RTF_31fa978dc1d4903cd86280858a6987e1_doc.json

[*] MalFamily: "Azorult"

[*] MalScore: 10.0

[*] File Name: "RTF_31fa978dc1d4903cd86280858a6987e1.doc"
[*] File Size: 8584
[*] File Type: "Rich Text Format data, version 1, unknown character set"
[*] SHA256: "4e9bc336be1115bb9ccaf35c583715d57dbabe0b8f39f7b8fa825c63e9663f5d"
[*] MD5: "31fa978dc1d4903cd86280858a6987e1"
[*] SHA1: "9100eb5d3df8058b8bdedfc1270bb65cae3a3dc1"
[*] SHA512: "03be464a997ba011f5e76c55d5af380bedb8a7184d8e33b703ea720e9f6cdb4b0fccf853227373e8bc651e139648523d89d8778e9023b325ef397cf07a2c2ae2"
[*] CRC32: "E36EC1F1"
[*] SSDEEP: "96:sBSv++TnufxQfvMEJbzUfSPQaq1HG4siteLm5esK4KO:cS+yupivMEJXUSQP1am5XK4KO"

[*] Process Execution: [
    "WINWORD.EXE",
    "splwow64.exe"
]

[*] Signatures Detected: [
    {
        "Description": "A process attempted to delay the analysis task.",
        "Details": [
            {
                "Process": "WINWORD.EXE tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
            }
        ]
    },
    {
        "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
        "Details": [
            {
                "IP": "52.109.6.40:443"
            },
            {
                "IP": "65.52.98.231:443"
            },
            {
                "IP": "104.18.24.243:80"
            },
            {
                "IP": "52.109.6.6:443"
            },
            {
                "IP": "152.199.4.33:80"
            },
            {
                "IP": "72.21.91.29:80"
            },
            {
                "IP": "184.84.243.193:80"
            },
            {
                "IP": "184.31.253.221:443"
            }
        ]
    },
    {
        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details": [
            {
                "post_no_referer": "HTTP traffic contains a POST request with no referer header"
            },
            {
                "suspicious_request": "http://ak3indonesia.com/wp-content/klunn/32/index.php"
            },
            {
                "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
            },
            {
                "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
            },
            {
                "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
            },
            {
                "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
            },
            {
                "url": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY"
            },
            {
                "url": "http://ak3indonesia.com/wp-content/klunn/32/index.php"
            },
            {
                "url": "http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
            }
        ]
    },
    {
        "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
        "Details": [
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\ty:\\xf6@\\xf92\\xeb\\xf7\\xfd\\x03p\\xe6z\\x8c\\xe5\\xf4\\xff\\x99\\xee6q\\x9a\\xa7h\"u\\x1eh\\xdbw\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1coffice15client.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l5p\\x9b\\x19%\\x1drd\\xd3ni\\x1ex\\x05\\xd8\\\\xe7;_\\xe3\\xdb\\x0f\\xd5\\x8c\\x8e0\\x91a3x\\xaf2\\x05\\x9c\\x1c\\xb6\t\\xa7\\xad\\x95\\x90$\\xc8\\x86\\x18\\xa9\\xe0\\xb3i\\xfc-\\xe3\\xdeq\\xbeiuc't\\x10\\xbc\\x05\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd7\\xbc\\xc4\\xe14m\\xe6\\xe8\\xb5;\\xc8\r\\x02\\x85'~jm\\xc8\\x94\\x0ew!&\\x14a\\xa8\\x03\\x8f\\x1f\\xd6\\xcc\\xbb\\xb9iu\\x1d\\xed\\x05\\x85n\\x91\\xed\\xa2\\xc2\\xbd\\x1c\\xe0"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x9c\\x9eg\\x8f23\\xbd\\xc1\\xf8\\xbd\\xe7u\\xd4\\xa7k\\xc2\\xf8d}\\x86\\x05\\xca\\x8a\\x1dl\\xdb\\xa3aw\\xe5\\xa5\\xa3m\\xc6}\\xa3+\\xe2\nh\\xbego\\xfet\\xb1\\xba\\xf8\\xc9\\x93\\x81\\xaa`\\xc0w\\xc9#w\\xbe\\x9a/\\x92\\xd5\\xd3\\xf8\\xd7\\xe8\\x0en\\xcb\\xb0\\x85\\x92<\\xe9\\x1ati\\xb6\\x95\\x85w\\xad1\\xca\\xab\\xe3\\xe7\\x06g\\x81\\xee\\x0c\\x9d*g.`\n.\\xc5\\x11\\x91\\xcdj\\xfa\\xcc\\xebl\\x99(\\x1a\\x9ab\\x0e\\xd2\\x95a7\\xd2\\x12\\xff\\x93e?\\xf0\\xec|\\xb63\\x06\\x98\\xc5g\\xe3\\xa2\\x00\\x14l\\x92\\xd6\\xe6\\xa2\\x8a\\xcer\\x13.~\\xbb\\x8b\\xfc\\xb8\\xd28^/\\xe6\\x93\\xbdm-\\x84a\\x01\\xca\\xb9\\x84h\\x94~\\xc9\\x17ih]_'\\xd1^\\x8b\\x9dfi=-0\\xc2e\\xec\\x92]l#x\\x1a&8\\xd6\\xf7\\xb4@\\xbd\\x9f\\x98_\\xaakm\\xeemt\\xe7\\xa5\\x14(\\x01\\xa8\\xc7h\\xbc\\x83(\\x9b\\xc4\\xb3d<\\xdc\\xdc\\xcc\\xf1\\x89\\xa9\\xe6\\xf6\\xf6t\\xc5$dyp\\x8fm\\xe0\\xc0\\xa3\\xa0~e"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\ty;e\\x12x\\x95t\\x03\\xec\\x89\\x84\\xaekr;5\\xa6\\xc48\\x7f\\xbcku\\xa2\\x11\\xd9\r\\xe9\\x9a\\xba\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbdd\\x7f\\x8f\\xea\\xfdb\\xd7\\x89\\x1df>\\xda\\xd8\\xd6y\\xab\\xd3\\xddh\\xffsr\\x12\\x86\\x1f\\x01\\xec\\xa8%\\x91\\xfe\\x9c\\x06\\a\\xe8#\\x97\\x0b1\\xa7\"\\xdc\\xcc\\x1a\\xd3\\x9c-\\xfa6\\xa6\\x1a1\\x86'wn]\\x08\\x90\\xa5'}\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x967\\xc5\\xdb\\xaa\\xf7\\x1fpk\\x89x\\x90\\x8akh?\\xee\\xcb\\x17\\xec\\x8c\\xdbn\\x07\\xcf=p\\xc2b@)\\xc3tkd\\x83\\x16=\\xf2:d\\x13\\xcbn>hza"
            },
            {
                "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\ncache-control: max-age = 89056\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 22 mar 2019 18:30:24 gmt\r\nif-"
            },
            {
                "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
            },
            {
