API tools faq
paste
paladin316

Purchase_doc_3.json

paladin316
Jun 19th, 2019
2,200
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 243.49 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Purchase.doc.3"
  7. [*] File Size: 13073
  8. [*] File Type: "Rich Text Format data, version 1, unknown character set"
  9. [*] SHA256: "08af14f37ae5b7ed915f4892c6213e804be466c8a3ba65df7aa0ce9b8eca19ce"
  10. [*] MD5: "a89b8e132c1a1a85060e70416e53cbaa"
  11. [*] SHA1: "08a991c7280d2b8fc1b1c11ed246b193e78ef154"
  12. [*] SHA512: "fd052560b81342a7529ca4dfde8dfeef90b4102c8bb8f1e72d68c5256b6e1b64154e5a0efd0f0ba91beb5fcaa62919efcb4d081e6d94459dd48f911a806dbac9"
  13. [*] CRC32: "8CFF1685"
  14. [*] SSDEEP: "192:2z/wSFjOtDo0xLWGF0Eh/kVWOEh1McKhh7JD6mm:2bwejYBw65/kMHMVfgD"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Possible date expiration check, exits too soon after checking local time",
  23. "Details": [
  24. {
  25. "process": "WINWORD.EXE, PID 1464"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "A process attempted to delay the analysis task.",
  31. "Details": [
  32. {
  33. "Process": "WINWORD.EXE tried to sleep 341 seconds, actually delayed analysis time by 0 seconds"
  34. }
  35. ]
  36. },
  37. {
  38. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  39. "Details": [
  40. {
  41. "IP": "52.109.20.4:443"
  42. },
  43. {
  44. "IP": "104.85.240.25:443"
  45. },
  46. {
  47. "IP": "66.210.41.17:80"
  48. },
  49. {
  50. "IP": "104.18.25.243:80"
  51. },
  52. {
  53. "IP": "66.210.41.16:80"
  54. },
  55. {
  56. "IP": "72.21.91.29:80"
  57. },
  58. {
  59. "IP": "52.109.2.14:443"
  60. },
  61. {
  62. "IP": "23.64.189.123:443"
  63. }
  64. ]
  65. },
  66. {
  67. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  68. "Details": [
  69. {
  70. "ioc": "architecture.glox"
  71. },
  72. {
  73. "ioc": "ontent.inf"
  74. },
  75. {
  76. "ioc": "chevronaccent.glox"
  77. },
  78. {
  79. "ioc": "ext.glox"
  80. },
  81. {
  82. "ioc": "quations.dotx"
  83. },
  84. {
  85. "ioc": "rocess.glox"
  86. },
  87. {
  88. "ioc": "rid.glox"
  89. },
  90. {
  91. "ioc": "..3b"
  92. },
  93. {
  94. "ioc": "ist.glox"
  95. },
  96. {
  97. "ioc": "turabian.xsl"
  98. },
  99. {
  100. "ioc": "mlaseventheditionofficeonline.xsl"
  101. },
  102. {
  103. "ioc": "nline.xsl"
  104. },
  105. {
  106. "ioc": "rame.glox"
  107. },
  108. {
  109. "ioc": "rc.glox"
  110. },
  111. {
  112. "ioc": "harvardanglia2008officeonline.xsl"
  113. },
  114. {
  115. "ioc": "pictureorgchart.glox"
  116. },
  117. {
  118. "ioc": "chicago.xsl"
  119. },
  120. {
  121. "ioc": "iso690.xsl"
  122. },
  123. {
  124. "ioc": "ccent.glox"
  125. },
  126. {
  127. "ioc": "set.dotx"
  128. },
  129. {
  130. "ioc": "gostname.xsl"
  131. },
  132. {
  133. "ioc": "gosttitle.xsl"
  134. },
  135. {
  136. "ioc": "adial.glox"
  137. },
  138. {
  139. "ioc": "iso690nmerical.xsl"
  140. },
  141. {
  142. "ioc": "ieee2006officeonline.xsl"
  143. },
  144. {
  145. "ioc": "e.gu"
  146. },
  147. {
  148. "ioc": "anded.thmx"
  149. },
  150. {
  151. "ioc": "content.inf"
  152. },
  153. {
  154. "ioc": "uotable.thmx"
  155. },
  156. {
  157. "ioc": "asis.thmx"
  158. },
  159. {
  160. "ioc": "sist02.xsl"
  161. },
  162. {
  163. "ioc": "rame.thmx"
  164. },
  165. {
  166. "ioc": "rings.glox"
  167. },
  168. {
  169. "ioc": "iew.thmx"
  170. },
  171. {
  172. "ioc": "etropolitan.thmx"
  173. },
  174. {
  175. "ioc": "arallax.thmx"
  176. },
  177. {
  178. "ioc": "gb.xsl"
  179. },
  180. {
  181. "ioc": "ividend.thmx"
  182. },
  183. {
  184. "ioc": "erlin.thmx"
  185. },
  186. {
  187. "ioc": "eadlines.thmx"
  188. },
  189. {
  190. "ioc": "ype.thmx"
  191. },
  192. {
  193. "ioc": "ircuit.thmx"
  194. },
  195. {
  196. "ioc": "g.n9"
  197. },
  198. {
  199. "ioc": "adge.thmx"
  200. },
  201. {
  202. "ioc": "rop.thmx"
  203. },
  204. {
  205. "ioc": "roplet.thmx"
  206. },
  207. {
  208. "ioc": "avon.thmx"
  209. },
  210. {
  211. "ioc": "amask.thmx"
  212. },
  213. {
  214. "ioc": "esh.thmx"
  215. },
  216. {
  217. "ioc": "late.thmx"
  218. },
  219. {
  220. "ioc": "eathered.thmx"
  221. },
  222. {
  223. "ioc": "vent.thmx"
  224. },
  225. {
  226. "ioc": "rail.thmx"
  227. }
  228. ]
  229. },
  230. {
  231. "Description": "Performs some HTTP requests",
  232. "Details": [
  233. {
  234. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  235. },
  236. {
  237. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  238. },
  239. {
  240. "url": "http://sripipat.com/pawpaw/PurchaseOrder.exe"
  241. },
  242. {
  243. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  244. },
  245. {
  246. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  247. },
  248. {
  249. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  250. },
  251. {
  252. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
  253. },
  254. {
  255. "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
  256. },
  257. {
  258. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
  259. },
  260. {
  261. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
  262. },
  263. {
  264. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  265. },
  266. {
  267. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  268. },
  269. {
  270. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
  271. },
  272. {
  273. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
  274. },
  275. {
  276. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
  277. },
  278. {
  279. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
  280. },
  281. {
  282. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
  283. },
  284. {
  285. "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
  286. },
  287. {
  288. "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
  289. },
  290. {
  291. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  292. },
  293. {
  294. "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
  295. },
  296. {
  297. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
  298. },
  299. {
  300. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
  301. },
  302. {
  303. "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
  304. },
  305. {
  306. "url": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe"
  307. },
  308. {
  309. "url": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes"
  310. }
  311. ]
  312. },
  313. {
  314. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  315. "Details": [
  316. {
  317. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pg\\xb0#x\\xd2\\xf3\\x84\\xeby\\xa7\\x04 \\xb1\\xc7\\x8c\\xd6\\xb66\\x03\\x82k\\x1amw\\xc7\\xb2\\xc8\\x8f\\x1b\\xb5o4\\xd8~6\\xce\\xbd?`ke\\xe4z`<\\xc0\\xbbh\\x98=%4re\\xa0\\xfd\\xf8\\x82\\xef\\xa1\\x89s0\\xa6\\xbd^\\xe7\\xcdh\\xfc4e=,\\xeb\\xf8\\x8c\\xa5\\x83\\x06\\xfcs\\x15\\xb5\\xd6\\x90\\x06<\\xa0\\xa3\\xead\\xd5v\\xdd\\xa0\\xf5\\x81'\\xfd`\\x8d\\xcd\\x01\\x7f\\x18z\\x92lr$\\x1c\\xfe<]\\xf0\\xd2\\xf17\\x14\\xf4\\xe0\\xa4\\x88\\xc5\\xda\\xc6\\\\x16\\xd8\\x9e\\xa7\\x05\n\\xc4\\x0f\\x04\\xccjt\\xbcrde4\\xc6\\x83\\x89\\xfc\\xec\\xfa8\\xaf\\xa7\\x9f\\x96\\xd6\\xb3\\xeb\n\n$\\x95\\xe1vk\\xdamn\\x14\\x14\\x9ea\\x0c\\x1f\\xea\\xd1\\xcc8nxdx)\\xd3\\xfec\\p\\xe0j\\xc8\\xadl>\\xb19\\xf6w=%\\xb8\\xb5\\x19%\\xe6*]\\x1ax\\x81\\x9d\\xc8d\\xcd!\\xf3i\\x13\\x8b\\x9b\\xc4\\x97\\xd5\\xb2s\\xed\\xd4\\xf8\\x98\\x7f\\xfa\\x7f\\x82\\x86e\\xa8h\\xf8\\x17l|\\xd3\\x96\\x97\\xc1\\xfbu\\x0e\\x96<"
  318. },
  319. {
  320. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x01\\xb0|\\xc9\\xce\\x10\\xc8%\\x94\\xe6\\xe9\\x8d\\xfe_\\x840`)\\x1a\\xbadz\\xfa*\\xd4i8\\x9fu\\xa4,\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  321. },
  322. {
  323. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04hu\\xbc\\xb5j\\xd5bm>\\xedj\\x96\\xe1\\xc43\\xf9\\xd8\\xfa'\\xe4fv\\xfa\\x88#\\x9b\\xa8\\x83\\x80r\\xe8i+\\xb9\\x03\\xd1\\xccom\\x04\\xf4oq\\xc7\\x00\\xec\\xec\\x9b\\xabx7m\\xf6@4\\xcc\\x12ich\\\\x8dzs\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x18c\\xb8\\xc1\\xf6(\\x95\\x1c\\xd2<\\xf0\\xe4\\x81e\\xa5\\x90\\xacjp\\x82\\x0e70\\xffj\\x91=\\x0ez\\xcer\\x8c7`t\\x8a<ir\t\\xfc\\x0b!\\xa6\\xc0\\xfa\\xa8j"
  324. },
  325. {
  326. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\ncache-control: max-age = 89056\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 22 mar 2019 18:30:24 gmt\r\nif-"
  327. },
  328. {
  329. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  330. },
  331. {
  332. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x02ar\\x17\\xc5\\xfa\\xc2\\xa6a6i\\x84x\\x19xh\\xce\\xb6\\xa9\\xff\\xe1iy\\\\xa5\\xc0\\x9d0\\x98\\xdf>\\xe2\\xc9\\xa0\\xc4\\xdd\\xb7e\\xbf\\xcb\\xb2\\x8b\\x84t\\xf6\\xa0\\x97\\xb1\\x8fyr\\xe6\\xde\\x1b\\x1a\\x1e\\xe5pyf\n%\\xf2{\\x95\\x13zx\\xff\\xc1\\xec\\xce\\x1f\\x1d\\x7f\\xff\\xdba&h#n\\xe3i\\x0c\\xa6?,\\xc3~\\xf0\\x13\\xa1\\x05\\xa2\\xbdk~\\xb0\\x0e\\x89\\x07\\x0b\\x990\\xbb\\x08\\xa8\\xfc\\xcc\\x10sa\\x00e-\\xce\\xf2\\xd7\\xee>e\\xa2\\xb5\\xcff\\xcaqf2ke\\x9e\\x9e\\x93\\xcb\\x15 \\xfd\\xc1\\x19\\x9a\\x82\nf\\x11-0~\\x80\\x15\\xddq\\xfd\\xf7\\xfdtrs(\\xe7%\\xea\\xac\\xbdojc\\xf4\\xff\\x80{\\x1d\\xd7\\xb4_um5\\xec\\xbf\\xf9\\xe2\\x06\\xc8x\\x18\\xd8|\\x10\\xb8\\xcd\\xd6\\x08\\xf9\\x01\\xa516?(\\x8f\\xda\\x1d'j\\xca\\x85\\xaf\\xd2\\xa2\\x07\\xc3v\\xcb\\xb4\\xd6\\xfc;\\x95\\xc2\\x18j\"\\xc6\nx\\xe5\\x1c\\x8b\\x8cm\\xac01\\x97\\xe1\\x19\\xb4\\xce\\x0b\\x7f\n\\x9d\\xd0\\x9fb\\xcd\\x8d!\\xc5"
  333. },
  334. {
  335. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\x10\\xc0\\x8e\\xfe\\x07\\xdc\\x85\\xf8\\xe8\\xa9k\\x88\\x03y\\xe7s\\x90\\xb1\\xeb\\xdb+\\xe4\\xef\\xc4b\\xccs\\x9b\\x10\\x8fs:m\\x91\\xe7\\x15\\x9a\\xfd\\xe0^\\x93e\\xe7\\x9e\\x14w\\x15:\\xcce\\xeebtz\\xfb\\xd1[b\\xe9\\xdf\\x9c\"p\\xac\\x98\\xd9\\xa9b\\x93\\xa1\\xe56\\xea\\x11\\xda)\\xbeh\\x8a\\xb3\"\\xcc\\x83\\xdf\\xc5\\xf8\\x02g\\xa1\\xd05\\xee}'*!j\\xa8\\x8c\\xad\r\\xf9tjk\\x11\\xc9t\\x84u\\xe6\\xee\\x1b\\x8d5\\xc3y\\xe2\\xa5\\x84\\xbd\\x96\\xc6\\x88\\xb6\\xa4\\xa8\\x95\\x1b#\t]v\\xbbl\\x80\\x95g\\xebd\\xec\\xbd\\xf2\\xb3>\\xa8\\xf7\\xd4\\xc1\\o\\xa2\\x13\\xb1`\\x03\\x0c3=\\xf6\\x8d\\x9f\\xd7%\\xe5`d\\xc2y\\xd4\\xa5\\xbaq\\xff\\xe5\r\\xd3\\xe8\"\\x1d\\x7fq\\xd9\\x81\\xbap\\x02\\x0b\\xa9\\xcf\\x0bef\\x01'<\\xe0\\x9d\\x11b5\\x9d\\xbec%\\xfb\\xa5 x\\x06\\xe3\"ri\n\\xdau\\x04\\x06m\\xcb\\xb5\\xe8\\xb6\\xbb\\x13e\\x8d\\x97r\\x12\\x98\\xf9`\\xef:l\\xc9\r\\x13\\xfc\\x7f\\x1e\\x96\\x91c%\\x10\\xe0\r,"
  336. },
  337. {
  338. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x01\\xb0}\\x12\\xca\\x8f\\x93za\\x13-zh\\xefl\\xa7b\\x1e\\x9a\\xeec\\xc9]\\xa4q\\xf5on\\xfau*\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  339. },
  340. {
  341. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\td\\xf5\\xf7\nuw \\xc9\\x1e\\xf6\\xa463\t\\x17l\\xd1[iw\\xc9\\xe3qe\\xd2\\x0fo\\x96d\\x19\\xfc\t\\xf9\\x9c\\x1c\\xfa6\\xf2\\xe2]\\x90~\\x9f\\x0c\\xf0\\x8f?\\x9a\\x8c\\x85)\\xeb\\xb8\\x01tr\\xcc\\xfe\\x04\\xc1\\x1c\\xc4$\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbf\\xa6\n\\xad\\x8c.q\\xda\\xabe\\xe4)\\x12\\x81\\xb2~\\xad\\x96\\\\xaablz_0<\\x9fn\\x15\\xec\\xd8\\xd8\\x97xht\\x81\t{7\\xf4)\\xbcr\\xe66\\xc5\\xe1"
  342. },
  343. {
