API tools faq
paste
paladin316

Docs_0e5652c552a7886b5a7a97da87853b05_doc_2019-07-09_08_30.txt

paladin316
Jul 9th, 2019
2,085
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 76.24 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Docs_0e5652c552a7886b5a7a97da87853b05.doc"
  7. * File Size: 267399
  8. * File Type: "Rich Text Format data, version 1, unknown character set"
  9. * SHA256: "4602ba25322868c3efd6c9d864297386673ff1ce9d8ba32f813ad556cd5926f9"
  10. * MD5: "0e5652c552a7886b5a7a97da87853b05"
  11. * SHA1: "0f9c0ac025e0b6cf758d255c7fd39bd57a5e81ed"
  12. * SHA512: "67600cf5757221a9e08906706960cb49abd6b9c42937801ae78dd63df27de7dc3314fde8cd67bf1b89b0d7891ec680dd4c9f980224d6028e6be2862324ff5ccb"
  13. * CRC32: "9978CF78"
  14. * SSDEEP: "768:s7Kf2sdrM3xaSybdRZXZWkWZNLeK61+0K/YupzvOXS9nnxNK0NraWBLmN0kg+R6m:sxxQW3yL/ehtrLLNOC+i6I3WO8ws"
  15.  
  16. * Process Execution:
  17. "WINWORD.EXE"
  18.  
  19.  
  20. * Executed Commands:
  21.  
  22. * Signatures Detected:
  23.  
  24. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  25. "Details":
  26.  
  27. "IP": "69.192.108.32:443"
  28.  
  29.  
  30. "IP": "104.18.24.243:80"
  31.  
  32.  
  33. "IP": "104.93.33.19:443"
  34.  
  35.  
  36. "IP": "52.109.92.24:443"
  37.  
  38.  
  39. "IP": "152.199.4.33:80"
  40.  
  41.  
  42. "IP": "72.21.91.29:80"
  43.  
  44.  
  45. "IP": "52.109.16.4:443"
  46.  
  47.  
  48.  
  49.  
  50. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  51. "Details":
  52.  
  53. "ioc": "ontent.inf"
  54.  
  55.  
  56. "ioc": "nline.xsl"
  57.  
  58.  
  59.  
  60.  
  61. "Description": "Performs some HTTP requests",
  62. "Details":
  63.  
  64. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  65.  
  66.  
  67. "url": "http://apps.identrust.com/roots/dstrootcax3.p7c"
  68.  
  69.  
  70. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  71.  
  72.  
  73. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  74.  
  75.  
  76. "url": "http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl"
  77.  
  78.  
  79.  
  80.  
  81. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  82. "Details":
  83.  
  84. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00\\x03\\x01$he9\\xc4\\x18\\xf3\\x0c\\xf8\\xfe6\\xb2\\x1f\\xde\\x82\\xfe\\xb5`\\xa89\\x11\\x9f\\xe99\\xcd\\xc5\\x8c\\xcdx\\xf5(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1coffice15client.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  85.  
  86.  
  87. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xca=\\xec\\xdc\\xbd\\xa2rgd\\xbd\\x0f\\xfc2<\\xb8\\xb7\\xd4\\xd9zj\\xdd\\xfd\\x15r\\xed%f\\x89~\\xa2\\x89\\x16\\xd0j0z(\\x98jle\\x1d\\x0b#\\xf0\\x10\\x17\\xce\\x0b;\\xeba\\xc9_\\xcc \\x16\\x89\\xbc\\xd8|o\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x16\\xd7h\\xbc\\xbb\\x84\\x03q\\x15\\xb2\\xec<\\xcbp\\xde\\xf5g\\x8a\\x05m\\x08\\x91\\xb3f\\x0b\\xa8j\\xe2\\x10v\\x81\\xbb\\xff1\\xd5u\\xdcm:\\x1a\\xb3\\x0e\\xcd\\xfc\\xb36\\x04a"
  88.  
  89.  
  90. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pdkp\\xbb\\xccn\\xd5\"\\xa2$%\\xe6lnq\\xbe\\x1a\\xf4\\x8c\\x04\\xbc|\\x1d< z\\xa3\\xda\\x05\\x8e5wg\\xbf\\xd1j\\xca\\x91\\xe2kf\\x0fhb\\xc8\\x0c\\x0b\\x8fz\\xeaj\\x9d\\xdc\\x1aazn\\x0c\\xaa\\xf2\\x01\\x8eq.\\xf8\\xfe\\x04\\xc8\\xfd\\xef!\\x83\\xa5\\x92\\xf0\\x86c\"\\x15-\\xf7\\xa0\\xab\\x808\\x03\\xf8b\\xe8\\xd3:\\xcf\\xd14t\\xfeb\\xa9\\x10cl\\x90\\x88\\x11\\x0b\\xb0g%8\\x13h\\xa5\\x19\\xeb\\xa7f\\xa5\\x95\\xf75b3^\\xc3(\\x84\\xe8z\\x12i\\xa6(n7\\xbf\\x18am'\\xb7\\xfb\\x88\\x16\\xa7\"\\xb8\\xad\\xd1\\xd5n\\x96r\\x81ux\\xa8\\x8f\\x13\\xb6m\\x82\\xbbu\\xe2w\\xccv\\xde\\xa9\\x1a\\x84\\xdf\\xf1\\x16$\\x96\\xdc)\\xa7\\xe5\\xf5\\xbc\\xe5\\xfb\\xbd2\\xfb\\xb1.\\xd5\\xba\\xf4\\x15\\x17\\x1c\\x19\\x7f+\\xe6\\xe5\\xe4*\\xdaa\\xab z\\x83w;\\xfe\\x19\\xea)p\\x00z\\x0c\\xf3g/\\xf2\\xeed\\xf3\\xc9\\xc0\\xeb\\xdd\\xd5\\x00\\xec1_y\\x9e\\4.-ss\\x83\\x94)~z\\xfd"
  91.  