                "http_request": "winword.exe_WSASend_get /pki/mscorp/crl/microsoft%20it%20tls%20ca%201.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: mscrl.microsoft.com\r\n\r\n"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\tyov\\xcfk\\xcf\\xb9\\x81\\x80\\xe0\\x90\\x11\\xc46m[\\x84\\xb0\\x00z\\xc4tc\\xb9ub\\xa5 2\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x89~[\\xa5\\xc5\\xb2\\xec\\xc8s\\xd6p.x\\xa7\\xbe6\\x06k\\xa1u\\xc0\\x1c\\xa0\n\\xe1 g\\xed\\xc0\\xd4\\xff\\x03\\xcc;\\x82\\x06\\xaa\\x1e%\\xe5%g\\xa8\\x80\\xf6\\xdc\\xb2\\x87r\\xf9\\xfe\\x08\\xf0^\\xd5\\x8c\\x8d*}\\xd9vn\\xa0\\x98\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf9h\\xc1\\x7fbo\\xc8\\x97\\x07\\xea\\x963{s\\x900|\\x81\\xbe\\x87\\x86\\xef\\xa1\\x86\\xf3\\x8d\\x0c\\x96\\x02:\\x18\\xcf\\xb8\\x95\\x91%uy{\\xabv*\\x0c5d\\xa7oh"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pi<\\xb2\r\\x88w}>k0\\xadn\\xd3\\x13\\\\xf9j$'\\x1b\\x0e\\x7f\\xc0\\x88\\x83's\\x1ak\\x17\\xadb\\xca\\xd6j\\xa0\\x078\\xbb\\xa5\\xaf\\x815\\x19'\\xf89.r\\xb2\\x9aca\\xd0\\xf5\\xd7\\x93\\xc7\\xce\\xe9{\\x83\\xe2\\xfc\\x8fs\\xf9\\xd9\\x8e\r\\xff \\x85;e~\\x11\\xa6\\x96w\\xf9?\\x0b\\x10z\\xda\\xee\\xcd\\xdc\\x0b\\xec6a%\\xc5`\\xc5\\xfc\\xd0\\x97\\xb5\\x12\\xf0\\b \\x8d\\x01\\x0fq\t\\xfc\\x92\\x9d\\x01\\x9e\\xba\\x19\\xcb{a\\xb7\\xc3\\xce\\xe0\\xaa\\x14q\\xca`e9j\\xab\\xe2\\xaey[.\\x12\\xa44#\\xfe\\x07\\x85~\\x1cpf\\x0e\\x946(\\xd8w\\x12\\x81\\xe1\\x7f3^r\\xfe\\xf5\\xeb\\xfc\\xc2m\\xab'b\\x05\\x91[\\x9dg*\"\\xd1\\x15g\\x8a!\\xcfi\\xbb\\xb3\\x84\\x86\\x04)\\\\x82j\\xc5\\x9b\\xb4q\\x91g\\x1c\\xf4\\xc4hl\\x8d$\\xce\\xc8^\n\\xa9\\x9b\\xf5\\xd2^7\\xa0\\x11\\xb4\\x82\\xb4i\\xc0\\xdf\\x1b\\x0fc\\xe61i\\xb0\\xac2\\x18\\\\x11\\x9cl\\x85\\xb7@\\xf2\\xb1\\x03ge\\xb4\\xab\\xb5"
            },
            {
                "http_request": "winword.exe_WSASend_get /pki/mscorp/crl/microsoft%20it%20tls%20ca%201.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x9e\\x01\\x00\\x00\\x9a\\x03\\x01]\ty\\xd3yu\\x03\\xb6t\\x16\\xd5\\x89\\xb9i\\xec\\xa8d\\x07\\xbbf*\\xc4\\x9c\\xa8*\\xf7\\x87\\xeb\\x04g\\x02( \\xfe,\\x00\\x00\\xb7$\\xb2\\xf0p\\x0e\\xe7y7|n\\xafdd\\xf6\\x10\\xd4o\\x04\\xb0\\xc2\\xf1\\xe7\\x8ei(\\xce\\x82\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s\\xe4\\xd9?-v-d\\xd3\\xa8\\xa1\\x10\\x83\\xd2[+\\xa7l\\xabvn\\xb4}\\x90\\xee\\xd7g\\xebv\\xab\\xe6\\xeep\\xc8ezk.jc\\xcdg\\x97\\xc1\\xe1+u\\x91t`8\\xbb\\x95\\x93he}j\\x88\\xa2\\xf2p\\x1b\\xb9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc0o\\x86dfo\\xbf n\\xc6\\x9e\\xf3\\x8a\\xe2\\x9c\\xdb]\\x92ew\\xb6\\xd0\\x9be\\x04&b\\xbc\\x91\\x8f\\x1ah\\xded|/ \\xb4\\xe67\\xd8u\\xd3\\xfe\\xb8\\xe4s\\xde"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\ty\\xd5_\\x86\\x93\\xf86\\xd4\\x889=\\x9f\\x07\\xefl{r\\x82;+\\xae\\x83\\xcf\\xa2\\x12c\\x82\\x95\\xa5w\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xb3!\\x82r\\xaa\\x84\\xc0\\xd8\\xf0\\x83\\x1d\\xda|\\xbd\\xe2\\xf8\\xd5;\\xd9\\xd1\\x9b\\xf0\\xd1\\x92m3\\x1e\\x97aj)4`\\xbfz\\xddl\\x0fn\\xb4\\x8a\\xf4\\\\xc1\\x07\\x03\\x01\\xee\\x13$o\\xcbn\\x9f\\xf2\\xc5>\\xac4\\x8c\\x0e\\xf9\\xe5\r\\xbf;h&|onx\\x18\\xd0\\c\\xc0a\\x19t\\xe610xp\\xfc\\xef\\x9a\\xfe\\x15}3\\x0f\\x1es\\x19\\x13bz\\xa0$\"?c\\x15\\xe5a\\x00\\xfd \\x81\\xd3uw\\xa9\\xeb1\\xe9\\x81\\xc9\\x9b\\xb1;n\\xf4j\\xcc\\xb7\\xa3rk\\xa04\\x899\\xc5\\xc2\\xd0\\x17\\xa0\\xbe\\xeb\\xbd\\x97<\\xba@\\k\\xcap\\xdd\\xc8\\x97\\x99\\xa0\\xbat\\xaf\\x8f%cn\\xba\\xf9\\x06\\x0cu\\xc4\\x8e\\xc9h\\xe1k.fs;\\xf4\\x9a\\xd5\\xa2\\xe6\\xc6jh\\xc7]\\x0c\\x06\\xbb^\\xca&\\x1ez\\xdff\\xef\\x16\\xad3\\xba\\x12\\xca\\xea\\xa67\\xbc\\xb5x\\x1ex\\xe1k}\\x9c\\x8f:))\\x84q\\xdf\\x1bu\\x0b\\xb4\\xc9t\\x8cx\\xe9\\xb3g\\xf3\\x1f\n\\x17st#\\x8f\\xce#\\x84k\\xf5pc\\xd8"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xdb}l\\xe2k\\xdc\\x84\\xa7p\\xf5:0g\\xb9\\xc3\\xb3>\\x0e\\x9a\\xaf\\xb9oa \\xd8o\\xe3\\x95[\\xe6\\xd7p=q\\xa8!\\xf4i\\x14\\x1bl\\x12\\xe8$k\\x03]\\x1b\\x1bq\\x819\\xe5\\x12\\x96s\\x83\\x17\\x7fh\\xdd'\r[\\x1f\\xedn/\\x93a\\xc6v\\x8df&\\xcb\\xa1\\xf9n\\xc9[c\\x95\\xc3<9\\xa5vs\\xe7\\x18\\xe7\\xe9\\xb7\\xb5\\xf4\\x1c\\xe9\\xf7\tg\\xd8\\xeef\\xa3]\\xa5\\xcc\\x92\\x7f>\\xb5f\\xe9\\xf4\\x8f\\xdcu\\xb1(\\xa4\\xb0}z[\\xc3t\\x07h0*\\xb4\\xe9n\\x9a\\xd8$\\xf7\\xe3d\\xbf\\xcd\\xfb\\x1f9m\\xa3\\x10\\x8678\\x8c\\xbbqa\\xfa\\x82\\xe3n)\\xfd<x\\xe7b1\\xa64\\x88\\xb7\\xb4@\\xe5}gm\\x9bn\\xf6\\x8d\\x00i\\xf9\\x17\\xfe\\xe1\\xd4g\\xca,\\xd8\\x8d\\xd6\\xe8\\xe7\\xf4\\x19\\xde\\x03\\xaa\\x86w\n\n\\xa5e\\x05%\\x85i\\xb2-o\\xd9\\xf7\\x83\\x8a\\x8b0/\\x17\\xbe\\xe0\\xac\\xc5\\x1fx\\x84\\xbd0&'\\x07\\x1e\\xb8\\xb0u\\xaf\\xaf}\\xf4j\\x0fmf5[\\x862g\\x9b"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\ty\\xff\\xfc\\x10dr\\xfe\\x85\\x87&\\x94\\xc6\\xda\\x14\\xec\\xcd8\\x81\\xdf\\xb2\\x87\\xd7\\xc0\\xa8c\\xeb\\xaf\\xa8z\\x93\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00h\\x1c\\x1f\\xd0\\xdd\\xec\\x8eo\\x1c\\xa1hi#r\\xd4\\xeb\\xda\\xad\\x956\\x19k\\x18\\xf8j}\\x8ek-\\xde\\xd0<ie\\xee!@d1o\\x88r\\xfc,`\\xd6!\\x0f\\xa1\\xbc\\x0b~i\\xb6o\\xe2\\x08\\x94\\xe3\\x1a3\\xfa%\\xeb\\xe7\\xb1\\xe0mw\\x15\\xe0\\xd2#av\\x9fo\\x0c$b\\x83\\x98\\x1c\\x98x\\xa5*bf-\\x8da\\xddhg\\xa5\\xa7\\x03\\x00dxp\\xf2\\x82\\x9d\\x8e\\x89\\xda\\xdc\\xbb\\xbc\\xe0|,r@\\x1eo\\xa0g'\\xbe'f\\xe7\\xfe\\x95b\\xa0a\\xe0j\\xc9_\\x83\\xc3we\\xb0'\\xa2\\x93\\xb0\\xa1]\\xfb\\xda\\x1a\\x020c&\\xb3\\xf9\\xe8\\x15\\x17-\\x9d\\xbb\\xef\\x04\\xa6\\x0b\\x9b\\xb8\\x82\\x7f\\xb6\\xb1,\\x7f\\x97d\\x1f\\xf7\\x84\\xdb\\xa8\\xc7\\xdfn?\\x8bvkb\\xd6oy\\x815\r;[\\xee\\x04\\xce\\x0chg.\\xbe\\x87r\\x1d>\\xebr\\x7f\\x8e\\x81\\xcf\\xa2\\xd2\\x07\\x88o\\xeb\\x8d\\xad\\xbb\\xe5;w\\xfdms\\xed\\xc3\\x9a\\xdb\\x85\\xc9q-\\x08a\\xc8ni\\xb6\\xe5\\xf9a"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\xbe3\\x176\\xc6\r\\xd4n\\x81\\xfb\\xb2\\x96\\xf9~c\\xa2l\\xda0[\\x0fb>\\x1c\\xdc\\xc5\\xa5\\x97\\x08y\\xa3\\x8e\\x84x\\xfa\\x9b\\xed\\xbd\\x17\\xf9\\xad\\xb2guj\\xbc\\x12w\\x9cw\\x10\\xa5v\\x1e\\xb3`w\\x8c\\x0b`\\xff\\x13\\x12\\x8b\\x8e\\xc3\\x12@\\x7f\\x02\\x08u\\xcc\\xe4$\\xa7\\xbd!\\xfc\\x99\\x11\\x840c\\xdd\\xd8{h\\xae\\x8f\\x08\\xf0\\xac`\\xb4\\xbc^\\xb3\\x0b7\\x08\\xf7\\xf53\\x1a\\xa8\\xe0\\xdd\\xf1dg\\x8e\\xd1w\\x9e\\\\x19\\xbe\\xccumf\\xbbe\\x04\\x14{+\\x88\\xf8\\xa5j\\x0e\\xaa\\xcc\\x99\\xd0\\xf3-\\xa6\\xda\\xe8\\xb0kj5\\xea\\xa9\\x0b!\\xdb\\xb9(%\\xe2\\xb2r\\x1b\\xa1)\\x97\\x1ao\\x11i\\xb0\\x1c\\xce\\xd2\\xe9\\x8d|o\\xcc\\xd23d\\xf8\\x19\t'\\xc7i\\x1e\\xd9tx\\xab\\xa1l\\x91\\xb4p/:r\\x1a6dry\\xb3\\x96\\x9c\\xab\\xa6\\xf4\\xa1:o&\\xe3\\xe3\\x0ey7\\xdb\\xa4\\x87\\xcd\\x81q(}j'\\x1c\\x8d:\\x7fat\\xde|\\xa8\\xe4\\xe5a[\\xfd\\xb5e\\x95\\xc1\\xb47y3qxr"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\xca\\xc8o\\x14gr-\\xd8a{\\xed\\x17\\xdcp\\xe4c\\xf8q\\x10\\x8f\\x18.\\x8a)\\xd1y>\\xdf\\xdb#)f\\xe1j\\x85\\xeb/\\xb0\\x93\r?b\\xaay\\x91\\xfb<>k\\xb4tt|\\x0cmy\\xdbu\\x0e\\x10n\\xe9\\x8c\\xfdde\\x8f\\xff\\xa3\\x89\\x8c\\xec_um<\\xdc\\x10\\xb6ygb\\xa4\n\\xc4\\xb9)\\x93p\\x7f\\xce\t\\xdc\\xd9\\xa1\\x9au\\x9a\\xfb\\xad\\xebc<\\x13p\\x1c\\xbe\\x1d\\x1f\\xdchv\\xa4?t\\xfb>\\x85.\\xe6q\\xbf\\xac\\xdf\\xa32\\xf6\\x8ct\\xcf\\xc6]\\x93\\x95\\x93\\xc9-\\xfd=\\xc3]\\x05\\xb7\\x89l\\xc0\\xf1\\xb3\\xe7\\xd0\\xbb\\xf3\\xe1\\xc5\\x10\\xa2}`\\xa7\\x8e'$\\x11`j\\x9b\\x14$6^\\xc2_\\x95\\xb3\\xf2b\\xa9zf\\xc1\\x17{|\\xddf\\xeb\\x02[h\\xbddz\\xfb\\x11\\xfa\\xfe\\x1c\\xc6\\x95(9\\x98\\xe8+\\x11v7~l\\xf1\\xa7\\xab}\\xc7'\\x1b\\xac+\\xdb.\\xd2\\x01\\x83\\x13\\x06;\\xe1\\x96m\\x1d3\\xd40{\\xd1\\xc1)0o\\xa6:\\x18\\xcc\\xbez\\x80\\xbd\\xd4\\xc4\\xde\\x9f"