  344. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x92vm\\x90/\\x1a\\xc0&\\x02b\\xef\\xd1\\x9d\\x94#\\x1ed\\x9f\\xfd\\x19\\xadqx\\x99\\xe8-b\\x83~\\xf8\\xde\\xa8\\x1ax\\xd8m\\xf8b\\xa5\r\\x8f=\\xfa\\xf2\\x88\\xbc\\x0e\\xa0\\xfe\\xda\\xe9\\xe75n\\x9f\\\\x03\r\\x9aek\\xe5i\\xc4`\\x96\r\\xf7\\x87*#\\x13u3\\x89\\xbd\\xf2dql\\xbb\n}\\x9b\\xc9\\xc7\\xf6\\x1blh#>\\xd0\\xfdn\\x98\\xd6w`\\xa9\\xc4b\\xdc~q\\xb6%!r\\xba\\x8a\\x0f4\\xef\\x18]\\x7f4g\\xed\\x07ww\\x06\\xe0\\xb9zg*5\\x00\\x87q\\xfe\\xef\\xc5\\xa5\\xd1\\x8e\\xbb\tb\\x94\\xf3\\xc7k\\xbb\\x82\\xa99\\xdb\\xc7d\\xe9\\x1el@\\xea\\xc4i\\x89\\xcc \\x0b\\xc0j1\\xcaxt[\\xa1l\\xb8\\xaa\\x1d\\x82\\x99\\x00\\x9e\\xe3\\xc2\\xb6\n\\xbfs}u\\x16!\\xcb\\x06\\xfc\\xbc\\xe1\\xbf\\xf2\\xde\\xd4\\xc1\\x19\\xcc\\xb3\\xd3x\\xa0y<\\x06\\x98\\x93\"\\xe9\\x16\\xe9\\xe0b\\xd3i%7\\xfb\\xd5\\xa7\\x0c\\x9a\\x82\\xe1\\xc2\\xaa\\x90\\x1f2?\\xb86\\xfehhi\\xdcr\\xb8\\x8a\\xe8\\xfdw\\xf6\\xc1\\x"
  345. },
  346. {
  347. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x01\\xb0\\x7f\\xa1\\x16\\xc0\\x1f\\x9c\\xfbb\\xcb\\x0fb\\xfa\\x98\\x15\\xdc\\xcf\\xee<\\xaf\\xe1%\\xd2~\\x13\\xcc\\x05\\x00\\xb2(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  348. },
  349. {
  350. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04.1\\x7f\\xe1x\\x06m\\xebu\"\\xfbg6\\x00f\n_w\\xb2[c\\xa2\\x81\\xdb^\\xb0c\\x8d\\xa2\\xf6\\x05\\x89g\\xc79\\xca\\xc8a'\\xc6#\\x97\\xb0n}+j\\xa2\\xa3\\xb0\\x8cd\\xfe\\x9d\\xee@\\x01\\x14&\\x82\\xd5\\x04\\xe7\\x1f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xca\\xd4fi\\x91w*\\xf5\\xf4\\xd9\\x08e\\xa9:o1\\x8e\\x9c\\xec\\xfd\\x08\\x1d\\x890?n\\xa3\\x86\\xb1\\x8a\\x0c\\xe2xg+\\x0b\\x92w\\x0f\\xda\\xb4\\xc3yp\\x80u\\xa7j"
  351. },
  352. {
  353. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa1b\\x89b\\xa40\\xbe\\xadp\\x06y:\\xd4\\xca\\x07#\\xab\\x19\\x9a\\xa0\\xb3@\\\\xa2\\x0e)\\x06\\xdds\\x08i\\xb2\\xc2`\\x8f\\x95\\xb2\\xe4\\xf5\\x1dw\\xea\\x12e\\x10\\x17\\xb3\\xae\\x07\\xe1j\\xfdb\\xa60\\xb7f+\\x97=\\x1cu\\xac\\xb1\\x81\\xb7\\xc52dx4]\\x989)\\xbfy$e\\x15\\x1c\\xac\r@k\\x8f@\\xfc\\xca\\xec\\xd4\\xe2\\xa5\\xc9\\xe0\n#\\x8b\\x906\\x0bj<\\xa2\\x9f\\xe4nmf=\\x1b\\xc0\\x03\\x07j\\xb9k5;\\x90\\x0e6,\\x17`o\\xeb\\xd3p\\x8e\\xf2d\\xb6\\x0fj\\x9c\\xd9\\x8b\\xb2h\\x88a\\x91\\xfb\\xbf\\x17|m\\x89\\x00f\\xd7t\\xe6\\xef\\xf0\"\\xb3\\xaa/d\"\\x0e*e\\xbeb\\xe7\\xc5g\\x1f/\\xcc\\x12\\x01\\x12\\x91\\xb3a\\xcf\\xc1|h\\xec\\xcc\\x11\\xe6\\xce\\xf5lv\\x8d\\x1f\\xcc\\xd2z@\\xd3#\\xab\\x1c\\xf8\ri\\x12\\xfa\\x88g\\xa3\\xbe\\x8b\\x14\\xd5.\\xab\\xf9\\xb9h\\xea\\xc8\\xdd\"q\\xdb\\x0c\\x80e\\xe4\\xe5_\\xd8\\xa2h^\\xd9_\\x9f\\xa7\\xe6\\xae\\x8e\\xb7\\x04\\xfa\\x8d\\x1e\\x92\\xa5\\x07lq"
  354. },
  355. {
  356. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\x0e$7u2\\x8d\\x9a\\x9b\\xcd\\xc8dnu\\x7f\\xe6\\xc5h\\xda\n)\\xf6^3c\\x1e\\x9dg\\xf2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  357. },
  358. {
  359. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\x18\\xec\\x82e\\x08|\\xd0\\x18/a\\x96a\\xeau\\xd5u-\\xc6 ]\\xdb\\xa3\\xe5\\xa7\\xedd\\xc4\\x8a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  360. },
  361. {
  362. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7fl\\xd2\\x89\\x0eh\\x1d\\xac\\x10\\xf3,\\x06)\\x16\\xc1\\x03\\xaa\\xec\\x1b2\\x84\\xdf\\xc9t\\xf2\\x9b\\x964z\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  363. },
  364. {
  365. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f,\\x0b\\xc0p\\x03>=\\x14\\x87\\x89q\\x841c\\xc0| \\x01\\x03\\xb9\\xa8z<\\xe9\\x82\\xf5\\xf5\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  366. },
  367. {
  368. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\xb6b\\xbd\\xdds\\xf5\"\\xe7\\xee\\x9f\\xf6_\\xb9s2\\x8e\\x85\\xd3\\xc3\\xf5:\\xf5\\xca\"\"h\\x1d8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  369. },
  370. {
  371. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\xa7\\xf3s\\xcdom\\x8c\\xde\\xd3\\xd0[`\\xfb\\x91\\xfbo\\x12y\nkt\\x0ei!&\\xde<\\x0e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  372. },
  373. {
  374. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f`\\x1fzo\\xc0\\xe4bn\\xd0/\\xb1e_\\xa5.\\x0c\\xe69z\\xc4\\xf8\\xde<\\xd0\\xa0\\x193\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  375. },
  376. {
  377. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7fn\\xe1 \\xd8\\x95igk\\x87\\xc7\\x1f\\x84\\xcc\\xb5[u-\\xca\\xd5o9>y\\xd46\\xe0'7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  378. },
  379. {
  380. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\xfa\\xb3\\xd6?\\xb1\\xa0\\xb7\n\\xaf_\\xe2\\x9dz\\xb0\\x8e\\x81b.\\x0c0\\x8bh\\xe4\\x13\\xa5g\t\\x1f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  381. },
  382. {
  383. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xect\\xcfvi\\x01\\xd8kk\\xc2\\xfb\\xbf\\xb8\\x8b*\\x9b\\x00j\\x02)\\x8a\\xeam\\xb4\\xe0l\\xc0t\\x0c\\xc0d\\x9e\\xe6\\x97<\\xae2z\\xfb\\x1ayc dbj\\xfan\\xc3\\xfa\\x10\\xdb*\\x02\\xff\\xd8\\xff\\x0f\\x0c\\xc6m\\xc9\\xa5s\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x10\\xcb\\xb0\\xa8\td%\\x1e\\x1f^\\x00\\xd8\\x80r\\x9b8\\x90\\xb36\\xa41&,qs\n\\xc8\\x0cw\\x04&c\\xbe\\x9dx)l\\xae\\xd9\\x850\\xe7ple\\xea.\\xf8"
  384. },
  385. {
  386. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x96/n\\x94\\x15#\\x9f\\x9e\\xea\\x00vu\\x17{\\xcdp\\xf8[\\xdd\\xefun,\\x92\\xcf\\xb0\\x028\\xaa\\x8bb-n\\xc0$u\\xd5\\xf5t\\xab\\x0e\\xed,>\\x98\\x80\\xe6yu4\\x82o.\\xe3\\x91\\xa5\\x81\\xae\\xa7\\x9bet\\x9cr\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdaf\\x91e\\xba\\xe9jc\\xfe\\xfe\\xe6d\\x92\\x13^z[d\\x89\\xfb\\x9eg\\xba\n\\xd9mzg\\xfd\\xea\\x02\\x07\\x90n]a\\x00\\xd1lx\\xc4\\xef<\\xf7m\\x8a\\xf0s"
  387. },
  388. {
  389. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1)\\xe1\\xae\\x9f+\\xbe\\x99>>h\\xe2&\\x05\\xc0\\xa7\\xc9=\\xb5d\\xf2o%\\xad\\xeag\\x07\\xab^\t\\x17b\\xf0\\xfak\\xb6b=\\xef\\xc2nv\\x81.\\xec\\x83\\xac+\\x19\\xa7\\x02\\xadh\\xaf5\\x001\\xae\\xa1\\xcb\\xc3\\x0b\\x16\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdf\\xb8\\xb6\\x99\\xd3\\xe5\\xccd\\x84w\\xbc\\x8e\\xd5\\xdd\\x02\\x8b\\xc4\\xf3\\xb5\\xe3<3\\x8a\\x89q\\x85\\xbdl\\x89\\xedw\\xdf3\\xa7xv\\xf7\\xaf&!m\\x1e\\xe7\\x8b\\xab\\x97\\x14b"
  390. },
  391. {
  392. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x97\\xa6\\xb7z\\x9f\\x94%\\x9a\\x89\\xf4\\x1a\\xa5:\\xecp\\xebm\\x16hr\\xcf\\x9f)\\x98@\\x8evp=`-\\x97\\xf6n\\xee0&\\xfbi\\x91\\xe7\\xa3\\xccl\\xbb\\x9aj\\xadl\\x04\\x1b\\xb0\\xc4\\xbfh\\x04\\xb1@b\\xbe\\x06\\xb7\\xee\\x93\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd0\\x90_nq\\x8a\\xecyn\\x06\\xc8[f&i\\x9d\\x1be\\x10\\x98\\x93i\\x84\\x89\\x00\\x9a\\xdb\\xc8\\x11'o\\xd2\\x14ar\\x17\\x96\\xfa\\x13\\x0e_4\\xd1\\xa8\\xeak\\xc8\\xfd"
  393. },
  394. {
  395. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xab\\x8du.\\xbf6\\x1f\\xe7\\xa0g\\xc3j\\xda*\\x81p*\\xb2\\x00#d\\xf3e\\xbc\\x9f\\xccc\\xce\\x15n\\xde\\xb8\\x85>9\\xa1d\\x7f\\xf2\\x9b\\xb5j\\xf6\\xfa\\xe7\\x8dx`\\xddfi\\x7f1\\xb9\\xdb\\xf5\\xfe^f+\\xdd'\\xd4\\x9e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd6\\xef\\x03\"3\\xcbg\\x04\\xdda\\xfb,t<\\xd9\\xa5,3\\xce\\xb2\\xce\\xfcy\\xa9t\\xa2i%;\\xa56\\xde\\x8f\\xf0*m\\xe8&m\\xb1\\x84^\\xc7\\x14\\xe1\\xac+\\xac"
  396. },
  397. {
  398. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb7\\xf8<\\\\xa1\\x05(\\xa8c\\x05\\xda\\xc7\\xd0\\x94\\xfa\\xd1@\\x1b2\\xd3\\xf7\\x87\\x96jz\\xac\\x8f\\xee<\\xfa\\x968\\xec1p4>\\xa0\\xf3z:\\xj\\xf2y\\x90\\xe9\\xc8\\x13z\\xe1s\\x9b\\xf8\\xb0\\xf9\\xd8\\xfe)\\x8c\\xd4e\\xbf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0009\\xa7k\\xd3\\xb9\\x12\\xb1\\xad\\xd6\\xb3\\x94\\xf9r \\xc6\t0\"\\x92\\xd4\\xa6\\x02\n3\\x86\\xe7\\xdfdvp\\xb3\\xcexv\\xd5\\xf6\\x1cu\\xd0\\xe3}\\xa9\\x15~.c\\xfa\\x98"
  399. },
  400. {
  401. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb1v\\x90\\xdb{9l\\xd1t\\x9f\\xfb\\xf8d[a^\\x16i\\xf0\\xd1\\x9f\\xe9x\\xf0\\x967\\xd7\\xb2n\\xeb\\xd6\\xa9>z\\xc4t\\xfd\\xa9\\xf0*c\\xe7\\x11\\xb1(\\xad\\xe1\\x84g\\xb3i\\x01im\\xc2\\xa1\\x17\\xc4k\\xe0\\x8bg\\xa9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf2\\xf0\\xcd\\xef\\x9a\\xd0]\\xbe\\x0b\t\\xcc\\xc0\\x97\\x97l\\xc7\\x8di\\xdc>\\xfe\\x92i\\x9d4\\xf0f#5\\x8d=\\xee+?i\\xdbu\\x11]b\\xa4\\xc3`\\xa2\\xd7\\xc4/\\x89"
  402. },
  403. {
  404. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04cw\\xf5c\\x93\\x97\\x99h*\\xce:\\xc3\\xe4\\xeao!\\xdc\\xe8)\\xf2\\xc2\\xe6w\\xb7m1\\x88\\xb1\\xbd5<\\x17\\x04w\\x1fb\\xc0k\\xcb\\xfb+:\\x86\\xb4l\\x1b\\xf9\\x92n\\x078\\xb7\\x9ed\\xe8`4&m\\xc6'\\xc3\\xc3\\x99\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x17\\xbe\\x19a\r\\xddb\\9\\xe6rr\\xb4\\xfb\\xc0\\x8e\\x0c\\x07\\x0c\\xe4}\\xe3s\\x00\\x8d \\xba\\x18\\xe8\\xdc\\x93da\\xcd^c\\xd7\\xd6\\xe9\\x18\\xba^\\xc0\\x14\\x10#\\xfac"
  405. },
  406. {
  407. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa5z@g\\xc5\\x1a<\\xc7y\\x19>\\xc5\r\\x0e\\x1c'\\x84~\\xe4 ^\\x11}w\\x12\\xae]_\\x9b\\x0f\\xda!\\xe2\\x95\\x1bj6\\x1b\\x07\\x8e\\xee\\xad\\xf3\\x1d\\x17fo9\\x02\\xa7\\xc6\\xa1\\xa4e\r\\xab\\xc6\\x06m+n\\xae\\xd8]v\\x15\\xc5\\xb3{\\x06\\xb76\\xd9tx\\x03\\xb0nytu\\xe8\\x91j\\x12\\x11\\x07\\x0f5{v\\xbf\\x9ad\\xd0\\x90i\\xe4\\x9c\\xf4_\\xdb\\xa9e\\x97\t\\xae\\xe7\\x10\\x83(\\xb3\\x9e\\\\x80\\xa0(\\x87g\\xb5\\xb9\\xee\\xd1\\xfd\\xb1\\xadjwvl\\xdbn\\x9a3\\x8bv\\\\x1c\\xd6\\xbd:\\x97i5\\x0c2=\\x88\\x15 \\x7f\t\\xe4\\x1c\\x83a\\x1d\\x99:\\xf0\\x95y\\x1a\\xd3\\\\xe31g\\xf7vj8\\x1f\\xae\\xb6k\\xb9\\xed\\xd8zqw>kfiy\\xd6\\x86h\\x81\\xd2\\xea\\x92\\xfc\\xac@7\\xb4\\xad\\xa3\\x10\\x03\\xaa>\\xce\\x9a\\x8eh\\x10{\\xf8\\x93idw\\x9b\\x82\\xbd&\\xa5\\xaay9|\\xfa\\xd8j0\\xb2\\xf1\\x9avq\\x87\\xf2\\xf7\\xb7l'\\xf7\\xfd\\x1fy\\xbe\\xc6\\xe8\\xc2>\\xca\\xc2"
  408. },
  409. {
  410. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1b\\xaa\\x0b\\xa1\\x95\\x14\\xea\\x99k\\x954?v\\x10\\x90\\xb3\\x90\\x05\\xe5\\x8b\\xea,%r\\x11\\x8b\\xff+|\\xb9k\\x9c\\xad\\x92\\xa3i\\x14\\xb0\\x07\\x1f\\x99g\\xd4\\x19dmn*\\xde\"\\xedi\\xa6%c\\xd8vhk\\xc6\\xee\\xa0%\\xb0r!\\xf1\\x9az\\x9c\\x94\\x82/\\x19j\\x8f\\xf0ai\\xd1\\xaf<\\xfe\\xa0r\\x86m\\xa92\t\\xd8s\\x06ww\n\\xf7\\x1e\\x1ca\\x14\\xe71\\x9e\\x82l\\x8b\\xf9\\x12a\\xd9\\xe1i>\\xb0\\x19\\xf37\\xf9\\x0c+\\xc7\\xce\\xdb\\x1a\\x0f'\\xa3]g\\xa1l\\x90\\xf0\\xc9\\xb9\\xcc\\xe2\\xb1\\x8d\\x15\\xf0<\\xc6\\\\x81\\xff\\xfc\\xfc\\xcc'\\xfd\\xf1\\x9e\\x0ca\\xd1!\\xf7w\\xe9\\xbf\\xc8\\xa4\\xfa\"\\xc7;\\xe6\\x0c\\x08\\xa4\\x91\\xca\\xe2vhr\\xffj\\x1d\\xb4\\xe9\\xdf#\\xd0$\\x12\\xf6\\x9d\\1\\x97:\\xe7\\x07w\\x861\\xa0\\x02\\x8d0\\xb5\\x80\\x1d\\x1a\\xc6\\x95}\\xfe\\\\xc4\\x8d\\xc9=e\\xa6\\x14\\xa5\\x05y-\\xbc\\xf8\nt\\x9b:\\x93$x\\xf9\\x82\\xb6\\xb1\\xe4\\xef\\xebx\\x19\\x04 \\x11\\x1d\\xf3v/_\\x15\\x14"
  411. },
  412. {
  413. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1o(5\\x9a^;s<5\\x96\\x0fw\\x99\\xff\\x8c\\xf5\\xc1}$9\\xc7\\xc1\\x04\\xad\\xc3<z\\x9fm\\xac\\xc6\\xd6\\xb2\\xc7\\xf3zw]\\xf3\\xa7k\\x83\\xaa!\\xb0\\xdc\\x99\\x999\\xe7a]t\\x1bk\\xf6\\xda\\x14\\x8bv\\x90lh%$\\xef>\\x12>:v\\xb8\\xa0 +\\xd3;\\xbf\\xd8\\xb8\\x99\\xf0\\x08\\xe9\\x03\\x9b\\xf0\\x97\\x82\\xbf\\xa8\\xb1\\xa6\\x91~im\\x13b\\x8e\\xef\\xb9\\xe5\\xa9\\x17\\x9d\\xfcu\\x90k\\x17\\xb8qf;\\xe1\\x1d\\xedb\\xbf\\xb6\\xe5\\x98\\xba\\xc3\\xc6o\\xd2\\xf3\\xbb\\xe9\\xdf\\xbc\\x05\\x91<\\xfal\\x94\\xdbe\\x9b(c~\\xac\\xda;y\\xa7\\x94_\\xc4\\xe7\\xc0\\xce\\xc29\\xfer\\x9bz\\x1c!m\\xa3\\x04v=\\x14e\\xd1\\x98/\\xba\\xfa;e%\\xcfv\\x07\\xfa\\x8a\\x9f\\xd2\\x05\\xe86\\xc5\\xa2\\xedm\\x95\\x15\\xfb\\xfb;\\x1e\\xa5\\xbf\\xf7\\xe9\\x04\\xd3\\xdc\\x80\\x06q/fy\\x9c\\xc14\\xb8\\xddt\\x9b\\xc3\\xf8\\xa5\\xbe\\xd9bl,\\x1cq\\xa9\\x94\\x1a0\\x84j\\xc6\\xd4\\x8a\\xf6(\\xec?\\xd3\\xe2\\x1a\\xc9\\x05ihx"
  414. },
  415. {