  92.  
  93. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01$hgo\\xea\\x15j\\x9by\\xd97bn\\x176\\xfc\\x1dmku@\\x92b:q\\xf7\nj\\xc5\\xd9\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  94.  
  95.  
  96. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xad\\x0c\\x88\\xe1\\xb2\\xa3\\x8b/n\\xdc\\xf1.\\xaf\\x85v.i\\xad\\xa0_\\xfd`(\\x84\\x1a_\\xe5\\xecs\\xdelc\\x0e`\\x84\\xa5\\x19l\\xe9\\xed\\xf9\\x0c\\x04\\x11$\\xe5\\xcc\\xfb\\xa8a\\x80\\x1e\\xe1\\xcc\\x80\\xa6\\xaf\\x08#k@\\xc7q\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000/\\xd4\\x9f\\x0b\\x14kp2\\x90\\x13\\x89lvw\\xae\\xc7a\\x0c>\\xd8\\x82\\x99\\xb4\\xde!yc\\xa3!\\xab!r\\xc4\\xfd)\\xf2\r\\xa1\\xce\\xc6\\xedg\\xcbm~\\x96\\x9c\\xee"
  97.  
  98.  
  99. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  100.  
  101.  
  102. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01$hh\\x97\\xa5\\xf2\\x93\\xe6\\xe9s+\\xee\\xf5\\xfd\\xb5\\xab\\xd1\\xb2\\xe4\\xd15\\x02t4g\\xdc\\xf4\\xacsv\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  103.  
  104.  
  105. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa6\\x11%y\\xa0'u\\xe6\\xa1\\xb4\\xff\\xed2\\xf03e(\\xf5l\\xea\\xbd \\xed\\xef\\x1b\\xa1\\xc1\\xe2\\xb5!\\x0e\\xd4d\\x93\\xf5\\x9b\\x02d\\x9ba\\xce\\x15j\\x01n\\xcaz\\xc4\\x16\\xef$\\xa4\\xdfr\\xc0\\xf7\\xe3t^\\xb6o\\x08\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf3x\\x012o|\\xeag\\x94\\xea\\xea\\xc8\\xe3kf\\x1e\\xa1\\xa6\\x93\\xaf\\x03\\x85h\\x8c\\x8bzp\\x04&\\x9e\\xa8\\x8c\\xd6x!\t\\xca\\x8f5\\xca&ecz\\x1c\\xd24"
  106.  
  107.  
  108. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x8a\\xa6w\\xfa\r'\\xd2v\\xc8\\x1a\\x1bq\\x12i\\xf1\\x95e\\x10\\xae\\x0b\\xcd\\x8bk\\xde\\x17\\x0c\\xd0\\xf4\\x01\\xec\\x86\\xder\\xa1n\\xea\\x96;\\x03\\x87\"\\xd0\\xfc4\\x88\\xc4\\x15\\xa5\\xed\\x81g\\x88id\\x1b\\x8d \\xdb\\xd6\\xea\\xdb\\x18\\xe7\\xe9\\xca\\xda\\x1e\r\\x1c\\xa4\\x12\\x9b!\\x99\\xa3o\\x9co)\\xd5)#h\\\\%\\xca;\\xe9kx\\x06\\xab\r\\xcf\\xcb\\xc3\\xfc\\xbbq\\xf2\\x13\\xe9\\xd705\\xbd\\xc29o\\xd8\\xc4\\xce\\xf9\\xe4s\\xa3\\x86vch\\xecm\\x0f\\xb1\\xe0\\x86\\xc6\\x08:\\xcc\\xbak\\x00\\x14n/\\x9c!c\\x89$\\x19\\xf8\\xe0\\x1f\\xec\\x9b\\x13l9\\xfa\\xecj\\x1anb\\x80,d\\xa8\\x9d\\x0e\\xe1p\\x9d\\x1c\\xd8\\xeccgb\\xd9\\xbd\\x93\\x8du\\xc1k\\x9f\\xa1t\\x95osu\\xfadzahyq\\x1a|\\xde\\xc8n\\xe5\\x99`\\x11\\xf5\\x92\\x84&\\x80^\\x16\\x1f\\x1d\\x1b\\xcc\\x86~\\xd4xk\\xcd\\xeb5i!\\x7f\\xa2\\\\xca\\xf9'\\x88\t\\xe3\\xff\\xdb\\xc0\\xa9\\x83\\xb8\\xa6\\xb4\\x8c^\\x88\\x00p\\xf1\\x1ce\\xa0u"
  109.  
  110.  
  111. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  112.  
  113.  