            }
        ]
    },
    {
        "Description": "Creates a hidden or system file",
        "Details": [
            {
                "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0001.tmp"
            }
        ]
    },
    {
        "Description": "File has been identified by 29 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
            },
            {
                "McAfee": "Exploit-CVE2017-11882.yx"
            },
            {
                "Arcabit": "Exploit.CVE-2017-11882.Gen"
            },
            {
                "Cyren": "CVE-2017-11882.E.gen!Camelot"
            },
            {
                "Symantec": "Exp.CVE-2017-11882!g3"
            },
            {
                "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
            },
            {
                "Avast": "Win32:ShellCode [Expl]"
            },
            {
                "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
            },
            {
                "BitDefender": "Exploit.CVE-2017-11882.Gen"
            },
            {
                "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
            },
            {
                "Sophos": "Troj/RtfExp-EQ"
            },
            {
                "DrWeb": "Exploit.ShellCode.69"
            },
            {
                "McAfee-GW-Edition": "Exploit-CVE2017-11882.yx"
            },
            {
                "FireEye": "Exploit.CVE-2017-11882.Gen"
            },
            {
                "Emsisoft": "Exploit.CVE-2017-11882.Gen (B)"
            },
            {
                "Ikarus": "Exploit.CVE-2017-11882"
            },
            {
                "GData": "Exploit.CVE-2017-11882.Gen (2x)"
            },
            {
                "Avira": "EXP/CVE-2017-11882.Gen"
            },
            {
                "Microsoft": "Trojan:O97M/Obfuse.AE"
            },
            {
                "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
            },
            {
                "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
            },
            {
                "ALYac": "Exploit.CVE-2017-11882.Gen"
            },
            {
                "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
            },
            {
                "Zoner": "Probably W97NativeOnly"
            },
            {
                "Rising": "Exploit.CVE-2017-11882!1.B40D (CLASSIC)"
            },
            {
                "MAX": "malware (ai score=94)"
            },
            {
                "Fortinet": "MSOffice/CVE_2017_11882.BB!exploit"
            },
            {
                "AVG": "Win32:ShellCode [Expl]"
            },
            {
                "Qihoo-360": "virus.exp.21711882.d"
            }
        ]
    },
    {
        "Description": "Created network traffic indicative of malicious activity",
        "Details": [
            {
                "signature": "ET TROJAN Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)"
            },
            {
                "signature": "ET TROJAN AZORult Variant.4 Checkin M2"
            }
        ]
    }
]

[*] Started Service: [
    "osppsvc"
]

[*] Executed Commands: [
    "C:\\Windows\\splwow64.exe 12288"
]

[*] Mutexes: [
    "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
    "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
    "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
    "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1",
    "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
    "Local\\WinSpl64To32Mutex_1b4a5_0_3000",
    "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000"
]

[*] Modified Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\RTF_31fa978dc1d4903cd86280858a6987e1.doc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_31fa978dc1d4903cd86280858a6987e1.doc",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{C74D9425-9A32-424E-8F7B-BEEC90D04512}.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{C3C607A4-BFCD-4EA8-99A3-DB7993CA01D9}.tmp",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\C1F52EFD459704E23E98B5C774A45162",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\C1F52EFD459704E23E98B5C774A45162",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\070C03D13B170C50ED5CDDF6BA1053A6",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\070C03D13B170C50ED5CDDF6BA1053A6",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab40A5.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar40A6.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0000.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0001.tmp"
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab40A5.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar40A6.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0001.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{C3C607A4-BFCD-4EA8-99A3-DB7993CA01D9}.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~$F_31fa978dc1d4903cd86280858a6987e1.doc",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\"
]

[*] Modified Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\odd",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\BC4771",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\BC4771\\BC4771",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime"