  416. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x10\\xd0\\x1d6\\xafz\\xd5e}\\xa3\\xf3\\xe9\\x0f\\x89mwr\\x02\\x88*\\xb1\\xc7x\\x99+e\\xe2m3\\x18\\xf7?\\xcf\\xd2\\xd8\\xd62\\x81\\xbf\\xaeo\\x84\\xa5t\\x19\\xa8\\xc8\\x9fx\\x98\\xcc}\\xcc\\x95v\\x1c\\x9b4n\\xf6\\xcfty/\\x9dp\\xac\\xef\\x16k\\xa2ere~\\xe5\\xf8\\xc64\"\\xcb\\xfe\\xe5[\\xce\\x17\\x80\\xb0n\\x16rh\\xb7\\xb9\\x02\"\\xe0d\\xa8\\x81\\xda\\xe8v\\xed\\xa9\\xbe/\\xe5\\x80\\x15\\xb2hc\\xee\\x93\\x7f\\xd9\\x83\\x07\\xf3\\x10\\xb8\\xba\\x9f@\\xbb\\xa7]\\xf5g\\x08\\xe8n0}\\x9e\\xf5\\x99\\xda\\xb3\\x14#6 <\\xf4v\\xe90\\xeb\\x98\\xa0\\xf3\\xe4ce\\xe7\\xf9\\x01\r\\xda\\x10!\\x82\\x9d\\x8b\\x16b\\xc8\\xb4\\xa6m\\xd6\\xfb\\xf8\\xc6\\x0e\\x04e\\x0f\\x04\\x91-\\xbd+\\xa9\\x13\\xaea\\xd1\\xb7\\xdc\r\\x18\\xec\\xfe\\xde\\xbb.\\xfc\\x98$\\x1e\\x99\\x16rp\\xfb\\x9b\\x89\\xab=\\x80\\xbdz\\x08\\xa0r.u#\\xa4\\xb0\\xc5\\x1f\r9\\xd9x p-8\\xcc0\\xd69\\xbd\\x8f\\xa6\\x15\\xb7\\x87\\x9b\\x9a\\xff\\xa0\\xdc\\xf6b\\x02"
  417. },
  418. {
  419. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\x9065(\\x12\\xf7\\xe4d\\xbd\\x9c\\x18 u\\xbcs&\\x17\\xa2i\\xfc\\x8d\\xa9f\\xeas\\x8ap\\xdf\nh\\xa0\\x92\\xd8\\xf1\"\\xf3_v\\xf4s\\xa0 \\x00\\x0c\\xf7ih#\\x8e\\xad\\x83!\\xfes\\x82r\\xbc%\\x88q\\xe8c1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf6y\\x13\\xcf^\\xcd(\\x84\\x17w\\x7f\\x1dy\\xc2\\xeepd\\xce\\xaf?(yu\\xfb%0z@a\\xa6\\x8e[\\x8f\\x9br\\xc0\\xa7`\\xbf\\xa8\\xf6\\x94\\xe1f8\\xc4<\\xbe"
  420. },
  421. {
  422. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc1\\x8ai\\xf1b\\xe0\\xcf\\xe5x\\x06\\xb7\\x9e\\xa9f\\x854\"\\x0c\\xa3\\xad\\xf9\\x98\\x94\\xcf\\xa3!-\\xff\\x94\\xba5\\x1d\\xa0\\x9b\\xee\\x96\\x86e;~\\x91#e[\\xf7\\xd6c>p8\\x14\\x93\\xaa!\\x82\\x7f\\x9c6'r)>\\xd7%f\\xd4sq\\x1e\\xe3\\x87\\x9er\\x03\\xe0\\x9b\\xcdt\\x165\\x84\\x0e\\xb2\\xe5\\x12\\xee\\x18\\x83\\xde:@&h\\xb9\\xc7;\"8\\xa1\\x96\\x85=\\xc2aa\\xf7\\xa0\\xd0\\xdf\\xa8&\\x9a\\x9a\\x84h\\x85\\xc7\\xe5-\\x8d2o\\x83\\x9f\n\\x1f\\xcf\\xb3\\xce`\\xdfrg\\xa0sj&\\xa7\\x88\\xe4\\xc9\\xce\\xe2\\xb6\\xb7=\\xda\\x0c\t\\xc4zv\\xde\\x8d*}\\xd1t\\xa5\\xf2q\\x05\\xf7\\x88\\xb3\\x80nz\\xbc\\x0er\\x92\\x0b\\x80\\xbc\\\\x84\\x06\\x91\\x8e\\x9a\\x9f;\\x01\\x89\\xe7p\\x10\\xae\\x92\\xech\\x8b\\xb5q\\x8aul\\xb9\\x9d`\\xd1\\x01u\\x16\\x9d\\xb7\\xef\\x95\\x13\\xd0\\x00\\x99\\xb1\\x7f\\x9c\\x99\\xe1x\\xfc\\xe9\\xc8\\x8e\\xe5\\xb6-!\\x1f\\xd1\\x9a\\xd1]\\xfcd\\xc0n3|\\xdfd\\xaf\\xef/7x\\x1f{\\xb2\t\\xc1\\x80"
  423. },
  424. {
  425. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\xcb\\x7fj\\x01\\x06c\\xe9\\xd6\\xc6\\xd5\\xed\\xa9\\x014\\xcf_\\xb1?m\\xed\\xe7o\\xd3*\\x06$\\xe3=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  426. },
  427. {
  428. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8d\\xc6\\xc3&\\x07l^-\\xa6\\xd4\\xd9(\\xef\\x0fi&m\\x1c%}\\x16\\xd4\\x90\\xa8\\xaf\\x86\\xbcf-r5\\xc4q\\xef\\x01\\xd0:\\xed\\x14\\x8d\\xbc\r\\xd78\\xaa\\x97\\xc2\\xa1\\x9e\\x99\\xd2\\xd2\\xf0\\x84\\xd9\\xc2'm\\x19\\xa4\\x14g-\\x81\\xb8\\x0c\\xb3\\x99%+)\\x95\\xb6\\x94e\\xb3\\xea\\x05@r7m\\xc3\\xf0\\xd9\\x88z\\xd5\\x15\\x9e\\x9d\\x9b\\xb7y\\xactd\\xe6\\xcc\\xa8\\xd72s\\x85\\xd8\\x01q}1+\\x978dyrj\\xe0\\xa7\\x16\\xb3\\x1f>\\x1c\\xe5o\\xffi\\xf0\\x82\\xcd\\xc2\\xfc\\x1elz\\xbduv|\\x96\\xc5\\xbdn@k\\x14\\\\x00\\xac\\xd2\\x14 \\xa55~nw\\xacfoe\n\\xf9\\x1dj]\\xb49l\\xd4h\\xa5\\xcb\\xa2\\xe6\\xe4n`?\\x1c\\x90\\xea\\xde\\xad\\xca=.\\xb0\\x8c\\xe9ba\\x80\\xddz4\\x0f\\xfa\\xc1\\x0c6\\xd4uq\\xa7m\\x9a\\xd0\\x15ag\\xc7y\\xbc3\\x08jpkw\\x87l9\\xfedrs\\xc1\\x08 \\x15~\\xado\\xbb\\x15h\\xbe\\xd5\\xc4\\xd9\\x91\\.\\x12\\xc0\\xb9 lm\\x10"
  429. },
  430. {
  431. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7fdc\\x87eryhh\\xa3\\xee[3gu\\xe6j\\xb5\\xad\\xd9\\xf8f\\x9e\\xca\\xff\\x82je\\xf0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  432. },
  433. {
  434. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcdi>\\x8d#x\\x07\\xbdp\\x8b\\x9c\\xb2\\x7f\\x80\\xd3\\xbc\\x85xnab\\x03\\xa5:\\xcc\\xaa\\x87y\\xe9e\\xb74\\x9aq\\xfcj\\xe4s\\x94g\\x92oez)7/\\x11x\\xfa\\x1apxn\\xa0\\x8c'^\\xb5^ ~\\xe8d\\xc5\\xa1f\\xd5\\x9ab\\x9a\\xea\\x89\\xfdg\\xb2\\xbayh\\x1a\\x9c\\xc2\\xe6qa\\x1a\\xa4jd}\\xea:\\xe3f\\xb1\r; \\xdb\\x1c\\x97\\xfd\\xae\\x9f8n\\xb2v\\x9c\\xdb9a\\xb5\\xbd3\\xb6d\"\\xac\\xed\\x17\\xe1d\\x8e\\x9a\\xd4\\xae\\x12\\x9e\\xe1\\xc0\\xb8y}i\\x04\\xec\\xbc\\xc6\\xf4a\\xf5\\x82\\x06\\x85\\xf28\\xea\\xe3tt\\x89b\\xc6t\\x85s\\xe8l9\\xfdy\\xb4\\x86\\xfdq\\xf4lz\\xfb\\x11(aus\\xe3\\xe5\\xe9\\xcd\\xd7\\x90\\xb0u\\x87\\xe5x\\x15\\xb2\\xf8\\xc4\\xe9\\xe4\\xd0\\x1dc\\xbbx[\\x04\\x14y\\xe3\\x8d\n\\xfe&\\xc6\\xea\\x05|\\x9e\\xd0\\x84d0\\xba!j\\xad\\xa0(\\xc4\\xd0tm\\x9a\\x18\\xae~<m\\xf2=^\\xea\\x03t\\x87\\x0b\\x17\\xfb\n\\x80\\xcb\\x92z\\xde0\\xc1\\xd6\\x19"
  435. },
  436. {
  437. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\xf8m\\xceb@\\x93\\xb4\\x8c\\xd1\\xe8\\xaf\\x00}\\xad\\x97\\x91\\xc0\\xa4f\\xa2\\xb4\\x05\\x1a\\xf9\\x1c\\x0f\\xc5\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  438. },
  439. {
  440. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\xaa\\x0f0\\xd4\\xe1\\x0c\\xce\\x17]s\\xdd}\\xbfd\\x97\\x81\\xb0\\xa8\\x00\\xcd\\xe5\\xc1\\xcc\\x12$\\x9e\\xc1\\xac\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  441. },
  442. {
  443. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\xaa\\x12%\\xf8\\x87=\\x06\\xec\\xcf|\\x05l\\x0e\\x01ui'r(\\x02\\xa2\\xb3\\x8f\\xc5\\x89$!,\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  444. },
  445. {
  446. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\x17\\xa3\\xaf\\x04\\xc3h#\\xd4v\\xfb}\\x90ep\\xc1\\xb5w\\xa99\\x15mc\\xc6\\x0b\\xe9\\xac\\xda\\xbc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  447. },
  448. {
  449. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\x06\\x8e\r\\xa3\\iih\\xb9\\xf3\\xa53\\xca\\xfc\\xcd`\\x8e\\x94\\x8f(\\x18?\\x8bw\\xdf\\xcc\\xba\\xc1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  450. },
  451. {
  452. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\x14f]m\\xdc?r\\xb3m\\xb6\\xac\\x16@\\xfe\\xfc\\xf8\\xd2\\x03v\\xfd)\\xd3\\xf50\\x9f2\\xb3\\xe4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  453. },
  454. {
  455. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\xaf?\\xd9\\xb4\\x04\\xd7\\xc8\\x8a<g[\\x08\\x96m\\xbb@p-\\x8b\\x81sa\\x9f/r)\\xf7\\xe6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  456. },
  457. {
  458. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbcve\\xb8\\xc7\\x9e>\\xcc\\xdb1fj\\x8b\\x8e\\xbc>\\xef\\xe7\\x8f,\\xcf\\x18\\x9e)\\x0e\\xa8m\\x04\\xd9zf\\xb5\\xab 1;q\\xda\\xbb\\xd7$u\\xdbk\\x0b\\x02\\x18\\xbfmn\\x1d1\\xe55_\\x01h\\x84f\\x13\\xf9\\x08\\xfd\\x0b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd9\\x07i\\xc5;\\xf7l2\\xbb\\x90\\xc09\\xdd\\xa6\\xf0\\x04\\xb1\\xf2\\xe9\\xdc6\\xa7\\xb4y\\xe1m2\\x05g\\xcet\\x90zu\\xed\\x95\\xa0\\xe0y?\\\\xaf\\xeb\\xc2\\xd3\\x90|\\xc1"
  459. },
  460. {
  461. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\x0e\\xbe\\x90\\xba+\\xd3\r\\xa8\\xa7\\x83\\xc8h\\x8d\\xfc\\x82\\xcb\\x8a\\xb1?\\x86\\xc5\\x0c\\xe6<r\\xb9q3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  462. },
  463. {
  464. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\xca\\xbdli\\xb7\\xaa\\xb6{\\xa7\\xd2~mi\\x06\\xde\\x00t\\xfe\\x0cvy\\xccy\\xba\\x0f\\xad\\xb97\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  465. },
  466. {
  467. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o\\x06\\x03\\x9c,\\xe0\\xfa>\\xde3\\xb8\\x02\\xed\\\\xec;\\xf9\\x8fr\\x11irmb\\x10\\xcc\\xd9g_+\\xff\\xd7\\x93\\xf2!\\xe7\\xf2\\xdb\\xf9t\\xdd\\xd26m&ni\\x7f;\t\\xaba\\xef_wn:\\xf5\\x06\\xa4,b\\xac\\xb1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83#\\x11\\xeb\\xd3z\\x99\\xd21\\x06\\x16vj\\xfde\\xe3\\x9e\\x1d\\xf1\\xbf`\\xb2\\x1c\\xdf\\x88n\\xe8\\x91\\x95a\\xfbq\\xaf'\\xcc\\x1fc\\x9e\\xba8r\\xf1\\xb2nz\\x87\t\\xf8"
  468. },
  469. {
  470. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\xbby\\xf9\\x96\\xe4\\x97\\xb1\\x96rr\\xfcsg.n\\xc7\\xa8e#i\\xab:f\\xc5\\xc9j.\\x0f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  471. },
  472. {
  473. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\x7f\\xd5\\xb7\\xdc\\x9cm]\\x98\\xd5\\xde\\x93|\\x81\\xbe?\\xcc\\xf1j\\xe4\\xc7\\x98vb7\\xf9\\xa5\\x8d\\x14(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  474. },
  475. {
  476. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04}\\x0b\\\\\\xd3\\xb0\\xc1q\\xfd;\\xb7\\x86\\xee]\\xb51\\xa2;\\x1a\\xa4\\xe25#-\\xd4\\x8c29w\\xc5\\xb2*\\xbf\\x83\\xbb77x[\\xab\\x1e\t\\x1fp\\xbc\\xe1@\\x10\\x143\\xad\\x15\\xef\\xb5c\"\\xab\\xed\\xdfnr\\xdc\\xb8b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x90\\xcb\\x8cm\\xa1\\x96\t\\xcf\\xb3s\\xeag\\xb8|p/\\xd8p\\xc1&\\x0e\\xe0\\\\xf9d~\\xc5\\x13\\xe5\"\\xfe\\xfa\\x8f\\x8c1\\xbe\\x0f\\xfa\\xee\\xeftp\\xc8\\x95\"\\xdd\\xc3\\xc4"
  477. },
  478. {
  479. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z\\xa8\\xe7o\\xe8\\x05\\xd3\\xaa\\xf9\\xc4\\x7f\\x1b\\xaf\\x00n6[mjqu\\x8d\\x1c\\x8a\\x03\\xe4n\\xa7\\xbf\\xfa\\x1c\\xca\rb\\x8a\\xcb\\xdan\\xd1\\xa2\\xcd\\xf7\\xff\\x14\\x82hg\\x05!\\x91\\xe4\\xb9\\x8ch,\\xba\\xe3\\xabu\\xc0_\\x10\\x0b\\x0c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3\\xbd\\xe9\\xdev\\xecn\\x89\\x87\\xf9\\x0e`/\\x95_\\x004t\\x85\\x89\\xc1\\xef\\x9d\\x16\\xady`y\\xb1\\xc7\\x8281\\xa7\r\\xb3\\xe1k\\xf8e\\x83$q\\xddbk\\xe40"
  480. },
  481. {
  482. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8a k-\\x8fh\\x8f\rk\\xf7t\\xc0\t\\x18/\\x08[\\xf1\\xda\\x90\\xcb\\x0e\\x8fw\\xfe\\x9f\\xf3(\\xbd3\\x80\\xbb;\\xd9\\xa6w)/\\xafy7\\x8c\\xbd(\\xab\\xebfy>c\\xc7\\xce\\xd8\\xb1@\\x167\\x9d>\\xcah\\xabm\\xc4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf0\\x19\\xeeh9\\x92\\x97\\x01\\x08\"\\x81.b&3:\\xf8h|\\xb6\\xab[\\xa75\\x11\\xdb\\xd3.$\\x00jc\\xa2\\x91\\xc9q\\xf6\\xf2\\x15\\xbc\\x9f\\x89m\\x8c\\x9c\\x1ea\\x00"
  483. },
  484. {
  485. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x86t\\xc7\\x1e\\x8c8\\xc0,\\xa9\\x87%\\x86\\xc6l\\xec|7\\x12\\xacp5\\x93ei\\xd7@\\x88b\\xa4\\xe9\\x0f\\xf6\\x97\\xef\\xcf\\x02\\x0et\\xea\\xe5\\x14c\\xb9\\xf3x\\x8f\\xe0\\xe1\\x82 \\x8e\\x7f\\xfc#\\xdc\\xc1'a\\xd6\\xd8\\xb3\\xeci\\x01\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa9\\\\xf1\\x02:?\\xfdk)gh\\xec\\xf9\\x138\\xc5e\\xef\\xa3\\xe6\\x12\\xd9\\xd4{ \\x8c\\xd7\\xa9\\xad\\xee~\\xd2a\\x9f8\\xd4\\xb3\\xcb\\x86\\x94\\x90\\x152\\x91\\xc9\\xfasg"
  486. },
  487. {
  488. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa0#=\\xcf\\x91\\xb4m\\x84\\xa9\\xfet\\xe9+\\x80\\xe3o\\x15\\xd9@-\\x0c\\x0e\\x90@\\x84\\xee\\xf1]\\x12?sw\\xd6\\xbbb\\xb9i\\x99\\xb8/\\xa0\\xc7\\xe5.6\\x8fv't\\x06s>7zn\\xcf/\\xc9$x\\x1f\\xa5l\\x1e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc6 \\xec\\xc5\\x9cf\\x17u\\xc6d\\x1f;w\\x1f_~\\x1d\\xe9\\xd53\\x99\\xcb\\x98[j\\x17\\x03y\\xd6\\x08\\xf01\\xf9c\\x87\\xa7\\x198\\xce2\\x9d\\xf7t\\xad\\x0b\"\\xb5d"
  489. },
  490. {
  491. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9d=f\\x17\\x8d\\xaa\\xf3or \\xe59/\\xe1v\\xcek\\x1d:\\x1e\\x10<\\xe6\\xe1\\xfd<\\xd5\\xc2\\xa7\\xcct0\\xf7o\\x93\\xfei\\x08zq-x\\x93\\xd6i%[(r\\x1c$\\xb5w\\xb5i\\xfeo`\\x93\\x92\\x06\\x8f\\x0c\\x9a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x08\\xe3\\xef\\xde\\x05\\xd4\\xe5\\xf8\\xe5q\\x85\\xa0e\\xd8.\\x05\\xeb\\x81-\\xb6\\xb8\\xfan\\xf4\\x01\\xe7\n\\xe9\\x8e\\xac8!\\xae\\x8c\\xd1\\xdd\\x1a\\x04\\x97\\xe7 \\xe0mw\\xe0\\xb8a\\xe8"
  492. },
  493. {
  494. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\n\\xa1\\xaea\\xa1\\xe5z\\x96\\xd3\\x9b\\x01t\\x08\\xecon\\x04\\xa8x\\x9cy\\x87f\\xf3\\xdbb\\xa6\\xc4\\xd4\\x17\\x9e\\xb2\\x9f{\\xa5wm*\\xfa\\x18\\xa4\\x9c\\x11\\x86eb\\x89.0\\xb3\\x11\\x13\\xc9\\x00\\x1a\\xfdx\\xaem,\\x10e\\x8f\\x1c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000n\\x98l\\xaff\\x08n\\x91\\xea\\x98\t\\xed\\x04\\xd3\\xb5;\\xddk \\xfa\\x89c\"\\x91\\xe10i\\xf5z\\x8a\\xa2\\x9d\\xab\\xcb\\xa8\\x1f\\xfe4\\xeb\\xfc1\\xb4w$\\xeb_\\x08\\xe6"
