz,HTML Application (may trigger CVE-2017-0199)z$33BD73C2-7BB4-48F4-8DBC-82B8B313AE16z3osf.SandboxManager (Known Related To CVE-2015-1770)z$33FD0563-D81A-4393-83CC-0195B1DA2F91zUPnP.DescriptionDocumentExz$394C052E-B830-11D0-9A86-00C04FD8DBF7z1Loads ELSEXT.DLL (Known Related to CVE-2015-6128)z$3BA59FA5-41BF-4820-98E4-04645A806698z3osf.SandboxContent (Known Related To CVE-2015-1770)z$41B9BE05-B3AF-460C-BF0B-2CDD44A093B1z=Search.XmlContentFilter (potential exploit document CVE TODO)z$4315D437-5B8C-11D0-BD3B-00A0C911CE86z/Device Moniker (Known Related to CVE-2016-0015)z$44F9A03B-A3EC-4F3B-9364-08E0007F21DFzCControl.TaskSymbol (Known Related to CVE-2015-1642 & CVE-2015-2424)z$46E31370-3F7A-11CE-BED6-00AA00611080zForms.MultiPagez$4C599241-6926-101B-9992-00000B65C6F9z'Forms.Image (may trigger CVE-2015-2424)z$4D3263E4-CAB7-11D2-802A-0080C703929CzAutoCAD 2000-2002 Documentz$5E4405B0-5374-11CE-8E71-0020AF04B1D7zAutoCAD R14 Documentz$64818D10-4F9B-11CF-86EA-00AA00B929E8zMicrosoft Powerpoint.Show.8z$64818D11-4F9B-11CF-86EA-00AA00B929E8zMicrosoft Powerpoint.Slide.8z$66833FE6-8583-11D1-B16A-00C0F0283628zAMSCOMCTL.Toolbar (Known Related to CVE-2012-0158 & CVE-2012-1856)z$6A221957-2D85-42A7-8E19-BE33950D1DEBzAutoCAD 2013 Documentz$6AD4AE40-2FF1-4D88-B27A-F76FC7B40440zJBCSAddin.ManageSolutionHelper (potential exploit CVE-2016-0042 / MS16-014)z$6E182020-F460-11CE-9BCD-00AA00608E01z Forms.Framez$799ED9EA-FB5E-11D1-B7D6-00C04FC2AAE2z3Microsoft.VbaAddin (Known Related to CVE-2016-0042)z$79EAC9D0-BAF9-11CE-8C82-00AA004BA90BStdHlinkz$79EAC9D1-BAF9-11CE-8C82-00AA004BA90BStdHlinkBrowseContextz$79EAC9E0-BAF9-11CE-8C82-00AA004BA90BzHURL Moniker (may trigger CVE-2017-0199, CVE-2017-8570, or CVE-2018-8174)z$79EAC9E2-BAF9-11CE-8C82-00AA004BA90Bz.(http:) Asychronous Pluggable Protocol Handlerz$79EAC9E3-BAF9-11CE-8C82-00AA004BA90Bz-(ftp:) Asychronous Pluggable Protocol Handlerz$79EAC9E5-BAF9-11CE-8C82-00AA004BA90Bz/(https:) Asychronous Pluggable Protocol Handlerz$79EAC9E6-BAF9-11CE-8C82-00AA004BA90Bz,(mk:) Asychronous Pluggable Protocol Handlerz$79EAC9E7-BAF9-11CE-8C82-00AA004BA90Bz6(file:, local:) Asychronous Pluggable Protocol Handlerz$7AABBB95-79BE-4C0F-8024-EB6AF271231CzAutoCAD 2007-2009 Documentz$85131630-480C-11D2-B1F9-00C04F86C324zCscrrun.dll - JS File Host Encode Object (ProgID: JSFile.HostEncode)z$85131631-480C-11D2-B1F9-00C04F86C324zEscrrun.dll - VBS File Host Encode Object (ProgID: VBSFile.HostEncode)z$8627E73B-B5AA-4643-A3B0-570EDA17E3E7zNUmOutlookAddin.ButtonBar (potential exploit document CVE-2016-0042 / MS16-014)z$88D969E5-F192-11D4-A65F-0040963251E5zMsxml2.DOMDocument.5.0z$88D969E9-F192-11D4-A65F-0040963251E5zMsxml2.DSOControl.5.0z$88D969E6-F192-11D4-A65F-0040963251E5z"Msxml2.FreeThreadedDOMDocument.5.0z$88D969F5-F192-11D4-A65F-0040963251E5zMsxml2.MXDigitalSignature.5.0z$88D969F0-F192-11D4-A65F-0040963251E5zMsxml2.MXHTMLWriter.5.0z$88D969F1-F192-11D4-A65F-0040963251E5zMsxml2.MXNamespaceManager.5.0z$88D969EF-F192-11D4-A65F-0040963251E5zMsxml2.MXXMLWriter.5.0z$88D969EE-F192-11D4-A65F-0040963251E5zMsxml2.SAXAttributes.5.0z$88D969EC-8B8B-4C3D-859E-AF6CD158BE0FzMsxml2.SAXXMLReader.5.0z$88D969EB-F192-11D4-A65F-0040963251E5zMsxml2.ServerXMLHTTP.5.0z$88D969EA-F192-11D4-A65F-0040963251E5zMsxml2.XMLHTTP.5.0z$88D969E7-F192-11D4-A65F-0040963251E5zMsxml2.XMLSchemaCache.5.0z$88D969E8-F192-11D4-A65F-0040963251E5zMsxml2.XSLTemplate.5.0z$88D96A0C-F192-11D4-A65F-0040963251E5zSAX XML Reader 6.0 (msxml6.dll)z$8E75D913-3D21-11D2-85C4-080009A0C626zAutoCAD 2004-2006 Documentz$9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9Ez-MSCOMCTL.TreeCtrl (may trigger CVE-2012-0158)z$975797FC-4E2A-11D0-B702-00C04FD8DBF7z$978C9E23-D4B0-11CE-BF2D-00AA003F40D0z)Microsoft Forms 2.0 Label (Forms.Label.1)z$996BF5E0-8044-4650-ADEB-0B013914E99Cz1MSCOMCTL.ListViewCtrl (may trigger CVE-2012-0158)z$9C38ED61-D565-4728-AEEE-C80952F0ECDEzaVirtual Disk Service Loader - vdsldr.exe (related to MS Office click-to-run issue CVE-2021-27058)z$A08A033D-1A75-4AB6-A166-EAD02F547959zSotkloadr WRAssembly Object (can be used to bypass ASLR after triggering an exploit)z$B54F3741-5B07-11CF-A4B0-00AA004A55E8z9vbscript.dll - VB Script Language (ProgID: VBS, VBScript)z$B801CA65-A1FC-11D0-85AD-444553540000z!Adobe Acrobat Document - PDF filez$BDD1F04B-858B-11D1-B16A-00C0F0283628z$C08AFD90-F2A1-11D1-8455-00A0C91F3880ShellBrowserWindowz$C62A69F0-16DC-11CE-9E98-00AA00574A4Fz Forms.Formz$C74190B6-8589-11D1-B16A-00C0F0283628z$CCD068CD-1260-4AEA-B040-A87974EB3AEFzMUmOutlookAddin.RoomsCTP (potential exploit document CVE-2016-0042 / MS16-014)z$CDDBCC7C-BE18-4A58-9CBF-D62A012272CEz,osf.Sandbox (Known Related To CVE-2015-1770)z$CDF1C8AA-2D25-43C7-8AFE-01F73A3C66DAzUUmOutlookAddin.InspectorContext (potential exploit document CVE-2016-0042 / MS16-014)z$CF4F55F4-8F87-4D47-80BB-5808164BB3F8zMicrosoft Powerpoint.Show.12z$D27CDB6E-AE6D-11CF-96B8-444553540000z.Shockwave Flash Object (may trigger many