]

[*] Deleted Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\odd",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\v(b",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\BC4771\\BC4771"
]

[*] DNS Communications: [
    {
        "type": "A",
        "request": "blogmason.mixh.jp",
        "answers": [
            {
                "data": "150.95.52.111",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "ak3indonesia.com",
        "answers": [
            {
                "data": "103.229.72.54",
                "type": "A"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "150.95.52.111",
        "domain": "blogmason.mixh.jp"
    },
    {
        "ip": "103.229.72.54",
        "domain": "ak3indonesia.com"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.usertrust.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.msocsp.com",
        "version": "1.1",
        "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.comodoca.com",
        "version": "1.1",
        "path": "/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY",
        "data": "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "J/\\xfb5/\\xfb<L\\x8a(9\\xf0N/\\xfb;/\\xfaI/\\xfb=H\\x8aH/\\xfb;O\\xed>;\\xed>2\\xed?N\\xed><\\x8eN/\\xfb4H\\xed>?\\x8cO/\\xfaI/\\xfb8/\\xfb>/\\xfb;N\\x89(9\\xfc(9\\xfd(9\\xfd(8\\x8c(9\\xf1(9\\xfb(9\\xfb(9\\xf1(9\\xfc(9\\xfe(9\\xff(9\\xfa(9\\xfe",
        "uri": "http://ak3indonesia.com/wp-content/klunn/32/index.php",
        "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
        "method": "POST",
        "host": "ak3indonesia.com",
        "version": "1.1",
        "path": "/wp-content/klunn/32/index.php",
        "data": "POST /wp-content/klunn/32/index.php HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nHost: ak3indonesia.com\r\nContent-Length: 105\r\nCache-Control: no-cache\r\n\r\nJ/\\xfb5/\\xfb<L\\x8a(9\\xf0N/\\xfb;/\\xfaI/\\xfb=H\\x8aH/\\xfb;O\\xed>;\\xed>2\\xed?N\\xed><\\x8eN/\\xfb4H\\xed>?\\x8cO/\\xfaI/\\xfb8/\\xfb>/\\xfb;N\\x89(9\\xfc(9\\xfd(9\\xfd(8\\x8c(9\\xf1(9\\xfb(9\\xfb(9\\xf1(9\\xfc(9\\xfe(9\\xff(9\\xfa(9\\xfe",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "mscrl.microsoft.com",
        "version": "1.1",
        "path": "/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
        "data": "GET /pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: mscrl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ak3indonesia.com/wp-content/klunn/32/index.php",
        "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
        "method": "POST",
        "host": "ak3indonesia.com",
        "version": "1.1",
        "path": "/wp-content/klunn/32/index.php",
        "data": "POST /wp-content/klunn/32/index.php HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nHost: ak3indonesia.com\r\nContent-Length: 52098\r\nCache-Control: no-cache\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl",
        "data": "GET /pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%201.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {}

[*] Resolved APIs: [
    "mso.dll.#1443",
    "mso.dll.#9214",
    "mso.dll.#199",
    "mso.dll.#1073",
    "mso.dll.#4255",
    "mso.dll.#3459",
    "mso.dll.#1262",
    "mso.dll.#5709",
    "mso.dll.#7353",
    "mso.dll.#5228",
    "mso.dll.#2155",
    "mso.dll.#1725",
    "user32.dll.RegisterWindowMessageW",
    "ws2_32.dll.#6",
    "ws2_32.dll.#5",
    "schannel.dll.SpUserModeInitialize",
    "advapi32.dll.RegCreateKeyExW",
    "advapi32.dll.RegQueryValueExW",
    "advapi32.dll.RegCloseKey",
    "ws2_32.dll.WSASend",
    "ws2_32.dll.WSARecv",
    "mso.dll.#4314",
    "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
    "mso.dll.#6484",
    "mso.dll.#8499",
    "mso.dll.#9871",
    "mso.dll.#4743",
    "mso.dll.#5452",
    "mso.dll.#2088",
    "mso.dll.#5274",
    "mso.dll.#3195",
    "mso.dll.#8165",
    "mso.dll.#9175",
    "mso.dll.#5315",
    "mso.dll.#8140",
    "user32.dll.IsWindowEnabled",
    "ole32.dll.CoGetCallState",
    "ole32.dll.CoGetActivationState",
    "advapi32.dll.RegisterWaitChainCOMCallback",
    "secur32.dll.FreeContextBuffer",
    "ncrypt.dll.SslOpenProvider",
    "ncrypt.dll.GetSChannelInterface",
    "bcryptprimitives.dll.GetHashInterface",
    "ncrypt.dll.SslIncrementProviderReferenceCount",
    "ncrypt.dll.SslImportKey",
    "bcryptprimitives.dll.GetCipherInterface",
    "ncrypt.dll.SslLookupCipherSuiteInfo",
    "user32.dll.LoadStringW",
    "ncrypt.dll.BCryptOpenAlgorithmProvider",
    "ncrypt.dll.BCryptGetProperty",
    "ncrypt.dll.BCryptCreateHash",
    "ncrypt.dll.BCryptHashData",
    "ncrypt.dll.BCryptFinishHash",
    "ncrypt.dll.BCryptDestroyHash",
    "crypt32.dll.CertGetCertificateChain",
    "userenv.dll.GetUserProfileDirectoryW",
    "sechost.dll.ConvertSidToStringSidW",
    "sechost.dll.ConvertStringSidToSidW",
    "userenv.dll.RegisterGPNotification",
    "gpapi.dll.RegisterGPNotificationInternal",
    "sechost.dll.OpenSCManagerW",
    "sechost.dll.OpenServiceW",
    "sechost.dll.CloseServiceHandle",
    "sechost.dll.QueryServiceConfigW",
    "cryptsp.dll.CryptAcquireContextA",
    "cryptsp.dll.CryptCreateHash",
    "cryptsp.dll.CryptHashData",
    "cryptsp.dll.CryptVerifySignatureA",
    "cryptsp.dll.CryptDestroyKey",
    "cryptsp.dll.CryptDestroyHash",
    "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
    "ncrypt.dll.BCryptImportKeyPair",
    "ncrypt.dll.BCryptVerifySignature",
    "ncrypt.dll.BCryptDestroyKey",
    "crypt32.dll.CertVerifyCertificateChainPolicy",
    "crypt32.dll.CertFreeCertificateChain",
    "crypt32.dll.CertDuplicateCertificateContext",
    "ncrypt.dll.SslEncryptPacket",
    "ncrypt.dll.SslDecryptPacket",
    "winhttp.dll.WinHttpReceiveResponse",
    "winhttp.dll.WinHttpQueryHeaders",
    "winhttp.dll.WinHttpQueryDataAvailable",
    "winhttp.dll.WinHttpReadData",
    "webservices.dll.WsCreateError",
    "ntdll.dll.EtwEventWrite",
    "ntdll.dll.EtwEventRegister",
    "ntdll.dll.EtwEventUnregister",
    "webservices.dll.WsCreateHeap",