  495. },
  496. {
  497. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x12w^\\xaa\\xe3|z=\\xceb\\xea;u\\xaec\\xa3\\x91\\xf1\\xb2\\x97\\xad\\xdd\\x87\\xfd\\xb5\\x0e\\xfd\\x8a'\\xc3\\x03\\xac\\x86\\xcd\\xe4z\\xc3x;jt\\xb0\\x86\\xcb\\x1c\\xe9\\x80\\x99\\x91\\xfa\\xfc\\xccj\\x1f\\xbf\\xa5\\xa1\\x9c\\xbaur\\x13\\x9b\\xf4\\xe6\\x9b \\xed\\xbd\\x9f\\xd08v\\xbc-m\\xa5c\\!#\\x81\\x1a\\xc0o\\xfe\\x8dr\\x0c\\xfdvv\\gq\\x86\\xef\\x96h\\xec\\x93\\xa8\\xa7-\\x11|nmk\\xc2\\xc5\\xd8lh\\xe1\\x8f\\xe8]a6\\xf8\\x9eo/+\\x1e\\xd0\\xa4\\x06\\x9fs\\xa3\\x1ev\\x1e\\xe7o\\x8c\\xa0\\xa12e\\xb2t\\x0c\\xa1\\x00l\\x9e\\xb4.\\x03>\\xf6=`\\xf8n\\x7f\\x93\\xb8\\xc9\\xb6\\x19\\xb6\\xd7\\xa3^yu\\xbe\\xe9\\xc1\\xe2\\xa2\\xdd\\xc8p\\x12\\x1e\\x98\\xd0\\x17\\xeb\\xce\\xaf\\xa4\\x95\\x06*f\\xcc\\x05?<xs\\xec\\xb2\\xca\\xee\\xa0v\\xdf\\xe0\\xef\\xb2\\xe7sj\\xbc\\x1a\\xeaw\\x95>c\\x9bsj\r\\x19\\x13i[\\xc3a\\xa6c\\x9e^i#6\\xd6\\xdc\\x13h\\x01\\xc5e\\x1a\\xef\\x0c\\xc9\\xe9\\xd3\\xcd\\xea\\x1d\\x9e"
  498. },
  499. {
  500. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\xbd\\xb8\\xa7\\x1b\\x02\\x0f\\x06\\xda<=\\x9d\\xd2\\xbb\\xc8\\xf8\\x1d\\x05\\xd0\\x00(\\xc7mt\\xa8\\xe4\\xdc\\x86\\xe0k\\xe6\\x98v%6\\x8d\\x01\rwwk\\x85\\xdc\\xeb\\xa4\\x06oi;\\x9c\\xa5=\\x05\".\\x11%5m\\xe3\\xa5\\x1c\\xca\\x06\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe0d\\xb5\\x92\\x13q\\x9e\\x9b\\xa3'\\xc9\\xc1\\xa1\\x85&?\\x9c\\x9e\\xc4\\xc3\\xe0\\x93\\xbbyr\\xaf\\xbcm\\xe7\\x1c\\xeb\\xb1\\xf3\\xeb\\xfe\\xf6w\\xb1j\\x0f\\x9au\\xa8\\x91\n[\\xf6\\xd9"
  501. },
  502. {
  503. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcb\\xec\\x17\\x17\\xed7\\xf5f\\xa3[\\xcf\\x88\\xdcd\\x98$\\x18y\\xad\\xff]\\xf4w\\xa6/\\x10\\xdb\\xa9\\xces\\xf4\\xbb>8\\xaf\\xd1\\xde\\<k\\xd7\\x89\\x99\\xea\\x06\\xbajn\\x8c|\\x07r;*:g\\xe0l\\x7f\\x16o\\x15\\xf6\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x12#3\\x0e\\x97\\xcem\\x16a\\x9cweum\\xf0\\xcey\\x12\\x85\\xad\\xd8\\xb7^\\xe4\\x94\\xb70,\\xa2i\\xcf\t+\\xf2\\xfcp\\xaf\\xe7t\\x93\\x8ad\\x9f&\\x00\\xf8s\\xf5"
  504. },
  505. {
  506. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x17$\"\\xacq\\xf0\\xfd\\xdb\\xe6\\x06?\\xb6i\\xff\\xe5\\x00v\\xc5\\x83\\x97+g\\xe9b\\\\x9e\\x06\\x01o\\xdf\\xc6,\\xb8\\xd00\\xc2\\x86\\x94\\x95\\x90\\x12\\w\\xa3\\xd6\\xd7\\xcd\\x8aj\\x18e\\xd2,\\xaa4\\x9a\\x01\\x0b.\\xab\\xa3\\xa3q$\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000/a\\xfb\\xc8\\xa8\\xabt%\\xc8\\xf2\\xd0d\\xfdj\\xe6o%\\xdfb\\xa3u\\x06\\x02\\x97r5\\xcdu\\xfev\\xec\\xa6\\x87\\x90\\x9f\\x03q\\x9ew\\x0f \\xd3\\xd4\\xa0\\x9a\\xfc}\\xd3"
  507. },
  508. {
  509. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x05\\xaaclq4\\xf4r%n?j\\x90u[,\\xe5^p]\\xea\\x95z\\x15u+8\\x07\\x9c`\\xce\\xf3\\xc7\\xe7v\\xe7\\x82\\xcb\r\\\\xec\\xd8\\xd7\\xe0rn\\x94za\\xdb\\xfb\\xd4\\xaf)\\x87lkh\\xd6\\xa1\\xfd\\xc9\\x9c\\xa6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x88\\x97\\xc7\\xa6\\x8d\\xf7\\x96\\xfe\\xd3}\\xdar%j\\x8c\\xe3\\xb3\nz\\xda!dm\\x8d\\x9c:y\\x0e:\\xf6z\\x12\\x18j\\x91\\x16^\\xde\\xfcjp\\xc7u\\x80v\\xb4\\xe1\\xcb"
  510. },
  511. {
  512. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\nh\\xb7\\xfb\r\\x8e\\xe5\\xe0\\x88\\x96\\xa42*\\xc1\\xd7\\x98\\x07\\x12-\\xee@\\xf6\\xd7\\x18\\x9f\\x1cxs@\\xfe\\xfb\\xee\\xbdos\\x05\\x12+\\x99a!\\xe4\\xa7\\x1ca\\xb1x\\xa7\\xe1h\\xe6\\x97\\xce:\\x12\\xda\\x18z+x\\x91\\x0b5\\xdai\\xbe<\\xcc\\xef\\xf3\\x16\\x98\\xee\\xbbv\\xf0c\\xd9\\xffpl[<\\xc2ff\\x96 \\x9e\\x1fp\\x9e\\xcexwj[\\x8f\\xd6r^\\xc0{\\xee\\x9fk\\xc1lo\\xbe\\x1bz/\\x8f\\xaf\\x86\\x9f\\xb4\\xd3h1msi\\x8d\\x7f\\x9e\\xe5nb\\xdd\\xe5\\xf2\\xb7\\xa1\\xf3\\x12$\\xc7\\xef\\xb5\\xf1\\x86\"f\\xf3\\xbe\\x86\\xadmt\\xce\\x96uy\\xdb\\xced\\xceu\\xd8\\xbb\\xbd\\x03$u\\l\\xd4\\x13?+\\x1fz\\xc6s\\x07\\xa2q\\x99{\\x064\\\\x97\\xb2v|\\xbdc\t-\\xd4\\xd61p\\x03\\xf9g\\xbb\\x8a.nr\\x0b\\x19\\xc5\\x11}\\xc1\\xfc\\x0cv\\xf0\\xc1u\\x9dog\\x89\\xbc\\x9c\\x9c<n\\xa0\\xde\\x07\\x81\\x04\\x83\\x04\\x1d\\x93\\xe6\\xa9\\xd8me\\x9a`\\xfb\\x99\\x06\\xda\\xd6\\xa9\\xd7\\xb6\\xbf\\x14"
  513. },
  514. {
  515. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010$\\x00v\\xf9\\x18\\xcc[\\xf9\\xfb\\xf0\\x07\\x17\n\\x08v\\x94\\xc2\\xe7\\xca */\\xef\\xc1~g\\xba(\\x80d1@\\x85'\\x8c\\xa5\\xfa\\xb5c\\x0f\\x88\\x00d\\xde\\x11u\\xd8>?\\xf1:\\xd8h\\xadl\\x1c\"\\x8e\r\\xc3\\x89\\x92m\\x91\\xbda4\\x1fs6\\xc0\\xc8\\x07q\\x1e\\x94l\\x97nbe\\1\\xea0s\\xf9\\x15\\xc5\\xb7\\xc1x\\xe6\\x17\\xa1\\xa11\\x01^\\xb1\\x18\\x9a0\\xb78\\x90\\xa5y\\xde\\xba\\x1c\\xe0\\xc8\\xc7\\xd3\\x9b\\xa7\\xfd\\xbd\\x90\\xced\\x9c\\x16\\x9f~\\x84\\x07r\\xac\\x00\\x10\\xa3k\\xd4\t\\x9atb\\xd6\\xa6\\xffc\\xaa\\x16\\xdbuc$\\x95\\x82\\xafd1\\xd4\\x97\\x87\\x90\\x98\\xce\\xda\\xe7\t\\xd3\\x93,2\\xdb\\xd6b,\\x15\\x91|\\xf7\\x15dxs\\xb8c9\\xb8\\x1fu$\\xa1\\x07\\xb0|\\x92\\xea\\xe0\\x84\\x9ds\\x02\\x9b\\xb8i\\xe5\\xe6\\xfd\\xbc\\x17\\xae\\x1fau\\xc0\\x80\\xe2\\x98\\xcf_\\xe7\\x93{e\\x1a\\x12\\xe6\\xf2\\xdd\\xee\\xb9\\xe8\\xe7=^%s\\xc6\\x026zf\\xf4\\x83\\xc5\t\\x0b\\xca_\\x0b\\xb2ij\\xe9\\xb2\\x1b"
  516. },
  517. {
  518. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010uhl\\xeb\\xfd&\\x1al\\xe4\\xf5\\x17<\\xf3\\x8f\\x88}\\xf0\\xceq\\x90\\xfds \r\\x90\\xdd\\xf2h\\xae\\xfe\\xf0\\x9a\\x04#;s\\xee\\x0ctc\\x0f\\xcf\\xcfp@}@\\x92\\xc97\\x8d\\xcc\\xeb\\xa3\\xf8=\\xbe\\xe5\\xe5s\\xec\\x94\\x92\\x87\\xef\\xc2\\x986m\\xab\\xafa\\xd9h\\x04\\xb4o\\xe5\\x85\\x92\\x9c\\xc2>\\xf0\\xae\\x1d\\xb3}~\\xe0$6'\\xc84s\\x8e\\x83\\x99\\x83\\xf9\\x99\\xf0\\xf1\\xc3\\xfdo%-\\x96\\xb5\\\\x97\\x12\\xc7\\xe3;\\xa9 \\x1c\\xc6\\xbd~pxh\\xd6\\x0b\\xe5ks\\xc97\\xac/\\xd3\\x88`<4\\x14\\x01dpcwo\\x14\\xb3\\x18\\xae-\\x7fp\\xe7\\x15p0\\xcb\\xc3\\xa6\\xa8\\xbd\\x83\\xce\\xa3\\x8b\\x9fun{\\xce\\xbc\\xe8x\\xcf\\x87/\\xb3\\xa3\\x00u\\xd5pe\\xb7\\x9c\\x8bxxv\\x19\\xc9\t\\x06\\x18\\x8eygz%\\xda\\x9f\\xe4c\\xceo\\x8bpa\\x1ey\\x8bb\\xf7\\xc6mz\\xd3g\\xd2\\xef\\x9b\\xb4u\\x1d\\x0b\\xa7\\x02\\x9c\\xd6\\xda\\xec\\xc8x\\xf4\\xc9\\xec\\xd281\\x95\\xcf\\x8ez\\xd4\\xb14\\x89\\xa3\r"
  519. },
  520. {
  521. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010[\\xcbt\\xe72\\xd1\\x96\\xc5\\x8b\\xb0\\xca\\x99\\xea\\xa4\\xf2\\x8f}e>\\xb4\\xcf\\x8f\\xe4\\x00v\\xe3\\x03kn\\x18\\xe2z\\x05\\x16e\\xebd\\x8b\\xb5\\xdeswn\\xa9\\x08\\xa9\\xaa\\x12\\xe1\\xbd\\xd0s\\x04`%\\x02_!\\x8edgg\\xb3\\x14vi\\x87\\x11\\xf6\\xff\\x9bi\\x81\\xaa\\x8b\\x81\\x01n\\xf9\\xc4\\xc6l\\xb1\\x02\\xd7\\x7f\\xd6e7+\\xcd\\x15&\\xf6\\xeer\\xb2\\xde\\xa2\\x11\\x16\\x81bo\\xaa\\x01\\xf3\\x90\\xf6\\xf1pac\\xe9_\\xf1\\xebb\\xc8\\x18\\x9b\\x18\\xddp\\x0c\\xecv\\xf2\\xf7\\x03\\x87\\xd1\\xde?\\xf9\\x04r9\\xa3\\xb3\\xa2\\xa0)\\xda\\xdfdl\\xbc\r\\x8a\\xbc\\xf6d\\xc4`#\\xca\\xb3\\x8b\\xc8\\xdc\\x80 \\xa7\t\\xbd\\xc8\\x82\\xdcd{7\\x9d0\\xde/dcfk\\xf9\\xdd\\xb0\\x97\\xe8\\xae\\x93\\x0b1\\xcb]\rb5\\xbe\\xcb\\xfd\\xfa\\xb0#4\\x86\\xb8\\xf1ba\\xeb\\xbbm\\x89\\x1f\\x1fz\\xbc\\x17\\x91w\\xf1\\x90\\xa1\\xa7\\x89\\x9e\\x14\\xf9p\\xd5uq\\x07\\x9f\\xe7<`r\\x98\\xd7s\\x9d'_\\xd3g\\xb6\\xc0\\xd8;\\xb2\\x9a^\\x91"
  522. },
  523. {
  524. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbd\\xad\\xfd\\xab8k\\x1de\\xb1g\\xdcj\\xcb\\x03\\xe7\\xe7\\x1cvs\\x8f\\xb2\\xf4\\xd8\\xb6k\\xa1p\\x993\\xd5\\xb2\\xf5\\xdb\\xf2\\xe0\\x98\\xf1\\xadz?f\\xff]\\x9bj7\\x9d+\\xb67j(\\x9b\\x7f\\x86v\\x13\\xa0=0)\\xb8{\ridb\\x08&g<\\xef$>\\xc9\\x8c\\x80\\xd8f\\xfe\\xc1\\xb6\\x04n\\x85\\xd4\\xb0\\xf1t\\x15u\\xe0\\x82\\xdbvu\\x8a\\xfd\\xa9.\\xa9\\xd1\\xe6\\xd6\\xe9\\x1a\\xcd+\\x94\\xbf\\xef\\xd0\\x05\\xb0\\xdf\\xae'\\x96\\xf9\\xd2\\x00\\xe4l\\xcdd\\xfao\\xcf\\xba\\x90\\xa6]4\\x8ci&\\xf4\\xc8e\\x87\\x89o \\xbc4scz\\xcc\\x83\\xf0\\xed\\xc1\\xc9\\xff\\xa6a\\x8bx\\xe1\\x02\\x8b\\xee4>\\x0e_\\xbc\\xe0cye\\xca\\x1a\\xb3myq\\xa9\\xd1\\xd9\\xfa\\xbf\\x0ew\\x03\\x1d\\x0fv\\x13\\xec\\x16q\\xcc\\x98tf\\xa0q9\\x99\\x8c\\xd0m\\xc5\\xeb\\x12 ld\\xde\\xa2\\x8b\\x1f\\xfd\\xf9\\x95\\xb5\\x08yk\\xc3\\xdcr\\xa1f\\xd2\\xa9g\\x03\\xea\\xa1\\xccr\\x19\\xf3\\x04\\xda\\x92\\x1a\\xbe\\x8e\\xe0\\x94\\xbb\\xc7\\xf8g}\\x17\\x86"
  525. },
  526. {
  527. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xccu\\xab\\x95whe%\\xab\\x11\\x01\\x9ab\\x1a\\x8d>0\\xb1\\xac\\xc0\\xe6\\xf9\\xf5kih\\xf6gs\\xbc>\\x9b<#\\xed>\\x0b\\x1ao\\x0e#\\x0e\\xfe\\x92n&3\\xcc\r\\x1c(tb\\x14\\x13\\xb1}\\xaey\\x15\\xb3s\\x9f\\xd5\\x93[\\xe5\\x1c\\xca\\xa6l\\x10\\x08\\xb2\\xb1y\\xc3\\xd0\\xd8_\\x92\\xf1\\x19\\x06\\xb25\\x19\\xd0\\x8e\\xbd\\xae1\\xd0h\\xf9\\xdb\\x86\\x14f\\x84\\xd0\\x89og\\xa8\\xf6y\\x82\\x04\\#\\x84\\x0c\\xb0\\xfc\\x92tn\\x80\\xa1\\xcc8\\x04\\x92`n\\xbe \\xb7\\xc1k\\x89\\xc1\\x80\\xc2\\xb58\\x83\\xae\\x9fo0\\xc5?\\xbc\\x88\\x9bl\\xd8\\x16\\xf05\\xf4\\xd1$\\xdf\\xffs\\xb5\\xcd\\x10d;\\x0b\\xc2\\xbe\\x99-\\x82\\x92\\xf5n\\xa2\\xa9\\x13\\xc0\\xda\\x1bb\\xaf\\xc6\\x07\\xf8\\xdd\\x0el\\x92x\\x03\\xf1n\\xe1\\xa5\\xf4w\\xbdl\\x92g\\x00\\xa9\\x8dt\\x11\\xb03n\\x08\\x03\\x95r\\xafe8]\\xc7\\q\\xc9\\xc1\\xe2ot}\\x86\\xc2f\\x8a\\x85\\xe86tms,a\\xdao\\x8e\\xcbz3`_6#\\xe7\\x85i\\xbe\\x9d"
  528. },
  529. {
  530. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbaqb\\xc6\\xef\\x9d3s\\xad\\xd9\n\\x95\\x89\\x8f\\x85\\xf9\\x92ws\\xb1\\xc2\\x99\\xec\\xd7qwg\\x8by\\xea\\x9d\\x11\\x1al\\x9e/\\x15@7\\x89\\xe8\\x9e\\x8a\\x14\\xd4\\xe3\\xc5e\\xae\\xe8\\x03\\xcbo\\xe2e6<\\xd4\\x91\\xb9\\xf82t\\x99\\x0c\n\\x7f\\xbb\\xc6\\xb1t\\xea\\x12\\xd0\"\\xcc\\x0c\\xe9;@#\\xae\\x1a\\x92\\xe2\\xd2}(\\x9d2i\\x8e\\xd7\\x04\\xae\\\\xa5\\xd2\n\\x1dy\\xdd}n\\xaf\\xfbi8\\xfa\\x1b!\\x0c\\x98\\x15\\x1f\\x88s\\x02\\x1a\\xf9\\x8e\\xb4\\xe7\\xb4:\\x1c\rqr\\xe0ive\\xff\\xc6%#\\xca^8\\x96\\x9e\\x16\\xb0r\\xf92h\\xe2:\\xf9\\xe4\\x03\\xd8\\x8b\\x19\\xb5\\xd8_k\\x1c\n\\x9f\\x98\\xc4s\\xbe`\\xd1#=\\xa2$\\x97&j;\\x1ec$2\\xecg\\xc5\\x0b4\\x0b\\x93\\\\x82y\\xec\\x0f \\x1e\\x18\\xc8\\xd1!%\\x87\\xdf\\xf69\\xf7\\xbc!;\\xf7sz\\xfe\\x82z\\xee\\x97c\\x98x\\xdd\\x9b\\xea\\x85\\xecm\\x06r\\xf910~\\xdf3\nf'eevbs\\x81\\xfemmq!\\xc6\\xac^q"
  531. },
  532. {
  533. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\xf54\"\\xc1\\xe0\\x91\\x8d\\xed.\\x16\\x1d\\x8c\\\\x06\\xb9_\\xac\\xbd\\xc9at\\xcf\\xa1+a\\x15\\x07\\xf4%\\xe0y\\x98v|$]\\x16x\\xd5\\xd8o\\xaf\\x86j)\\x8eq\\x03&\\x96\rk\\xfc\\xe5\\x15|6\\xc6\\x1d\\x7f\"&\"pz:\\xb1\\xfbyn\\x8f\\xd6a\\x95\\xab<\\xc5\\xf9\\xfcgo\\x1a\\xe2f\\x9a\\xd21y\\x04\\xde\\x15o\\x17\\x80\\x8fc\\x9ei\\xcd<i\\x14}ja\\xc0\\x02\\x95\\xfcx\\xb4c\\xd5\\xb7~\\xc1\\xe3h\\xbe\\x8ds\r\\xef\\xa1\\xa5@\\x7f\\xe0k\\x1b7\\xbb4t\\xc4\\xfe\\xec\\xaf\\x9b\\x93\\xf7+\\xbf\\xd0r\\x1b\n\\xe3\\x8e>r\\xf0\\xe5\"\\x8b\\xa6r\\xc6d\\x87\\x7f%\\x98m:\\xccw\\xf3k\\xf5\\x01\\xc5k(\\xb1l\\xfcdg\\xf5\\xd8uq\\xc6\\xac\\x0b\\x9d\\xe6%\\xf9\\xd3\\x84\\x0c\\x19\\xecl\\x1d\\xda\\xfb5ra\\x0b\\x81e\\x93\\x05[2\\xcc\\xb9\\x03\\xa9\\xbd\\x19\\x9b\\xcb\\x9f\\x16\\x94\\xba\\x11\\x1a\\xe3jf\\x08\\xa6\\x81\\xad\\xab\\x9e\\xd1r\\xcd\\x15\\xf3\\xe7\\xa6\\x1a\\x84\\xb7\\xdbh}\\xbfr\\xdd\\xfa\\x0e"
  534. },
  535. {
  536. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x95\\x86\\x8am\\x08\\xcf\\xd1\\x9d#\\xdd\\x17\\x1c\\x1d\\xbd\\xa5?g4\\x99\\xc6r\\xdcs\\xac*\"`k\\x02\\xb7\\xf4o\\x16u\\x1f\\xeb*\\xba\\xb1\n\n\\xca;mz\\x13%o\\x9ed[\\xad1|\\xd7\\x86\\x0f\\xaf\\x92t\\xf6%\\x98\r\\xe3\\xe3]!\\xff\\x06\\xa9\\xd9pu\\xab\\x16h\\xcd\\xd6\\xea\\xbd\\xb2>j\\xb5\\xbf#h\\x9dla\\xbab7\\xa3\\x93\\x16!4\\xcc\\x1f\\x9a\\xfa\\x8f\\xd0\\xd9kv8\\xb5z\\xc8\\xa4z\\xf6\\xca\\xed}\\xf8ex\\xedw[\\xda-\\xa1\\xbc\\x10\\x94\\xf9\\xa9\\xc14*\\xa5\\x87\\xfa\\xda\\xbc?\\xe9\\xdd\\xe6\\xe8\\xe3\\x8dn\\x93\\xa7\\xc4\\xb2sxf\\x12\\x06\\xa7f\\x9f\\x12\\x98s\\x07\n\\x13\\xde\\x86\\xf5\\x16{ \\xa3\\xc9\\xa5\\\\xd9r\\x89\\x97\\xc1\\xf8\\xb1\\x11\\x17\\xf8=x\\xba\\x18\\x16\\xab\\x16v\\xa6\\xc4\\xaff%\\x17l\\xf9w\\xda\\xf2\\xe4\\x98\\x85y!\\xaf\\x06uc\\x05(\\x16i.\\xb7\\xf5)o\\xbc\\xa0\\xbb@\\xe2\\x8dp0\\xbb\\x97\\x06\\xa6x\\\\x04o\\x97\\xdbn\\xe4gs9\\xcev\\xbec\\xa0"