  114. "http_request": "winword.exe_WSASend_get /pki/mscorp/crl/microsoft%20it%20tls%20ca%201.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: mscrl.microsoft.com\r\n\r\n"
  115.  
  116.  
  117. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x01\\x00\\x00y\\x03\\x01$h^\\xee\\xa4\\xbd\\x80m\\x7f\\xf6<\\x18\\xbe\\xf6q\\xa2\\xd1\\xd2\\xcf\\x0b\\x06\\x00jx%\\x8ewc\\x15m>\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  118.  
  119.  
  120. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8d\\xde\\xa5\\xe6w\\x1c\\xeb\\xf3\\xdf\\xda\\xac\\xd2\\x94r\\xd1\\x94^\\xad\\x18\\xeb!n\\xea?\\x0b\\xbf\\xa7+\\x92\\x8c\\xf6\\\\xb6pjaz\\x04\\x02\\xb3\\x0br\\xda\\x95\\xea:\\xc2sy.\\xd1l\\xa6\\x02\\x853\\xb8\\x13\\x18\\xd8+\\xdb\\xf7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb9r\\xb7\\xf9\"\\xa6\\xc9vj\\x1e\\xabr\\x04\\xee)\\x9f@\\xb7\\xfc\\xf0\\xaba\\xa0d\\x02\\xd3\\x87\\x0b4\\xb1\\xdd\\xfdy\\x1f\\xd5\\xa7u7\\xb4\\x9d\\xc8\\xd4\\x87\\xeb\\xc7o\\x04"
  121.  
  122.  
  123. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x93\\x0f\\xd4m\\xd0>:\\xeco\\x0ft\\x15f\\xdbo\\xb6\\xc3\\xd5\\xca\\xa2\\x03\\xb4\\xd9\\xa6\\x00\\xd3\\x1b\\x00\\x9d\\xae\\xbc\\xf2u\\xf8\\x08\\x92\\xb1\\xad\\xc9\\xf5o\\xdc\\xbf\n\\x93\\xcf\\xa6\\xeb\\xf9~%\\xebi\\xb9\\x97\\xa1\\xb3\\x83v\\xcev\\xef|\\xf5\\x87sv\\xee\\xe8\\\\xff3\\xff&\\xe4\\x13(/\\xc9\\x0c-\\x0b\r\\x8c$g\\xf9vb\\x8b3\\xa79!\\x13\\xad\\xcbj\\x82\\x8a\\x9ejp\\x9f\\x91h\\x0b\r\\xc4\\x8d\\xd6\\xd9o\\xf9<\\x84\\xeam\\xc9\\x80@\\xc2\\x83\\xd8~z\\xf0\\xab\\xf3\\x0cq\\xd7\\xffv\\xb8\\xa95\\x1c\\xfez\\xa5k5\\xd0jv\\x97\\x93j\\xb4tw\\x06\\xed\\x80\\x99|\\x02\\xba\\x9d1,\\xfd+\\x87=$\\x91\\x15\\xdb\\xb8\\xbe\\xf0\\xdc\\xa8\\xabf\\xb7\\xd9\\xba\\xa9\\xe0\\x08('\\xf8b\\xe6o\\xd2x\\xcb\\x07ua\\x85\\xb3\\x01y\\x8fm\\xc7!\\xd0,\\xb9'\\\\xaf-\\xc9in^\\xb0\rq\\xfa\\x13vj\\xcbm\\x0e\\xab\\xa4m\\xa5\\x1b\\xf5\\x9d\\x02y\\x10gbm^\\xd2\\xa9\\x16\\x86\\x15dk\\x08"
  124.  
  125.  
  126. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xe0\\xff\\x9dv\\xa7\\xfd\\xa6\\xf5\\x8a5\\xc6\\xe6\\x1a\\xa5z\\x11\\xa61\\xa7f\\xa9\\x0bp\\xb5\\x92\\x91\\x94\\x1c\\x85)\\xe9!\\xff\\x8b\\xafet5p\\xces\\x0bxw\\xa7byiu!\\x80\\xa3w\\xbbc\\xe3\\xb9\\xfay\\xb5\\x8c\\x88l\t-)\\xbd\\xcc\\xff\\x14\\xce\\xbf\\x1f\\x19\\x10\\xfc\\xb7\\xb2\\x86vf&\\x96\\xba\\x0cpjek\\x12^\\xbc5nv\\x082q\\x86\\xc3m\\xa5\\x9f>\\xcae\\x1c\\xf3\\xd1rh\\\\x8f\\x81\\xbdt\\xbf\\x8b\\xe6\\xcd5\\xdasw;\\x8a\\xb5\\xef\\xa7a\\x18\\xeb%\\xe5\\xc2\\xd1\\x12\\xcf\\xa46\\x10k%\\x80n\\x99\\x7f\\xae\\xad\\x9e\\x8a\\xdc\\x98\\xd5+\\x04wy\\x91\\xbb\\x16vg\\xe2y\\xe8\\xb8-)>r\\xd6\\x15\\xef\\x82\\x85\\xca\\x16x\\xbb\\xf1\\xd3\\x81ia\\xbe\\xa8\r\\x1a\\xbe\\x87\\xae\\xcf\\xe2\\x84=\\x11\\x81\\xb6\\xf8\\xe0\\x16\\x1a\\xf8r\\xe0o\\xef\\xact#\\xff\\xc3\\xce\\x9e\\x8c\\x878\\xf6\\xe99\\xa9)\\xb8\\xcb\\xc9\\xcfva\\x03\nu\\xf1\\x90\tj\\xd8\\x10\\xfd\\xdf&v<a\\xe0\\x955\\xed"
  127.  