    "webservices.dll.WsCreateReader",
    "webservices.dll.WsSetInput",
    "webservices.dll.WsFillReader",
    "webservices.dll.WsReadToStartElement",
    "webservices.dll.WsReadStartElement",
    "webservices.dll.WsReadType",
    "winhttp.dll.WinHttpCloseHandle",
    "crypt32.dll.CertFreeCertificateContext",
    "rpcrt4.dll.RpcBindingFree",
    "webservices.dll.WsFreeReader",
    "webservices.dll.WsFreeError",
    "webservices.dll.WsFreeHeap",
    "webservices.dll.WsCreateServiceProxyFromTemplate",
    "winhttp.dll.WinHttpOpenRequest",
    "winhttp.dll.WinHttpAddRequestHeaders",
    "winhttp.dll.WinHttpSendRequest",
    "winhttp.dll.WinHttpConnect",
    "winhttp.dll.WinHttpCrackUrl",
    "winhttp.dll.WinHttpSetStatusCallback",
    "winhttp.dll.WinHttpOpen",
    "winhttp.dll.WinHttpSetOption",
    "winhttp.dll.WinHttpWriteData",
    "winhttp.dll.WinHttpSetCredentials",
    "winhttp.dll.WinHttpQueryAuthSchemes",
    "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
    "winhttp.dll.WinHttpGetProxyForUrl",
    "winhttp.dll.WinHttpQueryOption",
    "webservices.dll.WsOpenServiceProxy",
    "webservices.dll.WsCall",
    "webservices.dll.WsAddCustomHeader",
    "shlwapi.dll.StrStrA",
    "shlwapi.dll.UrlUnescapeA",
    "cryptnet.dll.CertDllVerifyRevocation",
    "profapi.dll.#104",
    "sensapi.dll.IsNetworkAlive",
    "rpcrt4.dll.RpcBindingFromStringBindingW",
    "rpcrt4.dll.RpcBindingSetAuthInfoExW",
    "rpcrt4.dll.NdrClientCall2",
    "winhttp.dll.WinHttpSetTimeouts",
    "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
    "winhttp.dll.WinHttpTimeFromSystemTime",
    "shlwapi.dll.StrStrIW",
    "user32.dll.RegisterPowerSettingNotification",
    "powrprof.dll.PowerSettingRegisterNotification",
    "user32.dll.GetWindowThreadProcessId",
    "user32.dll.GetWindowTextW",
    "mso.dll.#25",
    "mso.dll.#1056",
    "mso.dll.#8136",
    "mso.dll.#8931",
    "shell32.dll.SHGetFileInfoW",
    "mso.dll.#5362",
    "mso.dll.#6044",
    "mso.dll.#6516",
    "mso.dll.#6221",
    "mso.dll.#5780",
    "mso.dll.#4870",
    "mso.dll.#6046",
    "mso.dll.#1241",
    "mso.dll.#2821",
    "mso.dll.#2340",
    "mso.dll.#7287",
    "mso.dll.#5290",
    "mso.dll.#1508",
    "user32.dll.IsZoomed",
    "user32.dll.GetWindowPlacement",
    "user32.dll.GetWindowRect",
    "mso.dll.#821",
    "user32.dll.GetSystemMetrics",
    "user32.dll.MonitorFromWindow",
    "user32.dll.MonitorFromRect",
    "user32.dll.MonitorFromPoint",
    "user32.dll.EnumDisplayMonitors",
    "user32.dll.GetMonitorInfoA",
    "user32.dll.EnumDisplayDevicesA",
    "mso.dll.#2378",
    "user32.dll.SetWindowPos",
    "user32.dll.AdjustWindowRect",
    "mso.dll.#5912",
    "mso.dll.#9719",
    "mso.dll.#8824",
    "mso.dll.#6117",
    "mso.dll.#3307",
    "user32.dll.SendMessageW",
    "user32.dll.DestroyIcon",
    "mso.dll.#3813",
    "mso.dll.#1815",
    "user32.dll.PtInRect",
    "mso.dll.#1613",
    "user32.dll.SetWindowTextW",
    "user32.dll.GetClassLongW",
    "mso.dll.#8572",
    "gdi32.dll.CreateDIBSection",
    "gdi32.dll.CreateCompatibleDC",
    "gdi32.dll.GetViewportOrgEx",
    "gdi32.dll.SetViewportOrgEx",
    "gdi32.dll.SetBkColor",
    "gdi32.dll.ExtTextOutA",
    "mso.dll.#1573",
    "mso.dll.#8612",
    "user32.dll.SetScrollRange",
    "mso.dll.#2509",
    "user32.dll.BeginDeferWindowPos",
    "user32.dll.DeferWindowPos",
    "user32.dll.EndDeferWindowPos",
    "gdi32.dll.DeleteDC",
    "user32.dll.OffsetRect",
    "user32.dll.EnumChildWindows",
    "user32.dll.GetScrollInfo",
    "user32.dll.MapWindowPoints",
    "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
    "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
    "mso.dll.#6126",
    "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
    "gdi32.dll.GetFontRealizationInfo",
    "gdi32.dll.GetFontFileInfo",
    "gdi32.dll.GetFontFileData",
    "mso.dll.#7261",
    "mso.dll.#9540",
    "usp10.dll.ScriptGetFontScriptTags",
    "usp10.dll.ScriptGetFontLanguageTags",
    "usp10.dll.ScriptGetFontFeatureTags",
    "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
    "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
    "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
    "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
    "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
    "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
    "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
    "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
    "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
    "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
    "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
    "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
    "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
    "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
    "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
    "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
    "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
    "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
    "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
    "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
    "user32.dll.SetRectEmpty",
    "user32.dll.InflateRect",
    "mso.dll.#1100",
    "mso.dll.#7047",
    "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
    "user32.dll.GetCursor",
    "user32.dll.GetClientRect",
    "user32.dll.SetScrollInfo",
    "user32.dll.SetScrollPos",
    "mso.dll.#3747",
    "mso.dll.#8218",
    "mso.dll.#5394",
    "mso.dll.#331",
    "mso.dll.#6829",
    "mso.dll.#539",
    "mso.dll.#4959",
    "mso.dll.#6463",
    "mso.dll.#4987",
    "user32.dll.GetWindow",
    "mso.dll.#7195",
    "mso.dll.#7573",
    "mso.dll.#445",
    "user32.dll.GetCaretBlinkTime",
    "user32.dll.CreateCaret",
    "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
    "user32.dll.IntersectRect",
    "user32.dll.DestroyCaret",
    "user32.dll.GetCaretPos",
    "user32.dll.SetCaretPos",
    "mso.dll.#5932",
    "mso.dll.#2071",