  537. },
  538. {
  539. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010[)\\x19@\\xa1h\\x1d\\x9dg\\xaais\\xa5\\xa7\\xfd\\x98\\xd0i\\xdd\\x10\\x82\\x8e\\xe6\\xa6k\\xf6o\\xb7\\xa7\\xf4}\\x95\\xef=\\x161\\xd6\\xd2\\x89f\\x99q'i\\xea\\xe2\\xd0p\\x81\\xfd\\xf4g?,gh1i\\x87\\xa7\\xbb\\xd9x\\x10\\xe3\\x878\\xfbom\\xb2r\\xae\\xfa\\xe0\\xce\\xd3,\\xd7\\x02t&r\\xed.\\xe3{\\xab\\xdb\\x88\\xc1\\x17\\xeb\t\\xab\\x15\\xec\\xe4\\xd6h\\x9f1\\xba\\xbc\\xa4o!b\\x13\\x82h\\x82o\\x13\\xb2\\xca\\x14w\\x19a+'\\x98\\xeb\\x0cv\\xdas\\x9e\\xd4s\\x8a\\x8c\\x06\\x06gl'z-\\xc0|v\\x8d\tp\\xc2\\xa8jau\\x7fpb\\xa0\\xd0hl\\xac\\x8a\\x98\\xa1k%\\xaes\\xc1j\\xa6!q\\x81\\x13&\\xd2v;\t\\xec(p\n\\x0b\\x98&\\xce\\xce\\xd0q\\x1e\\xc2*\\xf9m\\xf3\\x87\\x9f8p(\\x1a\\x06-k\\xb3ee)h\\xfb,\\xcaz\"\\xd4\\x82\\xce0\\xf1bw^\\xb2p\\xe1\\xff\\x9c\\x9b)\\xb6~s\\xdfm\\x96y\\x9d\\x0c\\x08\\xb6\\xab\\xac\\xa8\\xf7~m$\\xdeg\\xaa\\xcc"
  540. },
  541. {
  542. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaf\\xd4\\x1c\\xcd\\xe7hyk\\xbf\\xe5s\\x02\\xd6@j\\xc5\\x9e5\\x93\\xef\\x01\\xde\\xbc\\xcc\\xaa\\x14\\x88\\xcd\\xadl\\xe87\\x131h\\xd7\\xe9sz\\xa0;ei\\x15l\\xd5\\xef\\x17\\xd3\\xd6\\xd3\\xca\\x8a\\x88l\\x9f(\\xf6\\x08j~\\x98\\xd7\\xfc\\xaa\\xddkt\\x1f\\xdf o4ph\\xc1,`=*\\xd1f\\xaen\\x1d\\xeb<\tf\\x1f\\x10\\x93\\x7fw\\xb3\\x93p3\\xc14\\xce\\xd4!?y\\x85[\\xf7\\x05tg_6\\x8b\\xf7&'6\\x1ar\\x12'\\xd09g\\xc0\r\\xcfi\\x06o\\xe7r\\xae\\xb4\\xf5\\xcc \\xbee\\x99\\xa9\\xcby\\xdc}\\xb6\\xd5%\\xffu34\\xb6\\xb8\\xd81h0\\x82\\xb1a\\xb7a\\x036p\\x99m\\xe7\\xd1\\xc6\\xe5\\x18\\x97s|a\\xc3u5\\x91\\xf5&\\x99\\x81\\x0b\\xd39\\xd0\\xed\\xee\\x87e\\x91,\\x8c|p\\x8a\\x98\\xa7\\xa4\\xbb\\x02\\x12\\x1d\\xc8\\x9b\\xb7tt,\rg\\x05wff\\x0e\\x14\t[(\\xcc\\xfa\\xf7\\x14\\xbe\\xc96\\x08\\xda:\\x08\\xf0\\xb4nk#2\\x80\\xa3\\x91jx\\xd9f\\x00\\xdf\\xa0"
  543. },
  544. {
  545. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x07\\xcce\\xdf^\\xe3jq\\xc8\\xa9\\x0f\\xc4\\x01\\xfap\\x98\\xf0b\\xc8)vlh3\\xf9\\x7f\\x7f\\xfa3s\\x07\\xf8\\x0e\\xd6m$\\xf4\\xfc\\xdek\\x97\\x9d\\x7f\"\\x0e\\xd9\\xf5z\\xf1au?\\xf7\\xb5e\\xe1\\x86\\x9f\\xc0\\x16\\x0e\\xcb\\x1c\\xe1c\\xbb\\xa1:\\x920\\xe1\\x98\\xa3u\\xe5va?\\x91|\\xcf\\x81yeh\\xd6\\xcd\\xf4\\xa5\\xb5\\xe8\\xe3\\x83\\x9c$,\\xcb\\xba\\x86g\\xf2\\xde\\x91[\\x0cm\\x1a\\xc3\\xdc-\\xeang\\xcb\\x1d\\xca9jox\\xcb\\xc0\\xd6\\xae\\xbe\\xa0\\x15\\xd9y\\xc9\\xd7\\x8f\\x08_\\x01\tp\\xe6d\\xe1d\\\\x11\\xdc\\x7f\\xff\\xf2\\xd7\n\\x9d\\x16s\\xf1c\\x83^\\xc4r\\xc5\\x1e\\x81f\\x96\\xca\\x14v\\xc0\\x98\\xc1\\xd9\\xd6\\xf6\\x07\\xda\\xea\\xfa4\\x05n\t4\\x85\\x02\\x89\\x9b\\xe5\\x85q\\x94\\x01a{\\xc3\\xec\\xadeg=\\xfc\\xc3\\xde\\xee-\\xf6\\xba%1\\xbc\\x14m~\\xb6q2\\x00\\x1c\\x998*<\\xdac\\x12\\xc3\\xd6\\x91\\x897\\x93\\xfe\\x97y\\xddx\\xc4|@[\\xc2\\x01\\xe0\\xf0\\xf2\\xd7\\xe1*u\\xd1\\xf8\\xdb\\xe1"
  546. },
  547. {
  548. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010[\\x8a\\xb6\\xb9\\xaa\\xab\\x0e\\xf0w\\x8ekw\\xd9\\xd1\\xde\\xba\\xdc\\x86\\x8a\\xb5\\xfa\\x8f\\x9fp\\xe1\\x88\\xa7\\x84\\xe2b\\x89p\\xce\\xa0\r\\xfe\\x8a\\xec\\xad\\xb9\\x0f\\xb4\\x8ed\\xbb\\x07q\\xda\\x01\\x07+\\x94\\xcc]>\\xa0[\\xcc\\xb7\\x0f\\x00\\xdd\\xde\\xed\\x18<:\\x02h\\xbc\\x80\\x100z \\xeeq%\\xdd\\x10\\xff\\xcfx\\x80\\xcfm\\xb0p\\xf3\\x98m\\x01\"\\xe9\\x8fh\\xd2\\xa3\\xc1\\xa9\\x92\\xcc\\xc8\\x9c*\\xe4\\xc7\\xdd\\xc1w\\xea@\\\\x0e<\\xac\\xb5\\x8d\\xeb\\x99\\xd9 wdl\\xb8l\\xfal\\x10;!d08\\xe6\\xfcd\\x85e{u\\xad\\x9f\\xd9r\\x99~(q$ \\xb1:\\x8c\\xf0\\x84-:\\x9d\\xdc\\xa4f\\xa1?\\xf9\\x07\\xc0\\xe5\\xc5\\xf6][940\\xcfy\\x93\\xb2\\xc0/7\\x19?\\xea\\x08\\xb4\\x1d\\xad\\xc3\\x18\n\\r\\x9a\\xbfbr\\x0f\\xe5r\\x8a\\xdb]\\xbb\\xab\\x81c`\\xe0i\\xfc\\x88\\xf6dq\\x14\\x8d lg\\xfav\\xeb\\xfc3\\xa1j\\xa1\\xd9\\xc7\\x01 z\\x04\\xb1{]\\xde$\\x90\\xd6\\x9f\\xbd}\\x14\n7\\xbc\\x8e"
  549. },
  550. {
  551. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xde_i\\xfe\\xa2\\xbex\\xf9[pv\\xf1\\xad%\\xcbi\\xe9^\\x17\\xb0\\xe3*\\xa6*ytc\\x11t\\x9d\\x16lg4\\x96\\x8f\\x81\\x84m?i\\xd2\\x11\\xaa\\xd3e\\x01&\\x04\\xff\\xa3h\\xa6\\\\xca\\x91#\\x9a\\x16w\\xd47<\\xe4\\x06\\x1c\\x16\\xc3\\x87m\\xe5\\x1f)\\xc8av\\xdc\\xe5p\\xe8oz\\xc8\\x15-h\\x10\\x05\\x82\\xac\\xa5\\xa3j\\xf2\\xdc\\x0bw\\xfd%\\x04>ix\\x98\\xb7\\xee\\xece#\\xc7\\xa0\\xcd*\\xcf|u\\xfa\\x9f\\x88z$h~\\x87\\xaf\\xfc\\xca\\xabw\\x96\\xa5\\xcd\\xed<1\\xb2\\xc4?\\xd6z\\x90\\xf2\\x8d\\xe5\\xec\\x8d\\x94\\x92\\xe9_f\\xedt\\x03\\xd6\\x9d\\x92!c\\xd4\\x15\\xee\\xb5z\\xcb\\xb9\\x03\\xe2\\xfd\\x03\\x1ej\\x01u}\\xc46\\xf5@=h\\xb8\\xf0m\\xf2\\xf9z!\\xee1\\xee\\xd3&00\\x81`\\xeaq\\x9a\\xfb\\xd9\\x17\\x15\\x92dwe\\x0c\\x9bo\\x98\\xbd\\xe1 \\x94?\\xa8z\\x01\\xf2\\xd8\\x0c\\x04\\xc0\\xd5w\\xf1a\\xe4\\x8b&\\x85\\xe7\\x92>\\xce\\xe1\\xae2j\\x8c\\xb0[\\xa5fq\\xaa\\xd5\\x8fe"
  552. },
  553. {
  554. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  555. },
  556. {
  557. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xa1\\xf2\\xa0}\\xfe\\xc4\\x95)\\x7f\\x15t\\xf4[w\\xd2u9\\x17\\x1ap\\x8f\\xab\\x9e\\xbc\\xe8\\xea\\x8e\\x97\\xca\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  558. },
  559. {
  560. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xb0\\xa1#\\x12b\\xe1\\x92g\\xd4\\xd1}\\x04vsd\\x12\\xb4\\xc1\\x91\\x93\\x04\\xe1\\xdab\\x1e@\\x82-.\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  561. },
  562. {
  563. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x95\\x85\\x04\\x96\\x82\\xd7\n\\xd7lzf\\x06\"_`j\\x18vk\\x82\tl\\x93t\\xdcfs\\x1b\\x92d\\xd5w\\xa2\\x85\\xafm!\\x0e;q\\xbf8\\xda\\xdc8\\xbf\\xbd\\xb6\\xca\\xb6\\x0f\\xea\\x81\\x08\\xfd\\xf6>\\xe0\\xba\\x92\\x8cg\\xae\\xd3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x7f\\xf9\\x9d\\xdc\rb\\xfa>&\\xf6\\x08i\\xbc\\xb4+\\x1e\\x0e>\\x00\\xd2\\xff\\xc9\\xc7\\x13?\\xf9]*z~\\x85\\x91\\xc8\\xb3#n(\\x9e-[\\xe3\\xf5\\ \\x81\\x96\\xc5\\xf4"
  564. },
  565. {
  566. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf4\\x1f?j\\x85\\x95il\\xeam\\xe9\\xf4\\xb6\\xa3\\x91s1e\\xe4\\xf5\\xc3c\\xa1\\xc9-\\x9dk\\xfa_\\x145{\\x1a\\xeag\\xf1.,!,\\x05m\\xae\\x91\\xcd\\x14xj\\xfb\\x12n\\xfb\n\\x7f\\x05\\xe6\\x07w\\x08\\xf2v <\\x16\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x82\\xeeg\\xbb\\xa1=g\\xcb\\xc7\\x83\\xedd\\x98\\xdbyqa\\xe8c\\xc0\\xe6\\x12\\x95\\xe3\\xf9}\\x044\\xca\"a*\\xef\\xd5b\\xec\\x14\\xad\\xc9_\\xd2$a\\xea\\xc1\\xda\\x00\\xed"
  567. },
  568. {
  569. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010abz\\xf5\\x00\\xf2\\xe5\\xd9\\xe4\\x02\\xaf\\x05k!\\x82\\xc2o\\x1e\\x9c\\x95\\xbc'\\xf08k\\xc0\\xdb\\xaa\\xaf\\x8f0\\xd0\\x87\\x8a@\\x9d,3\\xa8\\x917\\x92\"\\xb4`\\xde\\x1ag\\x87\\x96\\xfbj\\x89\\xef\\xbaj\\x8b\"\\xf4\\xcf\\x96\\x89\\x16\\xd2\\xa1\\xa8y\\x96o\\x9d\\x0f(\\x1f6\\xc1(\\xc1\\xa1q\\xd3\\xc68&\\x19\\x9d\\x99\\x92\\xad>\\x84\\x16q\\xb7\\x11\\xb6\\x90\\xdd\\xf7'7\\x14\\xc1\\xf3\\x8e\\xb4\\xbf9-\\xcebs\\x80]\\x85\\xf0+7\\xd5m\\x11<v8\\xac+\\x12\\xaem\\x99\\x10\\x16\\xef\t\\xdd\\xd2\\x0b<(\\xa3\\xc3\\x07\\xf6\\xe1q\\x7f\\xaf\\x80k0\\xbe\\xee\\x16}\\xfe\\x11\\xb6\\xc3@\\xf0\\x00ea\\xc1\\xd9\\x8bh\\x96\\xee\\x97\\x86\\xda2\\x11\\xb8wk\\xf7&:\\x14c5\\x08\\xf2\\xa0_ux\\x9c\\xcb;bpe\\xbc\\xa1\\xcb\\xd6)\\x8eh<t\\xfc\\x93p\\x86w\\xb0`-)%\\xbf\\x05\\x05q%\\x83\\xdd\\xd9h\\x00w2\\xf1fc\\x02n\\x0c\\x9c\\xb0\\xcf\\x99\\xe3:\\xa0\\xbe\\x9d\\xb8$\\xac|\\x92t\\xb91d>u"
  570. },
  571. {
  572. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc7\\xb2\\x14\\xd1\\xdd3_\\xa9&a\\x06b\\\\x0b'_\\xf7<ps\\xb9\\xe0\\x9b\\x0fd\\x14u,5_\\xf6t\\x96$\\x8c\\xf8\\x15\\xb1v\\xe6\\x05.<\\x8f3\\x1b\\\\xb8l\\x1f\\xae\\x18\\x80`\\xb0l\\xd4\\xb5y\\xb5\\x82\\x7fu\\x9e\\x13\\xacu\\xea!\\x0fe\\xa2\\xff)\\x1e\\x7ff\\x94\\x0f\\x7f\\x19.xy\\xa5\\xb3^(\\xa2<\\xc0t4\\xd4cq\\xd8\\x95\\xfc\\x06\\xc9'\\xe9\\x04\\x7fp\\xad\\xee\\x98el\\xf3\\x8f\\xcf\\x8e\n\\xbc\\x1e:\\xc2\\x06\\x07\\x99f\\x9b\\xc3a\\xa0\\x01^\\xe8^\\x85gr\\xf7\\x05\\xeel9/\\x18\\xbc\"\\x9b\\xcc\\xafj\\xe4\\x96c\\x8d\\xcb\\xee\\xc7\\xca(\\xa8\\xc0\\xe5\\xd1\\x01\\xaa7\\x97\\xc8y\\x13\\x00\\xe6 dd\\x91\\xe2c_g\\x92\\xa1\\xb25-\\xba\\xc0q\\x99!_\\xa3\\x83f\\x17\\x90\\x0b\\xe4\\xf9\t\\x06`be\\x8a\\x03\\xdd\\x01\\x8a\\xd2\\xb83tt\\xd1q\\xe1\\xf5\\xfb\\xa2\\xe1\\x1e\\xc3;{\\x84^:\\x01m\\xec\\xd8w\\xf7y\\x10\\x88}\\x1cj\\xed\\x8b\\xf2b\\xe3\\xf0\\x06!\\xe3\\xc7\\xa4\\x86\\xd8"
  573. },
  574. {
  575. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsofttimestamppca.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 16 feb 2019 02:02:49 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  576. },
  577. {
  578. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: wed, 01 may 2019 05:01:31 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  579. }
  580. ]
  581. },
  582. {
  583. "Description": "File has been identified by 28 Antiviruses on VirusTotal as malicious",
  584. "Details": [
  585. {
  586. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  587. },
  588. {
  589. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  590. },
  591. {
  592. "McAfee": "Exploit-CVE2017-11882.bx"
  593. },
  594. {
  595. "Arcabit": "Exploit.CVE-2017-11882.Gen"
  596. },
  597. {
  598. "NANO-Antivirus": "Exploit.Rtf.Heuristic-rtf.dinbqn"
  599. },
  600. {
  601. "Symantec": "Bloodhound.RTF.12"
  602. },
  603. {
  604. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.C"
  605. },
  606. {
  607. "Avast": "Win32:ShellCode [Expl]"
  608. },
  609. {
  610. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  611. },
  612. {
  613. "BitDefender": "Exploit.CVE-2017-11882.Gen"
  614. },
  615. {
  616. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  617. },
  618. {
  619. "Sophos": "Troj/RtfExp-EQ"
  620. },
  621. {
  622. "F-Secure": "Exploit:W97M/CVE-2017-0199.B"
  623. },
  624. {
  625. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  626. },
  627. {
  628. "TrendMicro": "HEUR_RTFMALFORM"
  629. },
  630. {
  631. "McAfee-GW-Edition": "Exploit-CVE2017-11882.bx"
  632. },
  633. {
  634. "FireEye": "Exploit.CVE-2017-11882.Gen"
  635. },
  636. {
  637. "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
  638. },
  639. {
  640. "Cyren": "CVE-2017-11882.E.gen!Camelot"
  641. },
  642. {
  643. "MAX": "malware (ai score=82)"
  644. },
  645. {
  646. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  647. },
  648. {
  649. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  650. },
  651. {
  652. "GData": "Exploit.CVE-2017-11882.Gen (2x)"
  653. },
  654. {
  655. "ALYac": "Exploit.CVE-2017-11882.Gen"
  656. },
  657. {
  658. "Zoner": "Probably RTFObfuscationD"
  659. },
  660. {
  661. "Ikarus": "Exploit.CVE-2017-11882"
  662. },
  663. {
  664. "AVG": "Win32:ShellCode [Expl]"
  665. },
  666. {
  667. "Qihoo-360": "virus.exp.21711882.d"
  668. }
  669. ]
  670. }
  671. ]
  672.  
  673. [*] Started Service: [
  674. "osppsvc"
  675. ]
  676.  
  677. [*] Executed Commands: []
  678.  
  679. [*] Mutexes: [
  680. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  681. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  682. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  683. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  684. "CicLoadWinStaWinSta0",
  685. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  686. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  687. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}",
  688. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000"
  689. ]
  690.  