  128.  
  129. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xaf\\xf3o\\x87\\x8d\\xeb1\\xdd\\x0c\\x0f\\xbc~\\x1a\\xfe\\xff\\xa8?\\xcc5\\x8b\\xa3\\x95\\xf7\\xe1\\x9e\\x8eq)\\xd5\\xdb\\x99\\x92e\\xc2\\x1b\\xda=\\x86\\xf1`i\\xc7j)\\xa77l\\xda\\xe9\\xef\\xb3\\x00\\x07\\xf9\\xe4\\x8c\\x96u\\x02\\xab \\x08r@\\xc3&d\\x7f<\\xb6\\xaa\\xbb\\xfd\\xbd\\;1\\x85q\\x80\\xb3kz\\xf5xn\\x04\\x89$\\x98\\xf1\\x9c\\xa3\\xe8\\xf2w\\xbet\\x9e\\x16$7\\xe2\\xa8\\x99\\xd2\\xe6!\\xdc\\xd5\\xd4\\xb3=y\\xa4\\x88\t\\xc7\\xe1\\x19\\xbf\\xfa\\xc3ei5\\xb9\\x85\\x1b\\x96'\\x88q\\x94g\\xed\\xcf\\xf8^\\xa5m\\xcc\r\\xf9\\x85\\xa2\ru\\xc6h\\xcd\\x17\\x07\\xeau\\x14_0d\\x98\\xfb_\\xe0\\xe3\\xbe\\xfc\\xa5\\xc8\\xdf\\xf1\\xd2\\\\xfe\\xda\\xe9\\xad2\\xc2j\\x85/\\\\x1cbj\\xfe\\x94\\x9c\\x9ck\\xac\\xd2\\\\x18\\xdc\\xed\\xad\\xa4swgsf\\x85\\xa9\\xa3\\xc5\\xd3\r\\xcc\\xa5oc\\x07d^\\xb4\\xdas\\x11\\x9bd\\x14\\x80\\xcb\\x1cii\\xc2j\\x9df\\xf4m8b\\xfa\\xaf\\xdf\\xd2\\xda\\x05\\xbb#z\\xf4t\\xf6\\xc8"
  130.  
  131.  
  132. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$hch\\xe4ym\\xee\\xb1\\xf7b\\xc3\\xbf3\\xa6:\\xc0\\xb5\\xe2z\\x9e\\xca\\xd5\\xb1\\x1e\\x15c\\x89\\xf6p\\x80\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  133.  
  134.  
  135. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$hc\\x0e\\xd6\\xa9\\x8b\\x8a^^n\\xe0\\x0e\\xfc\\x06\\xa7\\xbce\\xef\\x80\\xa4i\\xe3\\xb7\\xb0\\x9cx\\xac\\xa7\t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  136.  
  137.  
  138. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$hc\\xeb\\xc3\\x1e\\xd6kg\\x9c\\xb0\\xd8\\xa2e\\xc9\\xf0\\xf8v\\x8f\\xe8\\x1b\\xfdn2\\xf7\\x0c\\xcd\\x93z\\xfbo\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  139.  
  140.  
  141. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04n\\xf7\\xa4\\xbdxa\\x1an\\xb8\\x06\\xd7\\x9d\\x83\\x11\\x99\\\\xef\\xf6u\\xd1d\\xc0v\\xb0fex\\xb7l\\xc2'l\\x8dh6/\\x14'\\x9bl\\xb1\\x9cm\\x88\\xd2@o\t\\xf1e\\xcbe\\xe0\\xc8x\\xaa\\xa5\\x08\\xc9\\xa1\\xb4iv\\xfd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf5\\xe5\\x1a1\\xbe\\x9e\\x8e\\xa2*\\xb7$\\xce)\\x95\\x15\\x00\\xef\\x1b\\xa0\\xfe\\x02\\xc8\\xa0\\xf0\\xf8\\x91f\\xb9r\\xbd\\xb2'\\xb0\\x7f\\xc98*\\xf0\\xdd\\xf3\\xa0\\xb3\\x8f#\\xf9v\\x10"
  142.  
  143.  
  144. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$hd4.i\\x91\\xaf\n\\xdd\\xd8\\xadmu*\\xe2lun\\xf1n\\xee\\xe3h\\xbf\\xa7d\\x9b\\xb9\\x88\\x81\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  145.  
  146.  
  147. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01$hdx\\x87\\xd5r\\xe5\\x93\\xda\\xaf\\x17\\xa0|\\x85\\xbb\\x92\\x1akc\\xe3vq\\xc6\\x88\\xaa`\\xdcn\\xa3b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  148.  
  149.  