    "mso.dll.#1024",
    "mso.dll.#6245",
    "mso.dll.#9041",
    "mso.dll.#1767",
    "mso.dll.#9369",
    "mso.dll.#4617",
    "user32.dll.FillRect",
    "mso.dll.#343",
    "mso.dll.#9636",
    "mso.dll.#2022",
    "mso.dll.#4750",
    "mso.dll.#4577",
    "user32.dll.IsHungAppWindow",
    "mso.dll.#850",
    "shell32.dll.SHAddToRecentDocs",
    "mso.dll.#1776",
    "mso.dll.#9026",
    "mso.dll.#4497",
    "mso.dll.#4647",
    "mso.dll.#8926",
    "mso.dll.#7212",
    "mso.dll.#5407",
    "mso.dll.#5152",
    "mso.dll.#3327",
    "mso.dll.#6333",
    "mso.dll.#420",
    "mso.dll.#1335",
    "mso.dll.#2041",
    "mso.dll.#7834",
    "mso.dll.#239",
    "mso.dll.#6357",
    "mso.dll.#7026",
    "mso.dll.#1671",
    "oleaut32.dll.#7",
    "mso.dll.#8263",
    "mso.dll.#9307",
    "mso.dll.#1441",
    "ole32.dll.PropVariantClear",
    "oleaut32.dll.#9",
    "mso.dll.#9223",
    "mso.dll.#6453",
    "mso.dll.#8044",
    "mso.dll.#3698",
    "mso.dll.#8565",
    "mso.dll.#8373",
    "mso.dll.#9741",
    "mso.dll.#478",
    "mso.dll.#479",
    "mso.dll.#340",
    "bcrypt.dll.BCryptOpenAlgorithmProvider",
    "bcrypt.dll.BCryptGetProperty",
    "bcrypt.dll.BCryptCreateHash",
    "bcrypt.dll.BCryptHashData",
    "bcrypt.dll.BCryptFinishHash",
    "bcrypt.dll.BCryptDestroyHash",
    "bcrypt.dll.BCryptCloseAlgorithmProvider",
    "mso.dll.#8633",
    "mso.dll.#5213",
    "mso.dll.#6163",
    "mso.dll.#552",
    "mso.dll.#5630",
    "mso.dll.#2513",
    "mso.dll.#1607",
    "mso.dll.#791",
    "mso.dll.#1848",
    "mso.dll.#8735",
    "mso.dll.#9374",
    "mso.dll.#5286",
    "mso.dll.#6368",
    "mso.dll.#4262",
    "mso.dll.#1010",
    "mso.dll.#7979",
    "mso.dll.#8549",
    "mso.dll.#8970",
    "mso.dll.#9198",
    "mso.dll.#4795",
    "mso.dll.#1865",
    "mso.dll.#9688",
    "mso.dll.#320",
    "advapi32.dll.RegDeleteKeyA",
    "user32.dll.DestroyCursor",
    "mso.dll.#7173",
    "mso.dll.#8511",
    "mso.dll.#3299",
    "mso.dll.#7001",
    "mso.dll.#3913",
    "user32.dll.PeekMessageA",
    "mso.dll.#1380",
    "mso.dll.#9500",
    "user32.dll.TranslateMessage",
    "user32.dll.IsWindowUnicode",
    "user32.dll.DispatchMessageA",
    "user32.dll.DispatchMessageW",
    "user32.dll.UpdateWindow",
    "mso.dll.#999",
    "mso.dll.#287",
    "dwmapi.dll.DwmIsCompositionEnabled",
    "mso.dll.#1575",
    "mso.dll.#5034",
    "mso.dll.#1517",
    "mso.dll.#718",
    "mso.dll.#4708",
    "mso.dll.#8046",
    "mso.dll.#4175",
    "mso.dll.#8672",
    "mso.dll.#1990",
    "mso.dll.#3051",
    "mso.dll.#1819",
    "mso.dll.#1419",
    "oleaut32.dll.#147",
    "kernel32.dll.WerRegisterMemoryBlock",
    "dwrite.dll.DWriteCreateFactory",
    "gdi32.dll.GetCurrentObject",
    "gdi32.dll.BitBlt",
    "gdi32.dll.GetClipBox",
    "gdi32.dll.StretchDIBits",
    "riched20.dll.REExtendedRegisterClass",
    "user32.dll.GetWindowLongW",
    "user32.dll.GetSysColor",
    "user32.dll.SetWindowLongW",
    "user32.dll.RegisterWindowMessageA",
    "user32.dll.RegisterClipboardFormatW",
    "user32.dll.GetDoubleClickTime",
    "user32.dll.SetCaretBlinkTime",
    "user32.dll.SystemParametersInfoW",
    "user32.dll.GetKeyboardLayoutList",
    "mso.dll._MsoGetFidUspDll@0",
    "mso.dll._MsoLoadLocalizedLibraryEx@12",
    "usp10.dll.ScriptGetProperties",
    "usp10.dll.ScriptItemize",
    "user32.dll.LoadCursorW",
    "user32.dll.IsWindowVisible",
    "user32.dll.GetKeyboardLayout",
    "user32.dll.PostMessageW",
    "user32.dll.DefWindowProcW",
    "uxtheme.dll.IsThemeActive",
    "uxtheme.dll.IsAppThemed",
    "uxtheme.dll.OpenThemeData",
    "user32.dll.GetDC",
    "user32.dll.ReleaseDC",
    "user32.dll.IsIconic",
    "user32.dll.GetParent",
    "usp10.dll.ScriptGetCMap",
    "user32.dll.InvalidateRect",
    "user32.dll.HideCaret",
    "user32.dll.ShowCaret",
    "user32.dll.NotifyWinEvent",
    "user32.dll.GetWindowTextLengthW",
    "user32.dll.EnableWindow",
    "msctf.dll.SetInputScope",
    "user32.dll.GetWindowRgn",
    "gdi32.dll.CreateCompatibleBitmap",
    "gdi32.dll.SaveDC",
    "gdi32.dll.SetPixel",
    "gdi32.dll.GetPixel",
    "gdi32.dll.RestoreDC",
    "imm32.dll.ImmAssociateContext",
    "mso.dll.#806",
    "mso.dll.#4908",
    "user32.dll.SetRect",
    "mso.dll.#8439",
    "mso.dll.#2736",
    "gdi32.dll.GetTextAlign",
    "gdi32.dll.ExtTextOutW",
    "mso.dll.#8122",
    "mso.dll.#2114",
    "advapi32.dll.RegQueryValueW",
    "apphelp.dll.ApphelpCheckShellObject",
    "mso.dll.#6558",
    "gdi32.dll.GetFontData",
    "usp10.dll.ScriptItemizeOpenType",
    "usp10.dll.ScriptShapeOpenType",
    "usp10.dll.ScriptPlaceOpenType",
    "mso.dll.#8395",
    "mso.dll.#379",
    "mso.dll.#6338",
    "advapi32.dll.RegDeleteTreeW",
    "mso.dll.#7964",
    "mso.dll.#1437",
    "mso.dll.#1427",
    "xmllite.dll.CreateXmlReader",
    "ole32.dll.CoRevokeInitializeSpy",
    "comctl32.dll.#388",
    "mso.dll.#6137",
    "winmm.dll.timeGetTime",
    "mso.dll.#5940",
    "usp10.dll.ScriptPlace",
    "usp10.dll.ScriptShape",
    "usp10.dll.ScriptJustify",
    "usp10.dll.ScriptTextOut",
    "usp10.dll.ScriptCPtoX",
    "usp10.dll.ScriptXtoCP",
    "usp10.dll.ScriptFreeCache",
    "usp10.dll.ScriptCacheGetHeight",
    "usp10.dll.ScriptLayout",
    "usp10.dll.ScriptBreak",
    "usp10.dll.ScriptIsComplex",
    "usp10.dll.ScriptGetLogicalWidths",
    "usp10.dll.ScriptApplyLogicalWidth",
    "usp10.dll.ScriptGetGlyphABCWidth",
    "usp10.dll.ScriptGetFontProperties",
    "usp10.dll.ScriptApplyDigitSubstitution",
    "usp10.dll.ScriptRecordDigitSubstitution",
    "usp10.dll.ScriptGetFontAlternateGlyphs",
    "mso.dll.#7578",
    "mso.dll.#8483",
    "mso.dll.#2613",
    "gdi32.dll.GdiIsMetaPrintDC",
    "mso.dll.#7848",
    "user32.dll.GetForegroundWindow",
    "user32.dll.GetFocus",
    "user32.dll.GetClassNameA",
    "user32.dll.IsWindowRedirectedForPrint",
    "gdi32.dll.CreateRectRgnIndirect",
    "user32.dll.GetUpdateRgn",
    "gdi32.dll.GetRgnBox",
    "user32.dll.ValidateRect",
    "user32.dll.GetUpdateRect",
    "user32.dll.BeginPaint",
    "user32.dll.EndPaint",
    "mso.dll.#3624",