  691. [*] Modified Files: [
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\Purchase.doc.3",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\~$rchase.doc.3",
  694. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  695. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{1D231B3C-0E19-4215-B93D-80A797F919FF}.tmp",
  696. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  697. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  698. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  699. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4BE.tmp",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4BF.tmp",
  702. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{52DFF9CC-D41C-4466-A760-3FE66B1BA6A9}.tmp",
  703. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF20.tmp",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF21.tmp",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF80.tmp",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E37.tmp",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\cab231A.tmp",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\cab232A.tmp",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\cab235C.tmp",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\cab234B.tmp",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\cab288E.tmp",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\cab232B.tmp",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\cab288D.tmp",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\cab288F.tmp",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\cab28AF.tmp",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\cab28C0.tmp",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C0D.tmp",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C0E.tmp",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E23.tmp",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FBB.tmp",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E22.tmp",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FBD.tmp",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F8B.tmp",
  725. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FBC.tmp",
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FBE.tmp",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A9D.tmp",
  728. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3E86.tmp",
  729. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3E96.tmp",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3EA7.tmp",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\cab41C5.tmp",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\cab437B.tmp",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5261.tmp",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5262.tmp",
  735. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  736. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5B9A.tmp",
  737. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  738. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BBA.tmp",
  739. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BCB.tmp",
  740. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5CE5.tmp",
  741. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6061.tmp",
  742. "C:\\Users\\user\\AppData\\Local\\Temp\\cab643A.tmp",
  743. "C:\\Users\\user\\AppData\\Local\\Temp\\cab667D.tmp",
  744. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  745. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  746. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7F36.tmp",
  747. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9408.tmp",
  748. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC346.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  749. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCC8F.tmp",
  750. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC7FA.tmp\\chevronaccent.glox",
  751. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC346.tmp\\Content.inf",
  752. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  753. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDBC3.tmp",
  754. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC7FA.tmp\\Content.inf",
  755. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  756. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF71D.tmp",
  757. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE818.tmp\\architecture.glox",
  758. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EA.tmp",
  759. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4FB.tmp",
  760. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE818.tmp\\Content.inf",
  761. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD12AB.tmp\\ConvergingText.glox",
  762. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD12AB.tmp\\Content.inf",
  763. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF2.tmp\\BracketList.glox",
  764. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA5A.tmp\\TabbedArc.glox",
  765. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF3.tmp\\turabian.xsl",
  766. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  767. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{00DBD61E-D4B5-48F3-8321-3B7C7AC6BFD2}.tmp",
  768. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B38.tmp\\iso690.xsl",
  769. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1607.tmp\\mlaseventheditionofficeonline.xsl",
  770. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA5A.tmp\\Content.inf",
  771. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF2.tmp\\Content.inf",
  772. "C:\\Users\\user\\AppData\\Local\\Temp\\cab305C.tmp",
  773. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2339.tmp\\gosttitle.xsl",
  774. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE1.tmp\\gostname.xsl",
  775. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD305B.tmp\\content.inf",
  776. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F11.tmp\\Element design set.dotx",
  777. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD31D4.tmp\\ThemePictureGrid.glox",
  778. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F7F.tmp\\Banded.thmx",
  779. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1607.tmp\\Content.inf",
  780. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD305B.tmp\\Quotable.thmx",
  781. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab43A0.tmp",
  782. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B38.tmp\\Content.inf",
  783. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  784. "C:\\Users\\user\\AppData\\Local\\Temp\\cab46B8.tmp",
  785. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD434E.tmp\\iso690nmerical.xsl",
  786. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD31D4.tmp\\Content.inf",
  787. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3561.tmp\\APASixthEditionOfficeOnline.xsl",
  788. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF3.tmp\\Content.inf",
  789. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD437E.tmp\\content.inf",
  790. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3531.tmp\\harvardanglia2008officeonline.xsl",
  791. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE1.tmp\\Content.inf",
  792. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD366C.tmp\\Equations.dotx",
  793. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F11.tmp\\Content.inf",
  794. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4695.tmp\\Basis.thmx",
  795. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD439F.tmp\\chicago.xsl",
  796. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43A1.tmp\\TabList.glox",
  797. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43B2.tmp\\InterconnectedBlockProcess.glox",
  798. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD485F.tmp\\RadialPictureList.glox",
  799. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD438F.tmp\\VaryingWidthList.glox",
  800. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar43B4.tmp",
  801. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD366B.tmp\\ThemePictureAlternatingAccent.glox",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2339.tmp\\Content.inf",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46A7.tmp\\pictureorgchart.glox",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4674.tmp\\content.inf",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD438F.tmp\\Content.inf",
  806. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD366C.tmp\\Content.inf",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3520.tmp\\Content.inf",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4674.tmp\\Metropolitan.thmx",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43A1.tmp\\Content.inf",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43B3.tmp\\content.inf",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD485F.tmp\\Content.inf",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD366B.tmp\\Content.inf",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46A7.tmp\\Content.inf",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4685.tmp\\gb.xsl",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4DDF.tmp\\PictureFrame.glox",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AE0.tmp\\sist02.xsl",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD437E.tmp\\View.thmx",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3561.tmp\\Content.inf",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4696.tmp\\HexagonRadial.glox",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43B2.tmp\\Content.inf",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43B3.tmp\\Dividend.thmx",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AE0.tmp\\Content.inf",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD434E.tmp\\Content.inf",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD514C.tmp\\ieee2006officeonline.xsl",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD52F3.tmp\\content.inf",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4DDF.tmp\\Content.inf",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3531.tmp\\Content.inf",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E1E.tmp\\ThemePictureAccent.glox",
  829. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4696.tmp\\Content.inf",
  831. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6052.tmp",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD52F3.tmp\\Frame.thmx",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F7F.tmp\\content.inf",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD439F.tmp\\Content.inf",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E1E.tmp\\Content.inf",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4695.tmp\\content.inf",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6062.tmp\\rings.glox",
  839. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  840. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\cab69AC.tmp",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6575.tmp\\Headlines.thmx",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD514C.tmp\\Content.inf",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4685.tmp\\Content.inf",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6555.tmp\\content.inf",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6062.tmp\\Content.inf",
  847. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  848. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6555.tmp\\Parallax.thmx",
  850. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox",
  851. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox",
  852. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
  853. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  854. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox",
  855. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  856. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  857. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6575.tmp\\Content.inf",
  859. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  860. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD76EC.tmp\\Berlin.thmx",
  862. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
  863. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  864. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox",
  865. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD796D.tmp\\content.inf",
  867. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8373.tmp",
  869. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD796D.tmp\\Wood_Type.thmx",
  871. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox",
  872. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\cab83C2.tmp",
  874. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
  875. "C:\\Users\\user\\AppData\\Local\\Temp\\cab872E.tmp",
  876. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
  877. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox",
  878. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8007.tmp\\Badge.thmx",
  879. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E7F.tmp\\Circuit.thmx",
  880. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  881. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  882. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
  883. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
  884. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B65.tmp\\Crop.thmx",
  886. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CFC.tmp",
  888. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
  889. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8007.tmp\\Content.inf",
  891. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD76EC.tmp\\content.inf",
  893. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
  894. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B65.tmp\\Content.inf",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD90E5.tmp\\content.inf",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD90E5.tmp\\Droplet.thmx",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\cab978F.tmp",
  899. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  900. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9655.tmp\\content.inf",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9ADB.tmp",
  903. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E7F.tmp\\content.inf",
  905. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  906. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA164.tmp\\content.inf",
  908. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA164.tmp\\Damask.thmx",
  910. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF60.tmp\\content.inf",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDACEE.tmp\\Feathered.thmx",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF60.tmp\\Mesh.thmx",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB397.tmp\\content.inf",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB397.tmp\\Slate.thmx",
  916. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
  917. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
  918. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB98.tmp\\content.inf",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB68.tmp\\Insight design set.dotx",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB98.tmp\\Main_Event.thmx",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDACEE.tmp\\Content.inf",
  923. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
  924. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
  925. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
  926. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
  927. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC696.tmp\\content.inf",
  929. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC696.tmp\\Vapor_Trail.thmx",
  931. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx"
  932. ]
  933.  
  934. [*] Deleted Files: [
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4BE.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4BF.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\~$rchase.doc.3",
  939. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{52DFF9CC-D41C-4466-A760-3FE66B1BA6A9}.tmp",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC346.tmp",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC7FA.tmp",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE818.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA5A.tmp",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF3.tmp",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD12AB.tmp",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF2.tmp",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1607.tmp",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B38.tmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE1.tmp",
  950. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  951. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{00DBD61E-D4B5-48F3-8321-3B7C7AC6BFD2}.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F7F.tmp",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F11.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2339.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD305B.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD31D4.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3520.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3531.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3561.tmp",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD366B.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD437E.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD366C.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD438F.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD439F.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43A1.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD434E.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43B2.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC7FA.tmp\\chevronaccent.glox",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43B3.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4695.tmp",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4685.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4696.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF80.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46A7.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AE0.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD485F.tmp",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4674.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4DDF.tmp",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E1E.tmp",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD514C.tmp",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD52F3.tmp",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab43A0.tmp",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar43B4.tmp",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC346.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6062.tmp",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6575.tmp",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF2.tmp\\BracketList.glox",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA5A.tmp\\TabbedArc.glox",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FBE.tmp",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\cab234B.tmp",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD12AB.tmp\\ConvergingText.glox",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E37.tmp",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD366C.tmp\\Equations.dotx",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\cab231A.tmp",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43B2.tmp\\InterconnectedBlockProcess.glox",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE818.tmp\\architecture.glox",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43A1.tmp\\TabList.glox",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF20.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\cab28AF.tmp",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD485F.tmp\\RadialPictureList.glox",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD76EC.tmp",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD31D4.tmp\\ThemePictureGrid.glox",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\cab235C.tmp",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD366B.tmp\\ThemePictureAlternatingAccent.glox",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C0E.tmp",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBE1.tmp\\gostname.xsl",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\cab28C0.tmp",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD796D.tmp",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD434E.tmp\\iso690nmerical.xsl",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2F8B.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6061.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1607.tmp\\mlaseventheditionofficeonline.xsl",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B38.tmp\\iso690.xsl",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4695.tmp\\Basis.thmx",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FBC.tmp",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBF3.tmp\\turabian.xsl",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3520.tmp\\CircleProcess.glox",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6062.tmp\\rings.glox",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E7F.tmp",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E23.tmp",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8007.tmp",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2E22.tmp",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5261.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C0D.tmp",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FBB.tmp",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD438F.tmp\\VaryingWidthList.glox",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FBD.tmp",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2339.tmp\\gosttitle.xsl",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4E1E.tmp\\ThemePictureAccent.glox",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD46A7.tmp\\pictureorgchart.glox",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\cab643A.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3E96.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4DDF.tmp\\PictureFrame.glox",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\cab288F.tmp",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\cab232B.tmp",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2F11.tmp\\Element design set.dotx",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4696.tmp\\HexagonRadial.glox",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5262.tmp",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\cab437B.tmp",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3561.tmp\\APASixthEditionOfficeOnline.xsl",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4AE0.tmp\\sist02.xsl",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BBA.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD305B.tmp\\Quotable.thmx",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\cab232A.tmp",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD437E.tmp\\View.thmx",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9408.tmp",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD43B3.tmp\\Dividend.thmx",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B65.tmp",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\cab667D.tmp",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5CE5.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD514C.tmp\\ieee2006officeonline.xsl",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3531.tmp\\harvardanglia2008officeonline.xsl",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A9D.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD439F.tmp\\chicago.xsl",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3E86.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\cab288D.tmp",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD90E5.tmp",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1F7F.tmp\\Banded.thmx",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3EA7.tmp",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4685.tmp\\gb.xsl",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4674.tmp\\Metropolitan.thmx",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BCB.tmp",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\cab41C5.tmp",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9655.tmp",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6575.tmp\\Headlines.thmx",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD52F3.tmp\\Frame.thmx",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF71D.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5B9A.tmp",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6555.tmp\\Parallax.thmx",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7F36.tmp",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8B65.tmp\\Crop.thmx",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD76EC.tmp\\Berlin.thmx",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4FB.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCC8F.tmp",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA164.tmp",
  1076. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD796D.tmp\\Wood_Type.thmx",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDBC3.tmp",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDACEE.tmp",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF60.tmp",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8007.tmp\\Badge.thmx",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\cab305C.tmp",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB397.tmp",
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7E7F.tmp\\Circuit.thmx",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD90E5.tmp\\Droplet.thmx",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9655.tmp\\Savon.thmx",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4EA.tmp",
  1087. "C:\\Users\\user\\AppData\\Local\\Temp\\cab46B8.tmp",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB98.tmp",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6052.tmp",
  1090. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB68.tmp",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA164.tmp\\Damask.thmx",
  1092. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAF60.tmp\\Mesh.thmx",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDACEE.tmp\\Feathered.thmx",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8373.tmp",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB397.tmp\\Slate.thmx",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB98.tmp\\Main_Event.thmx",
  1097. "C:\\Users\\user\\AppData\\Local\\Temp\\cab69AC.tmp",
  1098. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8CFC.tmp",
  1099. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC696.tmp",
  1100. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDBB68.tmp\\Insight design set.dotx",
  1101. "C:\\Users\\user\\AppData\\Local\\Temp\\cab83C2.tmp",
  1102. "C:\\Users\\user\\AppData\\Local\\Temp\\cab872E.tmp",
  1103. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDC696.tmp\\Vapor_Trail.thmx",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9ADB.tmp",
  1105. "C:\\Users\\user\\AppData\\Local\\Temp\\cab978F.tmp",
  1106. "C:\\Users\\user\\AppData\\Local\\Temp\\CVRFF6E.tmp.cvr"
  1107. ]
  1108.  
  1109. [*] Modified Registry Keys: [
  1110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\-!8",
  1111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\B24E8F",
  1132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\B24E8F\\B24E8F",
  1133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1185. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1375. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1376. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1377. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Data\\Settings",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Options\\BackgroundOpen",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1738. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1"
  1742. ]
  1743.  
  1744. [*] Deleted Registry Keys: [
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\-!8",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\}f6",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\B24E8F\\B24E8F",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1753. ]
  1754.  
  1755. [*] DNS Communications: [
  1756. {
  1757. "type": "A",
  1758. "request": "sripipat.com",
  1759. "answers": [
  1760. {
  1761. "data": "68.65.120.144",
  1762. "type": "A"
  1763. }
  1764. ]
  1765. }
  1766. ]
  1767.  
  1768. [*] Domains: [
  1769. {
  1770. "ip": "68.65.120.144",
  1771. "domain": "sripipat.com"
  1772. }
  1773. ]
  1774.  
  1775. [*] Network Communication - ICMP: []
  1776.  
  1777. [*] Network Communication - HTTP: [
  1778. {
  1779. "count": 1,
  1780. "body": "",
  1781. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1782. "user-agent": "Microsoft-CryptoAPI/6.1",
  1783. "method": "GET",
  1784. "host": "ocsp.digicert.com",
  1785. "version": "1.1",
  1786. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1787. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1788. "port": 80
  1789. },
  1790. {
  1791. "count": 1,
  1792. "body": "",
  1793. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1794. "user-agent": "Microsoft-CryptoAPI/6.1",
  1795. "method": "GET",
  1796. "host": "ocsp.msocsp.com",
  1797. "version": "1.1",
  1798. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1799. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1800. "port": 80
  1801. },
  1802. {
  1803. "count": 1,
  1804. "body": "",
  1805. "uri": "http://sripipat.com/pawpaw/PurchaseOrder.exe",
  1806. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1807. "method": "GET",
  1808. "host": "sripipat.com",
  1809. "version": "1.1",
  1810. "path": "/pawpaw/PurchaseOrder.exe",
  1811. "data": "GET /pawpaw/PurchaseOrder.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: sripipat.com\r\nConnection: Keep-Alive\r\n\r\n",
  1812. "port": 80
  1813. },
  1814. {
  1815. "count": 2,
  1816. "body": "",
  1817. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1818. "user-agent": "Microsoft-CryptoAPI/6.1",
  1819. "method": "GET",
  1820. "host": "crl.microsoft.com",
  1821. "version": "1.1",
  1822. "path": "/pki/crl/products/microsoftrootcert.crl",
  1823. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1824. "port": 80
  1825. },
  1826. {
  1827. "count": 1,
  1828. "body": "",
  1829. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  1830. "user-agent": "Microsoft-CryptoAPI/6.1",
  1831. "method": "GET",
  1832. "host": "ocsp.digicert.com",
  1833. "version": "1.1",
  1834. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  1835. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1836. "port": 80
  1837. },
  1838. {
  1839. "count": 1,
  1840. "body": "",
  1841. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  1842. "user-agent": "Microsoft-CryptoAPI/6.1",
  1843. "method": "GET",
  1844. "host": "ocsp.digicert.com",
  1845. "version": "1.1",
  1846. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  1847. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1848. "port": 80
  1849. },
  1850. {
  1851. "count": 1,
  1852. "body": "",
  1853. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1854. "user-agent": "Microsoft-CryptoAPI/6.1",
  1855. "method": "GET",
  1856. "host": "crl.microsoft.com",
  1857. "version": "1.1",
  1858. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1859. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1860. "port": 80
  1861. },
  1862. {
  1863. "count": 1,
  1864. "body": "",
  1865. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  1866. "user-agent": "Microsoft-CryptoAPI/6.1",
  1867. "method": "GET",
  1868. "host": "ocsp.digicert.com",
  1869. "version": "1.1",
  1870. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  1871. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1872. "port": 80
  1873. },
  1874. {
  1875. "count": 2,
  1876. "body": "",
  1877. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1878. "user-agent": "Microsoft-CryptoAPI/6.1",
  1879. "method": "GET",
  1880. "host": "crl.microsoft.com",
  1881. "version": "1.1",
  1882. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  1883. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1884. "port": 80
  1885. },
  1886. {
  1887. "count": 1,
  1888. "body": "",
  1889. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  1890. "user-agent": "Microsoft-CryptoAPI/6.1",
  1891. "method": "GET",
  1892. "host": "ocsp.pki.goog",
  1893. "version": "1.1",
  1894. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
  1895. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  1896. "port": 80
  1897. },
  1898. {
  1899. "count": 1,
  1900. "body": "",
  1901. "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  1902. "user-agent": "Microsoft-CryptoAPI/6.1",
  1903. "method": "GET",
  1904. "host": "ocsp.comodoca.com",
  1905. "version": "1.1",
  1906. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
  1907. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D HTTP/1.1\r\nCache-Control: max-age = 94804\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  1908. "port": 80
  1909. },
  1910. {
  1911. "count": 1,
  1912. "body": "",
  1913. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  1914. "user-agent": "Microsoft-CryptoAPI/6.1",
  1915. "method": "GET",
  1916. "host": "ocsp.pki.goog",
  1917. "version": "1.1",
  1918. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
  1919. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  1920. "port": 80
  1921. },
  1922. {
  1923. "count": 1,
  1924. "body": "",
  1925. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  1926. "user-agent": "Microsoft-CryptoAPI/6.1",
  1927. "method": "GET",
  1928. "host": "ocsp.digicert.com",
  1929. "version": "1.1",
  1930. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  1931. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1932. "port": 80
  1933. },
  1934. {
  1935. "count": 1,
  1936. "body": "",
  1937. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  1938. "user-agent": "Microsoft-CryptoAPI/6.1",
  1939. "method": "GET",
  1940. "host": "www.download.windowsupdate.com",
  1941. "version": "1.1",
  1942. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  1943. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  1944. "port": 80
  1945. },
  1946. {
  1947. "count": 1,
  1948. "body": "",
  1949. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  1950. "user-agent": "Microsoft-CryptoAPI/6.1",
  1951. "method": "GET",
  1952. "host": "ocsp.digicert.com",
  1953. "version": "1.1",
  1954. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  1955. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1956. "port": 80
  1957. },
  1958. {
  1959. "count": 1,
  1960. "body": "",
  1961. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  1962. "user-agent": "Microsoft-CryptoAPI/6.1",
  1963. "method": "GET",
  1964. "host": "ocsp.digicert.com",
  1965. "version": "1.1",
  1966. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
  1967. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1968. "port": 80
  1969. },
  1970. {
  1971. "count": 1,
  1972. "body": "",
  1973. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  1974. "user-agent": "Microsoft-CryptoAPI/6.1",
  1975. "method": "GET",
  1976. "host": "ocsp.digicert.com",
  1977. "version": "1.1",
  1978. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
  1979. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1980. "port": 80
  1981. },
  1982. {
  1983. "count": 1,
  1984. "body": "",
  1985. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  1986. "user-agent": "Microsoft-CryptoAPI/6.1",
  1987. "method": "GET",
  1988. "host": "ocsp.pki.goog",
  1989. "version": "1.1",
  1990. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
  1991. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  1992. "port": 80
  1993. },
  1994. {
  1995. "count": 1,
  1996. "body": "",
  1997. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  1998. "user-agent": "Microsoft-CryptoAPI/6.1",
  1999. "method": "GET",
  2000. "host": "ocsp.pki.goog",
  2001. "version": "1.1",
  2002. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
  2003. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  2004. "port": 80
  2005. },
  2006. {
  2007. "count": 1,
  2008. "body": "",
  2009. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  2010. "user-agent": "Microsoft-CryptoAPI/6.1",
  2011. "method": "GET",
  2012. "host": "ocsp.digicert.com",
  2013. "version": "1.1",
  2014. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  2015. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2016. "port": 80
  2017. },
  2018. {
  2019. "count": 1,
  2020. "body": "",
  2021. "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  2022. "user-agent": "Microsoft-CryptoAPI/6.1",
  2023. "method": "GET",
  2024. "host": "ocsp.pki.goog",
  2025. "version": "1.1",
  2026. "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
  2027. "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  2028. "port": 80
  2029. },
  2030. {
  2031. "count": 1,
  2032. "body": "",
  2033. "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  2034. "user-agent": "Microsoft-CryptoAPI/6.1",
  2035. "method": "GET",
  2036. "host": "ocsp.thawte.com",
  2037. "version": "1.1",
  2038. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
  2039. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
  2040. "port": 80
  2041. },
  2042. {
  2043. "count": 1,
  2044. "body": "",
  2045. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  2046. "user-agent": "Microsoft-CryptoAPI/6.1",
  2047. "method": "GET",
  2048. "host": "ocsp.usertrust.com",
  2049. "version": "1.1",
  2050. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  2051. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  2052. "port": 80
  2053. },
  2054. {
  2055. "count": 1,
  2056. "body": "",
  2057. "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  2058. "user-agent": "Microsoft-CryptoAPI/6.1",
  2059. "method": "GET",
  2060. "host": "th.symcd.com",
  2061. "version": "1.1",
  2062. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
  2063. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
  2064. "port": 80
  2065. },
  2066. {
  2067. "count": 1,
  2068. "body": "",
  2069. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  2070. "user-agent": "Microsoft-CryptoAPI/6.1",
  2071. "method": "GET",
  2072. "host": "ocsp.digicert.com",
  2073. "version": "1.1",
  2074. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
  2075. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2076. "port": 80
  2077. },
  2078. {
  2079. "count": 1,
  2080. "body": "",
  2081. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  2082. "user-agent": "Microsoft-CryptoAPI/6.1",
  2083. "method": "GET",
  2084. "host": "ocsp.digicert.com",
  2085. "version": "1.1",
  2086. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
  2087. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2088. "port": 80
  2089. },
  2090. {
  2091. "count": 1,
  2092. "body": "",
  2093. "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  2094. "user-agent": "Microsoft-CryptoAPI/6.1",
  2095. "method": "GET",
  2096. "host": "ocsp.pki.goog",
  2097. "version": "1.1",
  2098. "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
  2099. "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
  2100. "port": 80
  2101. },
  2102. {
  2103. "count": 1,
  2104. "body": "",
  2105. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2106. "user-agent": "Microsoft-CryptoAPI/6.1",
  2107. "method": "GET",
  2108. "host": "crl.microsoft.com",
  2109. "version": "1.1",
  2110. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2111. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 01 May 2019 05:01:31 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2112. "port": 80
  2113. },
  2114. {
  2115. "count": 1,
  2116. "body": "",
  2117. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2118. "user-agent": "Microsoft-CryptoAPI/6.1",
  2119. "method": "GET",
  2120. "host": "crl.microsoft.com",
  2121. "version": "1.1",
  2122. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2123. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 03 May 2019 05:00:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2124. "port": 80
  2125. },
  2126. {
  2127. "count": 1,
  2128. "body": "",
  2129. "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  2130. "user-agent": "Microsoft BITS/7.5",
  2131. "method": "HEAD",
  2132. "host": "redirector.gvt1.com",
  2133. "version": "1.1",
  2134. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
  2135. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
  2136. "port": 80
  2137. },
  2138. {
  2139. "count": 1,
  2140. "body": "",
  2141. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2142. "user-agent": "Microsoft BITS/7.5",
  2143. "method": "HEAD",
  2144. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2145. "version": "1.1",
  2146. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2147. "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2148. "port": 80
  2149. },
  2150. {
  2151. "count": 1,
  2152. "body": "",
  2153. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2154. "user-agent": "Microsoft BITS/7.5",
  2155. "method": "GET",
  2156. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2157. "version": "1.1",
  2158. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2159. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=0-6808\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2160. "port": 80
  2161. },
  2162. {
  2163. "count": 1,
  2164. "body": "",
  2165. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2166. "user-agent": "Microsoft BITS/7.5",
  2167. "method": "GET",
  2168. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2169. "version": "1.1",
  2170. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2171. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=6809-17180\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2172. "port": 80
  2173. },
  2174. {
  2175. "count": 1,
  2176. "body": "",
  2177. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2178. "user-agent": "Microsoft BITS/7.5",
  2179. "method": "GET",
  2180. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2181. "version": "1.1",
  2182. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2183. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=17181-27287\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2184. "port": 80
  2185. },
  2186. {
  2187. "count": 1,
  2188. "body": "",
  2189. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2190. "user-agent": "Microsoft BITS/7.5",
  2191. "method": "GET",
  2192. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2193. "version": "1.1",
  2194. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2195. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=27288-37259\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2196. "port": 80
  2197. },
  2198. {
  2199. "count": 1,
  2200. "body": "",
  2201. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2202. "user-agent": "Microsoft BITS/7.5",
  2203. "method": "GET",
  2204. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2205. "version": "1.1",
  2206. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2207. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=37260-58819\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2208. "port": 80
  2209. },
  2210. {
  2211. "count": 1,
  2212. "body": "",
  2213. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2214. "user-agent": "Microsoft BITS/7.5",
  2215. "method": "GET",
  2216. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2217. "version": "1.1",
  2218. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2219. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=58820-102218\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2220. "port": 80
  2221. },
  2222. {
  2223. "count": 1,
  2224. "body": "",
  2225. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2226. "user-agent": "Microsoft BITS/7.5",
  2227. "method": "GET",
  2228. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2229. "version": "1.1",
  2230. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2231. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=102219-160439\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2232. "port": 80
  2233. },
  2234. {
  2235. "count": 1,
  2236. "body": "",
  2237. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2238. "user-agent": "Microsoft BITS/7.5",
  2239. "method": "GET",
  2240. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2241. "version": "1.1",
  2242. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2243. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=160440-278512\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2244. "port": 80
  2245. },
  2246. {
  2247. "count": 1,
  2248. "body": "",
  2249. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2250. "user-agent": "Microsoft BITS/7.5",
  2251. "method": "GET",
  2252. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2253. "version": "1.1",
  2254. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2255. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=278513-514705\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2256. "port": 80
  2257. },
  2258. {
  2259. "count": 1,
  2260. "body": "",
  2261. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2262. "user-agent": "Microsoft BITS/7.5",
  2263. "method": "GET",
  2264. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2265. "version": "1.1",
  2266. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2267. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=514706-983866\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2268. "port": 80
  2269. },
  2270. {
  2271. "count": 1,
  2272. "body": "",
  2273. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2274. "user-agent": "Microsoft BITS/7.5",
  2275. "method": "GET",
  2276. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2277. "version": "1.1",
  2278. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2279. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=983867-1917778\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2280. "port": 80
  2281. },
  2282. {
  2283. "count": 1,
  2284. "body": "",
  2285. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2286. "user-agent": "Microsoft BITS/7.5",
  2287. "method": "GET",
  2288. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2289. "version": "1.1",
  2290. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2291. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1917779-3784590\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2292. "port": 80
  2293. },
  2294. {
  2295. "count": 1,
  2296. "body": "",
  2297. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2298. "user-agent": "Microsoft BITS/7.5",
  2299. "method": "GET",
  2300. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2301. "version": "1.1",
  2302. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2303. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=3784591-7520636\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2304. "port": 80
  2305. },
  2306. {
  2307. "count": 1,
  2308. "body": "",
  2309. "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2310. "user-agent": "Microsoft BITS/7.5",
  2311. "method": "GET",
  2312. "host": "r13---sn-bvvbax-2ime.gvt1.com",
  2313. "version": "1.1",
  2314. "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes",
  2315. "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560391825&mv=m&nh=EAI&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=7520637-12296959\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
  2316. "port": 80
  2317. }
  2318. ]
  2319.  