  150. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04n?\\x8e\\x9da\\x97\\xf30oz>\\xbf#\\xac\\xcb\\xd0\\xc9\\xd1-\\xaby\\xdc\\x12\\xd5\\xda\\xd6m\\x8av\\xe8n~\\x1a\\xfd\\xf4%qct\\x14\\xcc\\xd5z\\x84\\x9f\\x16>\\xe9\\xe0\\x08\\xa4\\xa0u\\xf4)\\xcd\\x149\\x0b\\xd5v\\xed\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb0\\xc48\\x02\\xf3r3\\xfb\\xb3\\x8b^,p\\xd8h\\xbc\\xaf\\xf1:<\\xcd\\xb9n\\xbd`\\xf1\\xde\\xbf\\x0c\\xdc\\xa8\\xdcsl^\\x92\\xee\\xd0\\x81p\\x00\\xf2\\x9e\\x80\\x1c\\xea%"
  151.  
  152.  
  153. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042h\\xdakl\\xd42\\xb4\\xdftb\\xea\\xa1\\x1c|m3\\xcf\\xf2\\x06\\x9b\\xd5p<\\x16\\xd5\\xf1 \\x9a\\xd7\\x9c\n\\xd3%\\xd2\\xff\\x18\\x7f\\x0b\\x83\\x12+\\x8c\\x08y\\xb7\\xf3\\xa1=\\x94\\xa7\\x03\\xa1\\xa2\\xaf\n\\x91\\x1d|\\xc0\\xac\\xad\\xdc\\xcb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000dg\\xc7qk\\xf2\\xbcb\\x826\\xa9#$\\xae\\x07\\xf6\\xca\\xcf\\x97\\x98\\x02\\x1c\"k\\xb5\\xd1:\\xd9\\x1d\\xc1\\xf3\\x1f\\x8c\\xd0\\xa5\\x93\\xd4\\x116d*\\xe0\\xb5*m\\x18\\xe9x"
  154.  
  155.  
  156. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xce \\xfes\\xe5\\x04\\xb8\\xd6\\xc4\\xb7j.#\\xbcs\\xb3\\xc9\\xd7d\\x8a\\xcef\\x1b\\x02!\\xaa\\x93v\\x86\\x9d\\xf0\\xbb6f\\x02\\x8a\\xa9,\\xe8\\xcc\\xdb\\x0b\\x03soq\\xae\\x89\\x96\\x0b\\xc7\\x177w\\xd5\\xa5\\xde\\xf7&\\xa8\\xac-_\\xc0a\\xcc\\x05#,n(/c\\xc8\\x8ff\\xdb\\x01\\x0e\\xcb\\xa2\\xd1\\x7f(z\\x85:\\x89\\xba\\xb8\\xd7\\x0f\\xfeb\\x14\\xa0i\\xa1\\xf9\\xb1h\\x9e\\xd1\\x94\\xe0\\x0b+\\xb8|\\xa1)\\xe4n(\\x8bh\\xa8b\\xb3\\xe2\\xad<\\x80\\x85\\x06\\xe6\\x86\\xe1\\xfd\\xe9o\\xeee\\xd0\\xd6\\x81_p\\xf2\\xbb\\xbf<&\\xa0\\xd7\\x05\"\\xab\\xc3\\x8a6\\xf9\\x8c\\xd909qt32\\x03\\xdd\\xa8r\\xf2\\x01\\xfc\\xc2\\x19\\x17\\xbd\\x08\\x12\\xf6\\xfd\r\\xa1\\xc3\\x07\\xd1\\xd8\\x1e+\\x13\\xab\\x14\\x13\\xc76\\x0c*\\x86\\xa5\\x91\\xae\\xd8d\\xa4\\x05\\xc8\\xb0#mgg\\x0b\\xe9\\xddu$,6\\xa6\\xf1\\xffc\\xa5m\\x9d\\xa1 \\x05\\x9a\\x00\\x967\\x13<\\xad\\xef\\xbdd\\xbf\\xbd\\x894\\xfe\\xb4j\\xa11\\x1d\\xe8w\r\\x19*\\xc8\\x97"
  157.  
  158.  
  159. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010p\\x8c\\xe1o>\\xcb+ya\\xceq\\xa67mb\\xe8n\\x963p\\x16\\xc0g7\\xf4\\x9bx\\x00\\xb5\\xe5\\xb6\\xe7\\x1fqu1\\xb9\\x95\\xc8\\xfd\\xfc\\xe4u_l\\xa6\\x8c/\\xad?5\\xb9\\xe2lhb\\x1fu\\xea\\x8by\tst\\x81\\x8dvbz\\xed=\\x18\\xb8\\xdc\\xc0\\x18\\x03\\x89\\x86\\xa4\\xc5\\xcd\\x9e\\xb3d\\x9e>\\xca\\xd3f\\xf6\\\\xa8e\\x8b.\\xeb0\\xb2\\x96e\\xf8\\xf2s?sg\\xe7go\\x8d\\x10\\xee\\xae\\x00\\x1f\\x91\\x95\\xe5\\xdf\\xb3\\xe9\\x04\\xdb\\x90\\x0b\\xe7p>\\xfc\\xe3\\x85\\xfa\\xbf\\x17\\x0bq\\x9e\\x0e\\xc6\\x14\\x04\\x94ds\\xca\\xab\\x03\\x8b\\xa0\\xec\\xce\\xe4d\\x8f\\xaf\\xbd\\xa1u\\xfd\\x93\r\\xb9\\xc2\\xda\\xc7\\xc8m\\xb3v\\xf83'!\\xcc\\x19\\xe5c\\xa1\\xa7\\xfd\\xc2\\xe9,\\xcew\\x1fz;\\xa9\\x8cmg\\x07\\xd2\\xdbu\\xfa\\xc3 /)2\\xbd.9:z\\xf6ty,m\\xcezq\\x8a;a\\x02lj\\x7f\\x06\\x0b\\xc2)\\xd4~\\x86\\xb4\\xa7\\x81\\xd3e9;o\\x11\\xa7\\xe3\\xc47\\xfe\\xeb"
  160.  