    "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
    "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
    "mso.dll.#6247",
    "gdi32.dll.TranslateCharsetInfo",
    "mso.dll.#3300",
    "mso.dll.#7465",
    "gdi32.dll.SetWindowOrgEx",
    "mso.dll.#732",
    "mso.dll.#5804",
    "mso.dll.#9465",
    "ole32.dll.CoCreateInstance",
    "mso.dll.#434",
    "user32.dll.GetMessageExtraInfo",
    "user32.dll.TrackMouseEvent",
    "mso.dll.#4746",
    "user32.dll.IsWindow",
    "user32.dll.GetInputState",
    "mso.dll.#8461",
    "ws2_32.dll.#116",
    "user32.dll.GetWindowDC",
    "gdi32.dll.SetLayout",
    "gdi32.dll.RectVisible",
    "gdi32.dll.GetClipRgn",
    "gdi32.dll.ExcludeClipRect",
    "gdi32.dll.SelectClipRgn",
    "mso.dll.#1414",
    "cryptnet.dll.I_CryptNetGetConnectivity",
    "mso.dll.#7531",
    "mso.dll.#8202",
    "cryptnet.dll.CryptRetrieveObjectByUrlW",
    "user32.dll.InSendMessage",
    "ws2_32.dll.#3",
    "ws2_32.dll.WSAGetOverlappedResult",
    "setupapi.dll.SetupIterateCabinetW",
    "kernel32.dll.RegOpenKeyExW",
    "ncrypt.dll.SslDecrementProviderReferenceCount",
    "ncrypt.dll.SslFreeObject",
    "kernel32.dll.RegCloseKey",
    "cabinet.dll.#20",
    "cabinet.dll.#22",
    "devrtl.dll.DevRtlGetThreadLogToken",
    "mso.dll.#7651",
    "mso.dll.#5071",
    "mso.dll.#2802",
    "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
    "cryptsp.dll.CryptSetHashParam",
    "mso.dll.#4111",
    "mso.dll.#1455",
    "user32.dll.GetAncestor",
    "user32.dll.GetDesktopWindow",
    "sechost.dll.QueryServiceConfigA",
    "sechost.dll.QueryServiceStatus",
    "rpcrt4.dll.RpcStringBindingComposeA",
    "rpcrt4.dll.RpcBindingFromStringBindingA",
    "rpcrt4.dll.RpcEpResolveBinding",
    "sechost.dll.LookupAccountSidLocalW",
    "rpcrt4.dll.RpcStringFreeA",
    "gdi32.dll.GetViewportExtEx",
    "gdi32.dll.GetWindowExtEx",
    "gdi32.dll.GetMapMode",
    "gdi32.dll.GetLayout",
    "user32.dll.GetCapture",
    "user32.dll.SetFocus",
    "user32.dll.MoveWindow",
    "user32.dll.GetMessageW",
    "user32.dll.GetClipboardOwner",
    "user32.dll.WindowFromPoint",
    "gdi32.dll.IntersectClipRect",
    "gdi32.dll.SetTextColor",
    "gdi32.dll.SetBkMode",
    "gdi32.dll.ExtSelectClipRgn",
    "uxtheme.dll.DrawThemeBackground",
    "gdi32.dll.GetTextColor",
    "user32.dll.GetLastInputInfo",
    "user32.dll.WaitMessage",
    "mso.dll.#2386",
    "advapi32.dll.RegisterEventSourceW",
    "advapi32.dll.ReportEventW",
    "advapi32.dll.DeregisterEventSource",
    "mso.dll.#816",
    "mso.dll.#511",
    "mso.dll.#5360",
    "mso.dll.#8574",
    "msi.dll.#39",
    "mso.dll.#8318",
    "mso.dll.#1283",
    "mso.dll.#8705",
    "mso.dll.#9685",
    "mso.dll.#3579",
    "mso.dll.#8747",
    "mso.dll.#4219",
    "mso.dll.#3244",
    "mso.dll.#2620",
    "shell32.dll.SHGetKnownFolderPath",
    "mso.dll.#9748",
    "mso.dll.#3496",
    "mso.dll.#2901",
    "mso.dll.#7830",
    "mso.dll.#5396",
    "mso.dll.#6895",
    "mso.dll.#8986",
    "mso.dll.#7945",
    "mso.dll.#408",
    "mso.dll.#2714",
    "mso.dll.#8622",
    "mso.dll.#3380",
    "mso.dll.#2566",
    "mso.dll.#1429",
    "mso.dll.#6502",
    "mso.dll.#2968",
    "advapi32.dll.NotifyServiceStatusChangeW",
    "webservices.dll.WsResetHeap",
    "webservices.dll.WsCloseServiceProxy",
    "webservices.dll.WsFreeServiceProxy",
    "advapi32.dll.CryptAcquireContextA",
    "advapi32.dll.CryptGenKey",
    "cryptsp.dll.CryptGenKey",
    "advapi32.dll.CryptImportKey",
    "cryptsp.dll.CryptImportKey",
    "advapi32.dll.CryptExportKey",
    "cryptsp.dll.CryptExportKey",
    "advapi32.dll.CryptDestroyKey",
    "advapi32.dll.CryptCreateHash",
    "advapi32.dll.CryptSetHashParam",
    "advapi32.dll.CryptHashData",
    "advapi32.dll.CryptGetHashParam",
    "cryptsp.dll.CryptGetHashParam",
    "advapi32.dll.CryptDestroyHash",
    "msi.dll.#90",
    "mso.dll.#8837",
    "mso.dll.#709",
    "mso.dll.#5913",
    "mso.dll.#8051",
    "mso.dll.#2052",
    "mso.dll.#988",
    "mso.dll.#7778",
    "mso.dll.#6429",
    "mso.dll.#5667",
    "mso.dll.#5127",
    "mso.dll.#5177",
    "mso.dll.#7590",
    "mso.dll.#8060",
    "mso.dll.#5925",
    "mso.dll.#3500",
    "mso.dll.#3334",
    "mso.dll.#7320",
    "mso.dll.#9639",
    "mso.dll.#9436",
    "mso.dll.#6584",
    "winspool.drv.OpenPrinterW",
    "rpcrt4.dll.RpcStringBindingComposeW",
    "rpcrt4.dll.RpcStringFreeW",
    "mso.dll.#8424",
    "winspool.drv.GetPrinterW",
    "mso.dll.#3339",
    "winspool.drv.DocumentPropertiesW",
    "rpcrt4.dll.RpcMgmtIsServerListening",
    "mso.dll.#3230",
    "winspool.drv.ClosePrinter",
    "mso.dll.#867",
    "winspool.drv.DeviceCapabilitiesW",
    "mso.dll.#1696",
    "gdi32.dll.CreateDCW",
    "winspool.drv.StartDocDlgW",
    "winspool.drv.ResetPrinterW",
    "winspool.drv.GetPrinterDriverW",
    "winspool.drv.EndDocPrinter",
    "winspool.drv.EndPagePrinter",
    "winspool.drv.ReadPrinter",
    "winspool.drv.StartDocPrinterW",
    "winspool.drv.StartPagePrinter",
    "winspool.drv.AbortPrinter",
    "winspool.drv.DocumentEvent",
    "winspool.drv.QuerySpoolMode",
    "winspool.drv.QueryRemoteFonts",
    "winspool.drv.SeekPrinter",
    "winspool.drv.QueryColorProfile",
    "winspool.drv.SplDriverUnloadComplete",
    "winspool.drv.#224",
    "winspool.drv.IsValidDevmodeW",
    "winspool.drv.GetSpoolFileHandle",
    "winspool.drv.CommitSpoolData",
    "winspool.drv.CloseSpoolFileHandle",
    "winspool.drv.#205",
    "user32.dll.MsgWaitForMultipleObjectsEx",
    "mso.dll.#7938",
    "mso.dll.#8693",
    "msptls.dll.?LsAssert@Ptls6@@YGXH@Z",
    "msptls.dll.?FsQuerySectionBasicColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfstrackdescription@1@PAJ@Z",
    "mso.dll.#2175",
    "gdiplus.dll.GdipRecordMetafileI",
    "gdi32.dll.Escape",
    "gdiplus.dll.GdipSetMetafileDownLevelRasterizationLimit",
    "gdiplus.dll.GdipGetImageGraphicsContext",
    "gdiplus.dll.GdipSetPixelOffsetMode",
    "gdiplus.dll.GdipSetSmoothingMode",
    "gdiplus.dll.GdipSetCompositingQuality",
    "gdiplus.dll.GdipSetPageUnit",
    "gdiplus.dll.GdipSetInterpolationMode",