  2320. [*] Network Communication - SMTP: []
  2321.  
  2322. [*] Network Communication - Hosts: []
  2323.  
  2324. [*] Network Communication - IRC: []
  2325.  
  2326. [*] Static Analysis: {}
  2327.  
  2328. [*] Resolved APIs: [
  2329. "sechost.dll.ConvertStringSidToSidW",
  2330. "mso.dll.#1443",
  2331. "mso.dll.#9214",
  2332. "mso.dll.#199",
  2333. "mso.dll.#1073",
  2334. "mso.dll.#4255",
  2335. "mso.dll.#7762",
  2336. "mso.dll.#3459",
  2337. "mso.dll.#1262",
  2338. "mso.dll.#5709",
  2339. "userenv.dll.RegisterGPNotification",
  2340. "gpapi.dll.RegisterGPNotificationInternal",
  2341. "sechost.dll.OpenSCManagerW",
  2342. "sechost.dll.OpenServiceW",
  2343. "sechost.dll.CloseServiceHandle",
  2344. "mso.dll.#7353",
  2345. "sechost.dll.QueryServiceConfigW",
  2346. "mso.dll.#5228",
  2347. "mso.dll.#2155",
  2348. "sechost.dll.ConvertSidToStringSidW",
  2349. "mso.dll.#1725",
  2350. "user32.dll.RegisterWindowMessageW",
  2351. "cryptsp.dll.CryptAcquireContextA",
  2352. "cryptsp.dll.CryptCreateHash",
  2353. "cryptsp.dll.CryptHashData",
  2354. "cryptsp.dll.CryptVerifySignatureA",
  2355. "cryptsp.dll.CryptDestroyKey",
  2356. "cryptsp.dll.CryptDestroyHash",
  2357. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  2358. "ncrypt.dll.BCryptImportKeyPair",
  2359. "ncrypt.dll.BCryptVerifySignature",
  2360. "bcryptprimitives.dll.GetHashInterface",
  2361. "ncrypt.dll.BCryptDestroyKey",
  2362. "crypt32.dll.CertVerifyCertificateChainPolicy",
  2363. "crypt32.dll.CertFreeCertificateChain",
  2364. "crypt32.dll.CertDuplicateCertificateContext",
  2365. "ncrypt.dll.SslEncryptPacket",
  2366. "ncrypt.dll.SslDecryptPacket",
  2367. "winhttp.dll.WinHttpReceiveResponse",
  2368. "winhttp.dll.WinHttpQueryHeaders",
  2369. "winhttp.dll.WinHttpQueryDataAvailable",
  2370. "winhttp.dll.WinHttpReadData",
  2371. "webservices.dll.WsCreateError",
  2372. "ntdll.dll.EtwEventWrite",
  2373. "ntdll.dll.EtwEventRegister",
  2374. "ntdll.dll.EtwEventUnregister",
  2375. "webservices.dll.WsCreateHeap",
  2376. "webservices.dll.WsCreateReader",
  2377. "webservices.dll.WsSetInput",
  2378. "webservices.dll.WsFillReader",
  2379. "webservices.dll.WsReadToStartElement",
  2380. "webservices.dll.WsReadStartElement",
  2381. "webservices.dll.WsReadType",
  2382. "winhttp.dll.WinHttpCloseHandle",
  2383. "crypt32.dll.CertFreeCertificateContext",
  2384. "rpcrt4.dll.RpcBindingFree",
  2385. "webservices.dll.WsFreeReader",
  2386. "webservices.dll.WsFreeError",
  2387. "webservices.dll.WsFreeHeap",
  2388. "webservices.dll.WsCreateServiceProxyFromTemplate",
  2389. "winhttp.dll.WinHttpOpenRequest",
  2390. "winhttp.dll.WinHttpAddRequestHeaders",
  2391. "winhttp.dll.WinHttpSendRequest",
  2392. "winhttp.dll.WinHttpConnect",
  2393. "winhttp.dll.WinHttpCrackUrl",
  2394. "winhttp.dll.WinHttpSetStatusCallback",
  2395. "winhttp.dll.WinHttpOpen",
  2396. "winhttp.dll.WinHttpSetOption",
  2397. "winhttp.dll.WinHttpWriteData",
  2398. "winhttp.dll.WinHttpSetCredentials",
  2399. "winhttp.dll.WinHttpQueryAuthSchemes",
  2400. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  2401. "winhttp.dll.WinHttpGetProxyForUrl",
  2402. "winhttp.dll.WinHttpQueryOption",
  2403. "webservices.dll.WsOpenServiceProxy",
  2404. "webservices.dll.WsCall",
  2405. "webservices.dll.WsAddCustomHeader",
  2406. "shlwapi.dll.StrStrA",
  2407. "shlwapi.dll.UrlUnescapeA",
  2408. "mso.dll.#4314",
  2409. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  2410. "mso.dll.#6484",
  2411. "mso.dll.#8499",
  2412. "mso.dll.#9871",
  2413. "mso.dll.#4743",
  2414. "mso.dll.#5452",
  2415. "mso.dll.#8165",
  2416. "mso.dll.#9175",
  2417. "mso.dll.#5315",
  2418. "mso.dll.#8140",
  2419. "user32.dll.IsWindowEnabled",
  2420. "ole32.dll.CoGetCallState",
  2421. "ole32.dll.CoGetActivationState",
  2422. "advapi32.dll.RegisterWaitChainCOMCallback",
  2423. "cryptnet.dll.CertDllVerifyRevocation",
  2424. "profapi.dll.#104",
  2425. "sensapi.dll.IsNetworkAlive",
  2426. "rpcrt4.dll.RpcBindingFromStringBindingW",
  2427. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  2428. "rpcrt4.dll.NdrClientCall2",
  2429. "winhttp.dll.WinHttpSetTimeouts",
  2430. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  2431. "winhttp.dll.WinHttpTimeFromSystemTime",
  2432. "shlwapi.dll.StrStrIW",
  2433. "cryptnet.dll.I_CryptNetGetConnectivity",
  2434. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  2435. "setupapi.dll.SetupIterateCabinetW",
  2436. "kernel32.dll.RegOpenKeyExW",
  2437. "kernel32.dll.RegCloseKey",
  2438. "cabinet.dll.#20",
  2439. "cabinet.dll.#22",
  2440. "devrtl.dll.DevRtlGetThreadLogToken",
  2441. "cryptsp.dll.CryptSetHashParam",
  2442. "sechost.dll.QueryServiceConfigA",
  2443. "sechost.dll.QueryServiceStatus",
  2444. "rpcrt4.dll.RpcStringBindingComposeA",
  2445. "rpcrt4.dll.RpcBindingFromStringBindingA",
  2446. "rpcrt4.dll.RpcEpResolveBinding",
  2447. "sechost.dll.LookupAccountSidLocalW",
  2448. "rpcrt4.dll.RpcStringFreeA",
  2449. "webservices.dll.WsResetHeap",
  2450. "webservices.dll.WsCloseServiceProxy",
  2451. "ws2_32.dll.#3",
  2452. "ncrypt.dll.SslDecrementProviderReferenceCount",
  2453. "ncrypt.dll.SslFreeObject",
  2454. "webservices.dll.WsFreeServiceProxy",
  2455. "user32.dll.IsHungAppWindow",
  2456. "mso.dll.#25",
  2457. "mso.dll.#1056",
  2458. "mso.dll.#8136",
  2459. "mso.dll.#8931",
  2460. "shell32.dll.SHGetFileInfoW",
  2461. "mso.dll.#5362",
  2462. "mso.dll.#6044",
  2463. "mso.dll.#6516",
  2464. "mso.dll.#6221",
  2465. "mso.dll.#5780",
  2466. "mso.dll.#4870",
  2467. "mso.dll.#6046",
  2468. "mso.dll.#1241",
  2469. "mso.dll.#2821",
  2470. "mso.dll.#2340",
  2471. "mso.dll.#7287",
  2472. "mso.dll.#5290",
  2473. "mso.dll.#1508",
  2474. "user32.dll.IsZoomed",
  2475. "user32.dll.GetWindowPlacement",
  2476. "user32.dll.GetWindowRect",
  2477. "mso.dll.#821",
  2478. "user32.dll.GetSystemMetrics",
  2479. "user32.dll.MonitorFromWindow",
  2480. "user32.dll.MonitorFromRect",
  2481. "user32.dll.MonitorFromPoint",
  2482. "user32.dll.EnumDisplayMonitors",
  2483. "user32.dll.GetMonitorInfoA",
  2484. "user32.dll.EnumDisplayDevicesA",
  2485. "mso.dll.#2378",
  2486. "user32.dll.SetWindowPos",
  2487. "user32.dll.AdjustWindowRect",
  2488. "mso.dll.#5912",
  2489. "mso.dll.#9719",
  2490. "mso.dll.#8824",
  2491. "mso.dll.#6117",
  2492. "mso.dll.#3307",
  2493. "user32.dll.SendMessageW",
  2494. "user32.dll.DestroyIcon",
  2495. "mso.dll.#3813",
  2496. "mso.dll.#1815",
  2497. "user32.dll.PtInRect",
  2498. "mso.dll.#1613",
  2499. "user32.dll.SetWindowTextW",
  2500. "user32.dll.GetClassLongW",
  2501. "mso.dll.#8572",
  2502. "gdi32.dll.CreateDIBSection",
  2503. "gdi32.dll.CreateCompatibleDC",
  2504. "gdi32.dll.GetViewportOrgEx",
  2505. "gdi32.dll.SetViewportOrgEx",
  2506. "gdi32.dll.SetBkColor",
  2507. "gdi32.dll.ExtTextOutA",
  2508. "mso.dll.#1573",
  2509. "mso.dll.#8612",
  2510. "user32.dll.SetScrollRange",
  2511. "mso.dll.#2509",
  2512. "user32.dll.BeginDeferWindowPos",
  2513. "user32.dll.DeferWindowPos",
  2514. "user32.dll.EndDeferWindowPos",
  2515. "gdi32.dll.DeleteDC",
  2516. "user32.dll.OffsetRect",
  2517. "user32.dll.EnumChildWindows",
  2518. "user32.dll.GetScrollInfo",
  2519. "user32.dll.MapWindowPoints",
  2520. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  2521. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  2522. "mso.dll.#6126",
  2523. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  2524. "gdi32.dll.GetFontRealizationInfo",
  2525. "gdi32.dll.GetFontFileInfo",
  2526. "gdi32.dll.GetFontFileData",
  2527. "mso.dll.#7261",
  2528. "mso.dll.#9540",
  2529. "usp10.dll.ScriptGetFontScriptTags",
  2530. "usp10.dll.ScriptGetFontLanguageTags",
  2531. "usp10.dll.ScriptGetFontFeatureTags",
  2532. "mso.dll.#6330",
  2533. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  2534. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  2535. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  2536. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  2537. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  2538. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  2539. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  2540. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  2541. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  2542. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  2543. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  2544. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  2545. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  2546. "msptls.dll.?FsDuplicatePageBreakRecord@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAPAU31@@Z",
  2547. "msptls.dll.?FsDestroyPageBreakRecord@Ptls6@@YGJPAUfscontext@1@PAUfsbreakrecpage@1@@Z",
  2548. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  2549. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  2550. "user32.dll.SetRectEmpty",
  2551. "mso.dll.#8693",
  2552. "user32.dll.InflateRect",
  2553. "mso.dll.#1100",
  2554. "mso.dll.#7047",
  2555. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  2556. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  2557. "user32.dll.GetCursor",
  2558. "user32.dll.GetClientRect",
  2559. "user32.dll.SetScrollInfo",
  2560. "user32.dll.SetScrollPos",
  2561. "mso.dll.#3747",
  2562. "mso.dll.#5394",
  2563. "mso.dll.#331",
  2564. "mso.dll.#6829",
  2565. "mso.dll.#539",
  2566. "mso.dll.#4959",
  2567. "mso.dll.#6463",
  2568. "mso.dll.#4987",
  2569. "user32.dll.GetWindow",
  2570. "mso.dll.#7195",
  2571. "mso.dll.#7573",
  2572. "mso.dll.#445",
  2573. "user32.dll.GetCaretBlinkTime",
  2574. "user32.dll.CreateCaret",
  2575. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2576. "user32.dll.IntersectRect",
  2577. "user32.dll.DestroyCaret",
  2578. "user32.dll.GetCaretPos",
  2579. "user32.dll.SetCaretPos",
  2580. "mso.dll.#5932",
  2581. "mso.dll.#2071",
  2582. "mso.dll.#1024",
  2583. "mso.dll.#6245",
  2584. "mso.dll.#9041",
  2585. "mso.dll.#1767",
  2586. "mso.dll.#9369",
  2587. "mso.dll.#4617",
  2588. "user32.dll.FillRect",
  2589. "mso.dll.#343",
  2590. "mso.dll.#9636",
  2591. "mso.dll.#2022",
  2592. "mso.dll.#4750",
  2593. "mso.dll.#4577",
  2594. "mso.dll.#850",
  2595. "shell32.dll.SHAddToRecentDocs",
  2596. "mso.dll.#1776",
  2597. "mso.dll.#9026",
  2598. "mso.dll.#4497",
  2599. "mso.dll.#8926",
  2600. "mso.dll.#7212",
  2601. "mso.dll.#5407",
  2602. "mso.dll.#5152",
  2603. "mso.dll.#3327",
  2604. "mso.dll.#6333",
  2605. "mso.dll.#420",
  2606. "mso.dll.#1335",
  2607. "mso.dll.#2041",
  2608. "mso.dll.#7834",
  2609. "mso.dll.#239",
  2610. "mso.dll.#6357",
  2611. "mso.dll.#7026",
  2612. "mso.dll.#1671",
  2613. "mso.dll.#8263",
  2614. "mso.dll.#9307",
  2615. "mso.dll.#1441",
  2616. "mso.dll.#9223",
  2617. "mso.dll.#6453",
  2618. "mso.dll.#8044",
  2619. "mso.dll.#3698",
  2620. "mso.dll.#8565",
  2621. "oleaut32.dll.#7",
  2622. "mso.dll.#8373",
  2623. "mso.dll.#9741",
  2624. "mso.dll.#478",
  2625. "mso.dll.#479",
  2626. "mso.dll.#340",
  2627. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  2628. "bcrypt.dll.BCryptGetProperty",
  2629. "bcrypt.dll.BCryptCreateHash",
  2630. "bcrypt.dll.BCryptHashData",
  2631. "bcrypt.dll.BCryptFinishHash",
  2632. "bcrypt.dll.BCryptDestroyHash",
  2633. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  2634. "mso.dll.#8633",
  2635. "mso.dll.#5213",
  2636. "mso.dll.#6163",
  2637. "mso.dll.#552",
  2638. "mso.dll.#5630",
  2639. "mso.dll.#1607",
  2640. "mso.dll.#791",
  2641. "mso.dll.#1848",
  2642. "mso.dll.#8735",
  2643. "mso.dll.#9374",
  2644. "mso.dll.#5286",
  2645. "mso.dll.#6368",
  2646. "mso.dll.#4262",
  2647. "mso.dll.#1010",
  2648. "mso.dll.#7979",
  2649. "mso.dll.#8549",
  2650. "mso.dll.#8970",
  2651. "mso.dll.#9198",
  2652. "mso.dll.#4795",
  2653. "ole32.dll.PropVariantClear",
  2654. "oleaut32.dll.#9",
  2655. "mso.dll.#1865",
  2656. "mso.dll.#9688",
  2657. "mso.dll.#320",
  2658. "advapi32.dll.RegDeleteKeyA",
  2659. "user32.dll.DestroyCursor",
  2660. "mso.dll.#7173",
  2661. "mso.dll.#8511",
  2662. "mso.dll.#3299",
  2663. "mso.dll.#7001",
  2664. "mso.dll.#3913",
  2665. "user32.dll.PeekMessageA",
  2666. "mso.dll.#1380",
  2667. "mso.dll.#9500",
  2668. "user32.dll.TranslateMessage",
  2669. "user32.dll.IsWindowUnicode",
  2670. "user32.dll.DispatchMessageA",
  2671. "user32.dll.DispatchMessageW",
  2672. "user32.dll.UpdateWindow",
  2673. "mso.dll.#999",
  2674. "mso.dll.#287",
  2675. "dwmapi.dll.DwmIsCompositionEnabled",
  2676. "mso.dll.#1575",
  2677. "mso.dll.#5034",
  2678. "mso.dll.#1517",
  2679. "mso.dll.#718",
  2680. "mso.dll.#4708",
  2681. "mso.dll.#8046",
  2682. "mso.dll.#4175",
  2683. "mso.dll.#8672",
  2684. "mso.dll.#1990",
  2685. "mso.dll.#3051",
  2686. "mso.dll.#1819",
  2687. "mso.dll.#1419",