  161.  
  162. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@\\xbe\\xae.\\xc2\\xeb:k\\x94\\xdc\\xfc\\\r\\xae0\\x9a.\\x0f7\\xb0\\x85\\xa3\\xdd(\\xf7\\\\xf0l\n\\x87(\\xd6r\\xcb\\x14z\\xf3\\xd5\\x07\\xe1$f\\x1a;\\x95\\xd0\\x98>\\xcb\\xed\\xad#w*\\x94\\x10\\xe4\\xa2-n\\x97\\xb3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcdo\\xda\\xf0y\\x97\\xe5a\\xc0\\x83\\x9c:~\\xfa\\x8c,\\x97\\x03\\x19\\xa7\\xaa\\xc9n\\x0e\\x0csb\\xea!\\xb4\\xd5\\x92\\xa7;\\xd5\\xe6\\x0e@-\\xc4x\\x91\\x9b\\x8bh\\x86y\\xb2"
  163.  
  164.  
  165. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbci\\x98\\xb5\\xcb\\x115\\xa2\\xcd\\x9djm\\x8f\\x8a\\x1e\\x9c\\x11\\\\x18\\x9de\\x07o\\xdf\\xd8\\xb1\\xf0\\xa0\\x87\\xd0\\xc9l\\xdd\\xe7\\xc4,\\x195;iga\\xfd\\x981s\\xdfn\\xf6\\xe9c~\\x9c*\\x88\\xb1\\x9e\\x14\\xc7\\x1d0\\xb8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb1\\xd0\\xb2\\x93\\xe5\\xd9\\xee\\x9b\\x14\\xf1\\xb11\\xd6\\x8e\\xf167\\x83\\xe3\\x81?\\xe1p\\x9e\\xf1\\x0f/\\xbe\\xa8\\xd4zmn\\xc3\\x93\\xe9\\x94\\xa4\\x0f\\xc7\\x9d\\x8af\\xa1\\x1a\\xa2w"
  166.  
  167.  
  168. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x05\\xba\\xbc\\xe3\\x90\\x9c\\x98c)\\xfdzt\\xf0.\\x15g\\xe2\\xc1#\\x9c\\x16\\x03jg\\x1d\\xb5\\xd1\\xead\\xd5\\xd6\\xb6\\xf7,\\xe1\nkh^ne\\xd7oz\\x02\\x08\\xaf$q\\xf8\\xaat\\xb0@:\\x84p\\x97\\x02\\x08\\xc9\\xd2\\x04\\x15\\x947\\x9b\\x18\\xf1w\\xe8m\\x98\\x8d\\xc1uc\\xd7+\\x92\\xaa\\xac\\xf7\r5\\x12\\x86\\xd6\\x81\\xe5\\xc1\\xb4\\xe7y\\xbd\\xee\\xbfp\\xf5r\\xf5\\xc9.\\x8cg\\x08\\xe0g\\xe5\\xb4\\xd1\\xe4b\\xab\\xcd\\x18%\\x917\\xaa<\\xa1\\x11\\x80l\\xdb\\x02\\x0c\\xc8%\\xd8\\xd9&\\x02\\xc1$k\\xaev\\xd7\\x84co\\x11\\x17\\xd7\\xf1=\\xe8`\\x93\\xa1t\\x1f'\\xfa\\x15c\\xbf-g\\xa9\\xa2\"n#\\xcd\\xd6:\\x1b\r\\x98a,ln\\xeei\\xcdvuyx\\x82\\xdcmb\\x16\\x9f\\x06\\x8d\\x85\\xaa\\xa0\\x90\\x1c\\xdf\\x12j\\xca\\xecp\\x04\\xb1u\\x05\\x06\r!\\xd6+\\xfb\\xc5\\xfc\\xb0\\xc8\\xf1\\xfe\\xdc.\\x1b\\x81($\\xc0\\x08t\\xa4)`\ngj*5\\xe11\\xcb\\xd8\r\\x83~\\xecoq"
  169.  
  170.  