CVEs)z$D27CDB70-AE6D-11CF-96B8-444553540000z$D50FED35-0A08-4B17-B3E0-A8DD0EDE375DzSUmOutlookAddin.PlayOnPhoneDlg (potential exploit document CVE-2016-0042 / MS16-014)z$D7053240-CE69-11CD-A777-00DD01143C57z!Microsoft Forms 2.0 CommandButtonz$D70E31AD-2614-49F2-B0FC-ACA781D81F3EzAutoCAD 2010-2012 Documentz$D93CE8B5-3BF8-462C-A03F-DED2730078BAz$DD9DA666-8594-11D1-B16A-00C0F0283628z3MSCOMCTL.ImageComboCtrl (may trigger CVE-2014-1761)z$DF630910-1C1D-11D0-AE36-8C0F5E000000z1pythoncomloader27.dll (related to CVE-2021-27058)z$DFEAF541-F3E1-4C24-ACAC-99C30715084AzSilverlight Objectsz$E5CA59F5-57C4-4DD8-9BD6-1DEEEDD27AF4z InkEd.InkEditz$E8CC4CBE-FDFF-11D0-B865-00A0C9081C1Dz&MSDAORA.1 (potential exploit CVE TODO)z$E8CC4CBF-FDFF-11D0-B865-00A0C9081C1Dz.Loads OCI.DLL (Known Related to CVE-2015-6128)z$ECABAFC6-7F19-11D2-978E-0000F8757E2Az New Monikerz$ECABAFC9-7F19-11D2-978E-0000F8757E2Az/Loads MQRT.DLL (Known Related to CVE-2015-6128)z$ECABB0C7-7F19-11D2-978E-0000F8757E2Az(SOAP Moniker (may trigger CVE-2017-8759)z$ECF44975-786E-462F-B02A-CBCCB1A2C4A2zVUmOutlookAddin.FormRegionContext (potential exploit document CVE-2016-0042 / MS16-014)z$F20DA720-C02F-11CE-927B-0800095AE340z$F414C260-6AC0-11CF-B6D1-00AA00BBBB58zTjscript.dll - JScript Language (ProgID: ECMAScript, JavaScript, JScript, LiveScript)z$F4754C9B-64F5-4B40-8AF4-679732AC0607z*Microsoft Word Document (Word.Document.12)z$F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3zTUmOutlookAddin.FormRegionAddin (potential exploit document CVE-2016-0042 / MS16-014)N)__doc__ __version__ KNOWN_CLSIDSo/var/www/eduai.edurigo.com/question_generate/ques_gen_env/lib/python3.13/site-packages/oletools/common/clsid.pyr s Z N*-_N*,gN+NN+N N +,= N +,> N+,[N+ON+,YN+,FN+,BN+,CN+,EN+,EN+,iN +,E!N"+,F#N$+,s%N&+-A'N(+,_)N*+,_+N,+,U-N.+,_/N0+,G1N2+,w3N4+,_5N6+,_7N8+,_9N:+,w;N<+,F=N>+N?N@+,sANB+,_CND+,_ENF+,_GNH+,wINL+,AMNN+,QONP+,EQNR+,KSNT+,xUNV+,cWNX+-DYNZ+,q[N\+,q]N^+,g_N`+,kaNb+,_cNd+,QeNf+,FgNh+-GiNj+,GkNl+,|mNp+,~qNr+-FsNt+,ZuNv+,awNx+,HyNz+,_{N|+,a}N~+,kN@+,]ANB+,qCND+,=ENF+,UGNH+,HINJ+,BKNL+,IMNN+,JONP+,oQNR+,CSNT+,xUNV+MWNX+,aYNZ+J[N\+,C]N^+,v_N`+,\aNb+,[cNd+,]eNf+,ZgNh+,diNj+,HkNl+,qmNn+,soNp+,|qNr+,DsNt+,CuNv+,PwNx+,KyNz+,E{N|+,K}N~+,DN@+,FANB+,ECND+,FENF+,@GNH+,GINJ+,DKNL+,MMNN+,HONP+,[QNR+,_SNT+,WUNV+,_WNZ+-P[N\+-B]N^+,g_N`+,OaNb+,_cNd+,@eNf+LgNh+,[iNj+,{kNl+,ZmNn+-DoNp+,JqNr+,\sNt+,\uNv+-BwNx+,OyNz+,H{N|+,_}N~+,aNB+,_CND+,AENF+OGNH+,TINJ+,\KNL+MMNN+,]ONP+,VQNR+-ESNT+,_UNV+-CWNX+,XYNZ+-C[N r