  2688. "oleaut32.dll.#147",
  2689. "kernel32.dll.WerRegisterMemoryBlock",
  2690. "dwrite.dll.DWriteCreateFactory",
  2691. "advapi32.dll.RegDeleteTreeW",
  2692. "xmllite.dll.CreateXmlReader",
  2693. "gdi32.dll.GetCurrentObject",
  2694. "gdi32.dll.BitBlt",
  2695. "gdi32.dll.GetClipBox",
  2696. "gdi32.dll.StretchDIBits",
  2697. "riched20.dll.REExtendedRegisterClass",
  2698. "user32.dll.GetWindowLongW",
  2699. "user32.dll.GetSysColor",
  2700. "user32.dll.SetWindowLongW",
  2701. "user32.dll.RegisterWindowMessageA",
  2702. "user32.dll.RegisterClipboardFormatW",
  2703. "user32.dll.GetDoubleClickTime",
  2704. "user32.dll.SetCaretBlinkTime",
  2705. "user32.dll.SystemParametersInfoW",
  2706. "user32.dll.GetKeyboardLayoutList",
  2707. "mso.dll._MsoGetFidUspDll@0",
  2708. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  2709. "usp10.dll.ScriptGetProperties",
  2710. "usp10.dll.ScriptItemize",
  2711. "user32.dll.LoadCursorW",
  2712. "user32.dll.IsWindowVisible",
  2713. "user32.dll.GetKeyboardLayout",
  2714. "user32.dll.PostMessageW",
  2715. "user32.dll.DefWindowProcW",
  2716. "uxtheme.dll.IsThemeActive",
  2717. "uxtheme.dll.IsAppThemed",
  2718. "uxtheme.dll.OpenThemeData",
  2719. "user32.dll.GetDC",
  2720. "user32.dll.ReleaseDC",
  2721. "user32.dll.IsIconic",
  2722. "user32.dll.GetParent",
  2723. "usp10.dll.ScriptGetCMap",
  2724. "user32.dll.InvalidateRect",
  2725. "user32.dll.HideCaret",
  2726. "user32.dll.ShowCaret",
  2727. "user32.dll.NotifyWinEvent",
  2728. "user32.dll.GetWindowTextLengthW",
  2729. "user32.dll.EnableWindow",
  2730. "msctf.dll.SetInputScope",
  2731. "user32.dll.GetWindowRgn",
  2732. "gdi32.dll.CreateCompatibleBitmap",
  2733. "gdi32.dll.SaveDC",
  2734. "gdi32.dll.SetPixel",
  2735. "gdi32.dll.GetPixel",
  2736. "gdi32.dll.RestoreDC",
  2737. "imm32.dll.ImmAssociateContext",
  2738. "mso.dll.#806",
  2739. "mso.dll.#4908",
  2740. "user32.dll.SetRect",
  2741. "mso.dll.#8439",
  2742. "mso.dll.#2736",
  2743. "gdi32.dll.GetTextAlign",
  2744. "gdi32.dll.ExtTextOutW",
  2745. "mso.dll.#8122",
  2746. "mso.dll.#2114",
  2747. "mso.dll.#6558",
  2748. "gdi32.dll.GetFontData",
  2749. "usp10.dll.ScriptItemizeOpenType",
  2750. "usp10.dll.ScriptShapeOpenType",
  2751. "usp10.dll.ScriptPlaceOpenType",
  2752. "mso.dll.#8395",
  2753. "mso.dll.#379",
  2754. "mso.dll.#6338",
  2755. "mso.dll.#7964",
  2756. "mso.dll.#1437",
  2757. "mso.dll.#1427",
  2758. "advapi32.dll.RegQueryValueW",
  2759. "apphelp.dll.ApphelpCheckShellObject",
  2760. "mso.dll.#6137",
  2761. "winmm.dll.timeGetTime",
  2762. "mso.dll.#5940",
  2763. "usp10.dll.ScriptPlace",
  2764. "usp10.dll.ScriptShape",
  2765. "usp10.dll.ScriptJustify",
  2766. "usp10.dll.ScriptTextOut",
  2767. "usp10.dll.ScriptCPtoX",
  2768. "usp10.dll.ScriptXtoCP",
  2769. "usp10.dll.ScriptFreeCache",
  2770. "usp10.dll.ScriptCacheGetHeight",
  2771. "usp10.dll.ScriptLayout",
  2772. "usp10.dll.ScriptBreak",
  2773. "usp10.dll.ScriptIsComplex",
  2774. "usp10.dll.ScriptGetLogicalWidths",
  2775. "usp10.dll.ScriptApplyLogicalWidth",
  2776. "usp10.dll.ScriptGetGlyphABCWidth",
  2777. "usp10.dll.ScriptGetFontProperties",
  2778. "usp10.dll.ScriptApplyDigitSubstitution",
  2779. "usp10.dll.ScriptRecordDigitSubstitution",
  2780. "usp10.dll.ScriptGetFontAlternateGlyphs",
  2781. "mso.dll.#7578",
  2782. "mso.dll.#8483",
  2783. "mso.dll.#2613",
  2784. "gdi32.dll.GdiIsMetaPrintDC",
  2785. "mso.dll.#7848",
  2786. "ole32.dll.CoRevokeInitializeSpy",
  2787. "comctl32.dll.#388",
  2788. "user32.dll.GetForegroundWindow",
  2789. "user32.dll.GetFocus",
  2790. "user32.dll.GetClassNameA",
  2791. "user32.dll.IsWindowRedirectedForPrint",
  2792. "gdi32.dll.CreateRectRgnIndirect",
  2793. "user32.dll.GetUpdateRgn",
  2794. "gdi32.dll.GetRgnBox",
  2795. "user32.dll.ValidateRect",
  2796. "user32.dll.GetUpdateRect",
  2797. "user32.dll.BeginPaint",
  2798. "user32.dll.EndPaint",
  2799. "mso.dll.#3624",
  2800. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  2801. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  2802. "gdi32.dll.TranslateCharsetInfo",
  2803. "mso.dll.#3300",
  2804. "mso.dll.#7465",
  2805. "mso.dll.#6247",
  2806. "gdi32.dll.SetWindowOrgEx",
  2807. "mso.dll.#732",
  2808. "mso.dll.#5804",
  2809. "ole32.dll.CoCreateInstance",
  2810. "mso.dll.#434",
  2811. "user32.dll.GetMessageExtraInfo",
  2812. "user32.dll.TrackMouseEvent",
  2813. "mso.dll.#4746",
  2814. "msptls.dll.?LsPointUV2FromPointUV1@Ptls6@@YGJKPBUtagLSPOINTUV@1@0KPAU21@@Z",
  2815. "msptls.dll.?LsQueryLinePointPcp@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINTUV@1@JPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2816. "user32.dll.GetInputState",
  2817. "mso.dll.#8461",
  2818. "user32.dll.GetClipboardOwner",
  2819. "user32.dll.GetActiveWindow",
  2820. "user32.dll.GetAncestor",
  2821. "mso.dll.#3544",
  2822. "mso.dll.#900",
  2823. "mso.dll.#1422",
  2824. "user32.dll.MsgWaitForMultipleObjectsEx",
  2825. "advapi32.dll.NotifyServiceStatusChangeW",
  2826. "mso.dll.#8662",
  2827. "mso.dll.#1885",
  2828. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  2829. "mso.dll.#832",
  2830. "mso.dll.#3702",
  2831. "mso.dll.#3484",
  2832. "mso.dll.#1966",
  2833. "mso.dll.#6960",
  2834. "mso.dll.#7892",
  2835. "msi.dll.#111",
  2836. "mso.dll.#7931",
  2837. "mso.dll.#3837",
  2838. "mso.dll.#8398",
  2839. "mso.dll.#2477",
  2840. "msproof7.dll.DllGetClassObject",
  2841. "msproof7.dll.DllCanUnloadNow",
  2842. "mso.dll.#4172",
  2843. "mso.dll.#1439",
  2844. "mso.dll.#9566",
  2845. "mso.dll.#111",
  2846. "mso.dll.#4191",
  2847. "mso.dll.#3802",
  2848. "mso.dll.#6982",
  2849. "mso.dll.#8800",
  2850. "mso.dll.#3572",
  2851. "mso.dll.#167",
  2852. "mso.dll.#5737",
  2853. "mso.dll.#590",
  2854. "kernel32.dll.FlsAlloc",
  2855. "kernel32.dll.FlsGetValue",
  2856. "kernel32.dll.FlsSetValue",
  2857. "kernel32.dll.FlsFree",
  2858. "ieawsdc.dll.HrExtractTemplateToPath",
  2859. "mso.dll.#3758",
  2860. "msgr3en.dll.CheckVersion",
  2861. "msgr3en.dll.#29",
  2862. "msgr3en.dll.#30",
  2863. "msgr3en.dll.#31",
  2864. "msgr3en.dll.#32",
  2865. "msgr3en.dll.#33",
  2866. "msgr3en.dll.#34",
  2867. "msgr3en.dll.#35",
  2868. "msgr3en.dll.#45",
  2869. "msgr3en.dll.#46",
  2870. "msgr3en.dll.#47",
  2871. "msgr3en.dll.#48",
  2872. "msgr3en.dll.#51",
  2873. "msgr3en.dll.#50",
  2874. "msgr3en.dll.#49",
  2875. "msgr3en.dll.#43",
  2876. "msgr3en.dll.#41",
  2877. "msgr3en.dll.#42",
  2878. "msgr3en.dll.#44",
  2879. "msgr3en.dll.#39",
  2880. "msgr3en.dll.#40",
  2881. "msgr3en.dll.#36",
  2882. "msgr3en.dll.#38",
  2883. "msgr3en.dll.#37",
  2884. "msgr3en.dll.#56",
  2885. "msgr3en.dll.#52",
  2886. "msgr3en.dll.#53",
  2887. "msgr3en.dll.#57",
  2888. "msgr3en.dll.#58",
  2889. "msgr3en.dll.#59",
  2890. "user32.dll.LoadStringA",
  2891. "mso.dll.#2561",
  2892. "mso.dll.#1266",
  2893. "gdi32.dll.GetStockObject",
  2894. "mso.dll.#6501",
  2895. "riched20.dll.REMSOHInst",
  2896. "mso.dll.#511",
  2897. "mso.dll.#8118",
  2898. "gdi32.dll.GetGlyphIndicesW",
  2899. "mso.dll.#9465",
  2900. "user32.dll.GetWindowDC",
  2901. "gdi32.dll.SetLayout",
  2902. "gdi32.dll.RectVisible",
  2903. "gdi32.dll.GetClipRgn",
  2904. "gdi32.dll.ExcludeClipRect",
  2905. "gdi32.dll.SelectClipRgn",
  2906. "user32.dll.WindowFromPoint",
  2907. "user32.dll.GetCursorInfo",
  2908. "user32.dll.GetCapture",
  2909. "user32.dll.GetMessagePos",
  2910. "user32.dll.ScreenToClient",
  2911. "user32.dll.SetFocus",
  2912. "user32.dll.GetDesktopWindow",
  2913. "user32.dll.FindWindowExW",
  2914. "advapi32.dll.CryptAcquireContextA",
  2915. "advapi32.dll.CryptGenKey",
  2916. "cryptsp.dll.CryptGenKey",
  2917. "advapi32.dll.CryptImportKey",
  2918. "cryptsp.dll.CryptImportKey",
  2919. "advapi32.dll.CryptExportKey",
  2920. "cryptsp.dll.CryptExportKey",
  2921. "advapi32.dll.CryptDestroyKey",
  2922. "mso.dll.#8060",
  2923. "crypt32.dll.CryptQueryObject",
  2924. "wintrust.dll.CryptSIPPutSignedDataMsg",
  2925. "wintrust.dll.CryptSIPGetSignedDataMsg",
  2926. "cryptsp.dll.CryptGetDefaultProviderW",
  2927. "cryptsp.dll.CryptAcquireContextW",
  2928. "crypt32.dll.CertEnumCertificatesInStore",
  2929. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  2930. "cryptsp.dll.CryptReleaseContext",
  2931. "wintrust.dll.WinVerifyTrust",
  2932. "wintrust.dll.WintrustCertificateTrust",
  2933. "wintrust.dll.SoftpubAuthenticode",
  2934. "wintrust.dll.SoftpubInitialize",
  2935. "wintrust.dll.SoftpubLoadMessage",
  2936. "wintrust.dll.SoftpubLoadSignature",
  2937. "wintrust.dll.SoftpubCheckCert",
  2938. "wintrust.dll.SoftpubCleanup",
  2939. "wintrust.dll.CryptSIPVerifyIndirectData",
  2940. "advapi32.dll.CryptCreateHash",
  2941. "advapi32.dll.CryptSetHashParam",
  2942. "advapi32.dll.CryptHashData",
  2943. "advapi32.dll.CryptGetHashParam",
  2944. "cryptsp.dll.CryptGetHashParam",
  2945. "advapi32.dll.CryptDestroyHash",
  2946. "mso.dll.#844",
  2947. "mso.dll.#8172",
  2948. "mso.dll.#1003",
  2949. "mso.dll.#3543",
  2950. "user32.dll.RegisterPowerSettingNotification",
  2951. "powrprof.dll.PowerSettingRegisterNotification",
  2952. "user32.dll.GetWindowThreadProcessId",
  2953. "user32.dll.GetWindowTextW",
  2954. "user32.dll.SendNotifyMessageW",
  2955. "user32.dll.ReleaseCapture",
  2956. "ole32.dll.CoTaskMemFree",
  2957. "ole32.dll.CoTaskMemAlloc",
  2958. "ole32.dll.CoInitializeEx",
  2959. "mso.dll.#7531",
  2960. "ole32.dll.CoUninitialize",
  2961. "msi.dll.#90",
  2962. "mso.dll.#1414",
  2963. "mso.dll.#8202",
  2964. "mso.dll.#7189",
  2965. "mso.dll.#2738",
  2966. "mso.dll.#8691",
  2967. "mso.dll.#6079",
  2968. "mso.dll.#7167",
  2969. "mso.dll.#7163",
  2970. "mso.dll.#333",
  2971. "mso.dll.#1785",
  2972. "user32.dll.IsClipboardFormatAvailable",
  2973. "mso.dll.#5973",
  2974. "user32.dll.RemovePropW",
  2975. "mso.dll.#2014",
  2976. "user32.dll.DestroyWindow",
  2977. "mso.dll.#5919",
  2978. "advapi32.dll.SaferiSearchMatchingHashRules",
  2979. "mso.dll.#9668",
  2980. "mso.dll.#8472",
  2981. "mso.dll.#2294",
  2982. "mso.dll.#2968",
  2983. "mso.dll.#2281",
  2984. "mso.dll.#2628",
  2985. "mso.dll.#1401",
  2986. "mso.dll.#3425",
  2987. "mso.dll.#5291",
  2988. "mso.dll.#1718",
  2989. "mso.dll.#4777",
  2990. "mso.dll.#1914",
  2991. "advapi32.dll.RegDeleteKeyW",
  2992. "mso.dll.#235",
  2993. "mso.dll.#4416",
  2994. "mso.dll.#9398",
  2995. "wintrust.dll.WTHelperProvDataFromStateData",
  2996. "wintrust.dll.WTHelperGetProvSignerFromChain",
  2997. "crypt32.dll.CertCloseStore",
  2998. "mso.dll.#1442",
  2999. "mso.dll.#4388",
  3000. "mso.dll.#8022",
  3001. "mso.dll.#8757",
  3002. "mso.dll.#237",
  3003. "mso.dll.#4214",
  3004. "mso.dll.#884",
  3005. "mso.dll.#121",
  3006. "mso.dll.#1712",
  3007. "mso.dll.#9344",
  3008. "mso.dll.#4203",
  3009. "mso.dll.#3974",
  3010. "mso.dll.#4882",
  3011. "mso.dll.#2449",
  3012. "mso.dll.#2767",
  3013. "ws2_32.dll.#116",
  3014. "mso.dll.#9199",
  3015. "mso.dll.#7948",
  3016. "mso.dll.#3209",
  3017. "mso.dll.#4083",
  3018. "mso.dll.#292",
  3019. "mso.dll.#795",
  3020. "mso.dll.#8349",
  3021. "mso.dll.#8796",
  3022. "mso.dll.#3930",
  3023. "mso.dll.#9105",
  3024. "mso.dll.#2427",
  3025. "mso.dll.#8116",
  3026. "mso.dll.#6156",
  3027. "user32.dll.KillTimer",
  3028. "uxtheme.dll.CloseThemeData",
  3029. "user32.dll.UnregisterClassW",
  3030. "user32.dll.UnhookWindowsHookEx",
  3031. "mso.dll.#7002",
  3032. "mso.dll.#186",
  3033. "user32.dll.PostQuitMessage",
  3034. "mso.dll.#591",
  3035. "mso.dll.#2272",
  3036. "mso.dll.#4284",
  3037. "msptls.dll.?LsDestroyContext@Ptls6@@YGJPAUlscontext@1@@Z",
  3038. "mso.dll.#4426",
  3039. "mso.dll.#8473",
  3040. "mso.dll.#8106",
  3041. "mso.dll.#8876",
  3042. "mso.dll.#4210",
  3043. "mso.dll.#8586",
  3044. "mso.dll.#8004",
  3045. "mso.dll.#6078",
  3046. "mso.dll.#815",
  3047. "mso.dll.#187",
  3048. "mso.dll.#5625",
  3049. "mso.dll.#8316",
  3050. "mso.dll.#7598",
  3051. "cryptnet.dll.I_CryptNetSetUrlCachePreFetchInfo",
  3052. "cabinet.dll.#23",
  3053. "advapi32.dll.ConvertSidToStringSidW",
  3054. "msi.dll.DllGetVersion",
  3055. "user32.dll.RemoveClipboardFormatListener",
  3056. "user32.dll.UnregisterPowerSettingNotification",
  3057. "powrprof.dll.PowerSettingUnregisterNotification",
  3058. "advapi32.dll.CryptReleaseContext",
  3059. "shell32.dll.#155",
  3060. "advapi32.dll.EventUnregister",
  3061. "user32.dll.UnregisterClassA",
  3062. "gdiplus.dll.GdiplusShutdown",
  3063. "wtsapi32.dll.WTSUnRegisterSessionNotification",
  3064. "winsta.dll.WinStationUnRegisterConsoleNotification",
  3065. "advapi32.dll.RegDeleteValueW",
  3066. "mso.dll.#2482",
  3067. "mso.dll.#5458",
  3068. "advapi32.dll.UnregisterTraceGuids",
  3069. "comctl32.dll.#321"
  3070. ]
  3071.  
  3072. [*] Static Analysis: {}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!