    "mso.dll.#7678",
    "gdiplus.dll.GdipGetDC",
    "mso.dll.#2213",
    "mso.dll.#2053",
    "gdi32.dll.GetTextCharset",
    "mso.dll.#5390",
    "mso.dll.#5285",
    "mso.dll.#136",
    "gdi32.dll.LPtoDP",
    "gdiplus.dll.GdipCreateMatrix3",
    "gdiplus.dll.GdipReleaseDC",
    "gdiplus.dll.GdipSetWorldTransform",
    "gdiplus.dll.GdipDeleteMatrix",
    "gdiplus.dll.GdipDeleteGraphics",
    "gdiplus.dll.GdipGetHemfFromMetafile",
    "gdiplus.dll.GdipDisposeImage",
    "gdiplus.dll.GdipEmfToWmfBits",
    "gdi32.dll.GetTransform",
    "gdi32.dll.SetVirtualResolution",
    "gdi32.dll.IsValidEnhMetaRecord",
    "gdi32.dll.IsValidEnhMetaRecordOffExt",
    "gdi32.dll.SetMetaFileBitsEx",
    "gdi32.dll.DeleteEnhMetaFile",
    "mso.dll.#8472",
    "mso.dll.#2281",
    "mso.dll.#2628",
    "mso.dll.#3425",
    "mso.dll.#5291",
    "mso.dll.#1718",
    "mso.dll.#4777",
    "mso.dll.#3258",
    "mso.dll.#7974",
    "mso.dll.#2609",
    "mso.dll.#7366",
    "mso.dll.#4416",
    "mso.dll.#4008",
    "mso.dll.#5541",
    "advapi32.dll.GetFileSecurityW",
    "advapi32.dll.SetFileSecurityW",
    "advapi32.dll.GetSecurityInfo",
    "advapi32.dll.SetSecurityInfo",
    "advapi32.dll.GetSecurityDescriptorControl",
    "mso.dll.#2955",
    "mso.dll.#629",
    "mso.dll.#1401",
    "mso.dll.#5919",
    "mso.dll.#4597",
    "mso.dll.#7189",
    "mso.dll.#2738",
    "mso.dll.#8691",
    "mso.dll.#6079",
    "mso.dll.#7167",
    "mso.dll.#7163",
    "mso.dll.#333",
    "mso.dll.#1785",
    "mso.dll.#4281",
    "uiautomationcore.dll.UiaClientsAreListening",
    "user32.dll.DestroyWindow",
    "user32.dll.RemovePropW",
    "mso.dll.#5973",
    "mso.dll.#2014",
    "mso.dll.#9668",
    "mso.dll.#2294",
    "mso.dll.#1966",
    "mso.dll.#1914",
    "advapi32.dll.RegDeleteKeyW",
    "mso.dll.#235",
    "mso.dll.#9398",
    "mso.dll.#1442",
    "mso.dll.#4388",
    "mso.dll.#8022",
    "mso.dll.#6889",
    "mso.dll.#3633",
    "gdi32.dll.GetTextExtentPointA",
    "user32.dll.MessageBeep",
    "user32.dll.SetCursor",
    "user32.dll.DialogBoxIndirectParamW",
    "comctl32.dll.RegisterClassNameW",
    "uxtheme.dll.EnableThemeDialogTexture",
    "uxtheme.dll.GetThemeBool",
    "user32.dll.GetDlgItem",
    "mso.dll.#6900",
    "user32.dll.CallNextHookEx",
    "uxtheme.dll.BufferedPaintInit",
    "uxtheme.dll.BufferedPaintRenderAnimation",
    "uxtheme.dll.GetThemeTransitionDuration",
    "uxtheme.dll.BeginBufferedAnimation",
    "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
    "uxtheme.dll.DrawThemeParentBackground",
    "uxtheme.dll.GetThemeBackgroundContentRect",
    "uxtheme.dll.DrawThemeText",
    "uxtheme.dll.EndBufferedAnimation",
    "user32.dll.GetDlgCtrlID",
    "user32.dll.IsDlgButtonChecked",
    "user32.dll.EndDialog",
    "uxtheme.dll.CloseThemeData",
    "uxtheme.dll.BufferedPaintStopAllAnimations",
    "uxtheme.dll.BufferedPaintUnInit",
    "user32.dll.UnhookWindowsHookEx",
    "user32.dll.SetActiveWindow",
    "user32.dll.EnumThreadWindows",
    "user32.dll.EnumWindows",
    "mso.dll.#6489",
    "mso.dll.#613",
    "user32.dll.IsClipboardFormatAvailable",
    "user32.dll.ScreenToClient",
    "user32.dll.GetCursorInfo",
    "mso.dll.#3144",
    "mso.dll.#1213",
    "mso.dll.#4220",
    "mso.dll.#3214",
    "mso.dll.#6521",
    "user32.dll.LoadImageW",
    "user32.dll.CreateWindowExW",
    "comctl32.dll.HIMAGELIST_QueryInterface",
    "comctl32.dll.DrawShadowText",
    "comctl32.dll.DrawSizeBox",
    "comctl32.dll.DrawScrollBar",
    "comctl32.dll.SizeBoxHwnd",
    "comctl32.dll.ScrollBar_MouseMove",
    "comctl32.dll.ScrollBar_Menu",
    "comctl32.dll.HandleScrollCmd",
    "comctl32.dll.DetachScrollBars",
    "comctl32.dll.AttachScrollBars",
    "comctl32.dll.CCSetScrollInfo",
    "comctl32.dll.CCGetScrollInfo",
    "comctl32.dll.CCEnableScrollBar",
    "comctl32.dll.QuerySystemGestureStatus",
    "uxtheme.dll.#49",
    "user32.dll.EnableScrollBar",
    "user32.dll.ShowScrollBar",
    "user32.dll.ShowWindow",
    "user32.dll.SetParent",
    "user32.dll.KillTimer",
    "user32.dll.ClientToScreen",
    "oleaut32.dll.SysAllocString",
    "oleaut32.dll.SysStringLen",
    "oleaut32.dll.SysAllocStringLen",
    "oleaut32.dll.SysFreeString",
    "uxtheme.dll.GetThemePartSize",
    "user32.dll.FindWindowExW",
    "gdi32.dll.SetTextAlign",
    "wininet.dll.InternetGetConnectedState",
    "rasapi32.dll.RasConnectionNotificationW",
    "sechost.dll.NotifyServiceStatusChangeA",
    "cryptsp.dll.CryptAcquireContextW",
    "osppcext.dll.SLActivateProduct",
    "gdi32.dll.GdiFlush",
    "osppcext.dll.SLGetTokenActivationGrants",
    "osppcext.dll.SLGetTokenActivationCertificates",
    "osppcext.dll.SLGenerateTokenActivationChallenge",
    "osppcext.dll.SLSignTokenActivationChallenge",
    "osppcext.dll.SLDepositTokenActivationResponse",
    "osppcext.dll.SLFreeTokenActivationGrants",
    "osppcext.dll.SLFreeTokenActivationCertificates",
    "advapi32.dll.ConvertSidToStringSidW",
    "msi.dll.DllGetVersion",
    "msi.dll.#111",
    "mso.dll.#6344",
    "mso.dll.#9099",
    "mso.dll.#8320",
    "mso.dll.#7770",
    "mso.dll.#6216",
    "mso.dll.#3544",
    "mso.dll.#900",
    "mso.dll.#1422",
    "mso.dll.#2133",
    "gdi32.dll.ResetDCW",
    "user32.dll.GetClassNameW",
    "mso.dll.#4702",
    "user32.dll.GetMessagePos",
    "advapi32.dll.CryptReleaseContext",
    "cryptsp.dll.CryptReleaseContext",
    "mso.dll.#1266",
    "gdi32.dll.GetStockObject",
    "mso.dll.#6501",
    "riched20.dll.REMSOHInst",
    "mso.dll.#8118",
    "gdi32.dll.GetGlyphIndicesW",
    "winspool.drv.#254",
    "gdi32.dll.GdiPrinterThunk",
    "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
    "secur32.dll.InitSecurityInterfaceW",
    "cryptsp.dll.SystemFunction035",
    "winspool.drv.DocumentPropertySheets",
    "rpcrt4.dll.NdrClientCall3",
    "sechost.dll.LookupAccountNameLocalW",
    "unidrvui.dll.DrvResetConfigCache",
    "unidrvui.dll.DrvDocumentPropertySheets",
    "kernel32.dll.SortGetHandle",
    "kernel32.dll.SortCloseHandle",
    "unidrvui.dll.DrvDeviceCapabilities"
]

[*] Static Analysis: {}