  171. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\xf2\\xa9\\x9e\\x1ej\\xdd\\xe2\\x006\\x86d\\xcc\\xec\\x04\\xacqj!\\xd6;;\\x8f\\xf4b\\x8a\\xea\\x08\\xd7\\x0f\\x19(3ws#\\xbc\\xb1\\xbbv\\xf2\\x83\\xae.\\xa9\\x94\\x9d(\\xa5\\xb1\\xcc\\xd06~w\\xcbc\\x03\\xe0\\x1f\\xb9\\x92bz\\xe8\\x08e\\x80\\xa9g\\x89\\xb3\\xc1\\xf7l\\xe2\\x17\\xaa/\\xa0\\xa3\\x17j\\xe0\n\\xe5l\\x1e\\xa5\\xeb\\x0f\\xc0\\xb2\\x107\\xc3\\xec\\x88\\x9f=\\x9c\\x17\\xf1n-\\xca\\xfd1\\xb0s\\x9e0\\xeb\t'\\xe1fz\\xa19\\x1f\\x80\\x1b?\\x9f\\xb4\\xf2\\xcf(m\\x80\\xcd\\x92t\\x1c\\x19h\\x00\\xe3\\x\\x1agtw\\x84,\\xdb\\xe0f\\xc24h\\xfb\\xdd\\xce\t\\xd0\\x9fo\r\t\\xd9\\xde\\xc0\t\\xa1\\x80\\x07 \\xad\\xaa\\x9fm\\xa3\\xfb\\xe3\\x04t\\x91\\x1d\\xc6\\xf2.\\\\xfc\\xe0\\x88\\xc4\\xa7d?hx\\x15?\\x92\\xb1\\xc6u\\xe4\\x01\\xd1\\xc7j&\\xa7y\\xeat\\xcd\\x1a\\xe9\\x82\\x88\\x12\\x8d\\x82\\x06\\x96\\x95n\\xa1\\xfc*n\\xc1a\\xdf\\x02\\xb3\\xe1$\\xfe\\x93\\x89l\\x80\r\\x1bhjqd\\xe6\\x7f0"
  172.  
  173.  
  174. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdf\\x01\\x9a\\xc8\\x14\\xb5\\xbc\\xd2\\x02tf\\x12:yh\\xab\\xc5\\x06l\\x06h\\xec\\xab\\xf4k\\x01\\x0c0&h\\xdbetr\\xd6p\\x82,\\x02\\xf5\\xd3g\\x93\\xd7\\xc2%v\\x9c\\x82t\\x81m\\x01\\x12\\xc8\\xc4\\x1b\\x07*h\\x05\\x13\\x922\\xabfe\\xd1\\x12o\\xd5\\xf2\\xb3\\xb0e\\x16#\\x1c\\xe6\\xae\\xd9_\\x07ea&h=-\\x1c\\xdc\\x0ba/7\\xf3\\xddg#\\xe8\\xd15\\x07\\xe75\\xca\\xfa~\\xb0\\x1f\\xfce\\xd1l\\xe5+<=\\x8fk\\xf9\\xb9\\xc9\n\\x05-\\x04\\xd2k/\\x15\\x19\\xfd\\xe3\\xb9\\xa4g\\xe1\\xd9\\x00\\x97)\\xf4dp\\xae.\\x9f\\xd7\\xd5\\x0f\\xc5\\x98\\xd8rj\\xb7\\xbe\\xc7\\x80!\\x7f\\x7f\\xbc\\xac\\xd4\\x8a\\xe2;g\\xb5`\\xc8\\xe4!\\x1c\\x15\\xaa\\xad)\\xee\\x1e\\xcfh$\\xdc\\xeb\\x0ch\\xcf\\xf8\\x81\\x16\\xeb$4q)j\\xcc\\xce=\\x05a\\x0bxl\\xa0\\x81\\xf9:e\\x93mh5(\\xc3\\xe3\\xdf\\x0f\\x10\\x81w\\x98\\x14\\x07m\\x0f^e\\xecvr\\x8a\\x9a\\xa8~\\xc8\\x9a\\xa0`\\x94\\xad\\xe1\\x86"
  175.  
  176.  
  177.  
  178.  
  179. "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
  180. "Details":
  181.  
  182. "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
  183.  
  184.  
  185. "FireEye": "Exploit.RTF-ObfsStrm.Gen"
  186.  
  187.  
  188. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  189.  
  190.  
  191. "McAfee": "Exploit-CVE2017-11882.ah"
  192.  
  193.  
  194. "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
  195.  
  196.  
  197. "Symantec": "Bloodhound.RTF.12"
  198.  
  199.  
  200. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
  201.  
  202.  
  203. "TrendMicro-HouseCall": "Possible_SMBCVE20170199"
  204.  
  205.  
  206. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  207.  
  208.  
  209. "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
  210.  
  211.  
  212. "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
  213.  
  214.  
  215. "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
  216.  
  217.  
  218. "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
  219.  
  220.  
  221. "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
  222.  
  223.  
  224. "F-Secure": "Heuristic.HEUR/Rtf.Malformed"
  225.  
  226.  
  227. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  228.  
  229.  
  230. "TrendMicro": "Possible_SMBCVE20170199"
  231.  
  232.  
  233. "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
  234.  
  235.  
  236. "Sophos": "Exp/201711882-P"
  237.  
  238.  
  239. "Ikarus": "Exploit.CVE-2017-11882"
  240.  
  241.  
  242. "Cyren": "CVE-2017-11882!Camelot"
  243.  
  244.  
  245. "Avira": "HEUR/Rtf.Malformed"
  246.  
  247.  
  248. "Antiy-AVL": "TrojanExploit/OLE.CVE-2017-11882"
  249.  
  250.  
  251. "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
  252.  
  253.  
  254. "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
  255.  
  256.  
  257. "GData": "Exploit.RTF-ObfsStrm.Gen"
  258.  
  259.  
  260. "AhnLab-V3": "RTF/Malform-C.Gen"
  261.  
  262.  
  263. "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
  264.  
  265.  
  266. "Zoner": "Probably RTFObfuscation"
  267.  
  268.  
  269. "MAX": "malware (ai score=80)"
  270.  
  271.  
  272. "Qihoo-360": "susp.rtf.objupdate.gen"
  273.  
  274.  
  275.  
  276.  
  277. "Description": "Attempts to create or modify system certificates",
  278. "Details":
  279.  
  280.  
  281.  
  282. * Started Service:
  283. "osppsvc"
  284.  
  285.  
  286. * Mutexes:
  287. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  288. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  289. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  290. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  291. "CicLoadWinStaWinSta0",
  292. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  293. "Global\\552FFA80-3393-423d-8671-7BA046BB5906"
  294.  
  295.  
  296. * Modified Files:
  297. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_0e5652c552a7886b5a7a97da87853b05.doc",
  298. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_0e5652c552a7886b5a7a97da87853b05.doc",
  299. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF06B5BEA9-68C1-4AF9-BEB8-909146385BEA.tmp",
  300. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS266399C4-CC40-40C1-A35D-1F82294786CD.tmp",
  301. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRSDC5C317F-3686-4CA1-B12F-12F227A2CCEC.tmp",
  302. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  303. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  304. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  305. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C1F52EFD459704E23E98B5C774A45162",
  306. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C1F52EFD459704E23E98B5C774A45162",
  307. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF70F.tmp",
  308. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF710.tmp",
  309. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1864.tmp",
  310. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1865.tmp",
  311. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1866.tmp",
  312. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1877.tmp"
  313.  
  314.  
  315. * Deleted Files:
  316. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  317. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  318. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF70F.tmp",
  319. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF710.tmp"
  320.  
  321.  
  322. * Modified Registry Keys:
  323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\$m",
  324. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\74830A",
  343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\74830A\\74830A",
  344. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  587. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\\Blob",
  588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893"
  646.  
  647.  
  648. * Deleted Registry Keys:
  649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\$m",
  650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\(1y",
  651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  655. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DAC9024F54D8F6DF94935FB1732638CA6AD77C13"
  656.  
  657.  
  658. * DNS Communications:
  659.  
  660. "type": "A",
  661. "request": "koirado.com",
  662. "answers":
  663.  
  664. "data": "46.105.57.169",
  665. "type": "A"
  666.  
  667.  
  668.  
  669.  
  670. "type": "A",
  671. "request": "apps.identrust.com",
  672. "answers":
  673.  
  674. "data": "192.35.177.64",
  675. "type": "A"
  676.  
  677.  
  678. "data": "apps.digsigtrust.com",
  679. "type": "CNAME"
  680.  
  681.  
  682.  
  683.  
  684. "type": "A",
  685. "request": "vemvemserver.duckdns.org",
  686. "answers":
  687.  
  688. "data": "205.185.125.42",
  689. "type": "A"
  690.  
  691.  
  692.  
  693.  
  694.  
  695. * Domains:
  696.  
  697. "ip": "192.35.177.64",
  698. "domain": "apps.identrust.com"
  699.  
  700.  
  701. "ip": "46.105.57.169",
  702. "domain": "koirado.com"
  703.  
  704.  
  705. "ip": "205.185.125.42",
  706. "domain": "vemvemserver.duckdns.org"
  707.  
  708.  
  709.  
  710. * Network Communication - ICMP:
  711.  
  712. * Network Communication - HTTP:
  713.  
  714. "count": 1,
  715. "body": "",
  716. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  717. "user-agent": "Microsoft-CryptoAPI/6.1",
  718. "method": "GET",
  719. "host": "ocsp.digicert.com",
  720. "version": "1.1",
  721. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  722. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  723. "port": 80
  724.  
  725.  
  726. "count": 1,
  727. "body": "",
  728. "uri": "http://apps.identrust.com/roots/dstrootcax3.p7c",
  729. "user-agent": "Microsoft-CryptoAPI/6.1",
  730. "method": "GET",
  731. "host": "apps.identrust.com",
  732. "version": "1.1",
  733. "path": "/roots/dstrootcax3.p7c",
  734. "data": "GET /roots/dstrootcax3.p7c HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: apps.identrust.com\r\n\r\n",
  735. "port": 80
  736.  
  737.  
  738. "count": 1,
  739. "body": "",
  740. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  741. "user-agent": "Microsoft-CryptoAPI/6.1",
  742. "method": "GET",
  743. "host": "www.download.windowsupdate.com",
  744. "version": "1.1",
  745. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  746. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  747. "port": 80
  748.  
  749.  
  750. "count": 1,
  751. "body": "",
  752. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  753. "user-agent": "Microsoft-CryptoAPI/6.1",
  754. "method": "GET",
  755. "host": "ocsp.msocsp.com",
  756. "version": "1.1",
  757. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  758. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  759. "port": 80
  760.  
  761.  
  762. "count": 1,
  763. "body": "",
  764. "uri": "http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
  765. "user-agent": "Microsoft-CryptoAPI/6.1",
  766. "method": "GET",
  767. "host": "mscrl.microsoft.com",
  768. "version": "1.1",
  769. "path": "/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
  770. "data": "GET /pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: mscrl.microsoft.com\r\n\r\n",
  771. "port": 80
  772.  
  773.  
  774.  
  775. * Network Communication - SMTP:
  776.  
  777. * Network Communication - Hosts:
  778.  
  779. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!