file_doc.json

[*] MalFamily: ""

[*] MalScore: 10.0

[*] File Name: "file.doc"
[*] File Size: 267457
[*] File Type: "Rich Text Format data, version 1, unknown character set"
[*] SHA256: "f2ad490fc150a333f619069d8378bd117c3c3a72cf5662c85a161de1be54656e"
[*] MD5: "437599ffe9c92a8c7ecea6478efc063b"
[*] SHA1: "24da668d18e0199fe365e103ad50eafaa2bca9e2"
[*] SHA512: "f6da78dc7782c9735a85c6467816b532937ab136f5201029ece3d7adddbc8347cfced3d625a1567b6a68a8b89a681d8c907cefbb9311387113fbc2a6ee8e6488"
[*] CRC32: "B30364C1"
[*] SSDEEP: "1536:sxxQW3yVHcwPKjVvBzxjdCP3rbvvJtGJ82kb8:sxt3aDP4pzKbzWk4"

[*] Process Execution: [
    "WINWORD.EXE"
]

[*] Signatures Detected: [
    {
        "Description": "Attempts to connect to a dead IP:Port (4 unique times)",
        "Details": [
            {
                "IP": "104.18.24.243:80"
            },
            {
                "IP": "23.64.189.123:443"
            },
            {
                "IP": "52.109.2.14:443"
            },
            {
                "IP": "72.21.91.29:80"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
            },
            {
                "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
            },
            {
                "url": "http://paroquiadamarinhagrande.pt/jiftxq.msi"
            },
            {
                "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
            },
            {
                "url": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
            }
        ]
    },
    {
        "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
        "Details": [
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x01\\xb0\\x8b\\\\x96u\\x8b,\\xf2\\xb6\\xb3\\xb2\\x1d\\xbf\\x8b5\\xc9\\xd8\\x07\\xb6mu\\xbej%\\x18\\x91p[)\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x041mb\\x1ah\\x9a\\xde\\xacsb\\xbd\\x98d\\xe9\t\\xa7\t\\x1f\\xb9xzt\\x9e\\xd3\rbw2e\\xe9c\\x00.\\xc0\\xc2\\x08h\\x85\\xdc[\\x161l\\x87\\xc5\\x1e\\x0c[bi\\\\x8et\\xfe\\xb12\\xaf\\xdf\\x11\\x85k\\xd1^e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb2\\x9damp#p\\xabx\\xf5k\\x00o\\x8e\\x81\\xb3/\\xf9\\xb1\\xae\\x16n\\xbc\\x92qh\\x129\\xd7\\x99\\x02 \\x1b\\xf9\"\\xe9\\x862\\x91c\\xa2\\xe9\\xe8\\xcd\\xe4\\xda\\xd0~"
            },
            {
                "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
            },
            {
                "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xb8\\x9e\\xfe\\xc7\\x11^\\xa2\\x89f\\x05\\x7f9\\xc8\\xc3#qx\\x167\\xdc,h=\\xb5x\\xb4ww\\xc0\\xac\\xe7\\xe4ui\\xcc\\xf9\\xa9'?\\x8e\\xbf\\xfbp\\x13m`\\xd8\\x91\\x8a\\x1c\\xaf\\xbba.\\x15\\x89\\xc5o|\\x10kj]\\xcf(\\xebz\\x1di\\x19.\\x7f-\\xaa(w\\x8d\\xe3h\\xdeg\\xfcz\\xbc\\xc5\\xe3\\xf0\\xf9\\xcc\\xf1!\\xf8\\x17q\\xcbz\\xc6\\xce\\xb7vx~q\\xe2\\xe8\\x8d\\xff\\xcc\\xd5\\x035\\x08\\xd5a=\\xacww\\x1b3\\xa6jx\\xa2s\\xfc\\xaa\\xfc\\x06ojz\\x12\\xd3\\xdb\\xf2\\xe2]y\\xc9\\xd2\\x1c\\xd7\\x12jf\\xd4\\xa5>&\\xba\t\\x10b3\\x8fsyn\\xae\\x99\\xe8\\x88\\xe1x\\xb4\\x1a\\x9d\\x9e\\xa9\\x8aa}\\x9d\\xdc\\x81l\\xd0\\x18\\xd37\\xear@h@4a\\xd2\\xaf\\xb2a\\xf3\\xa5\\xed\\x03$\\xc4\\xa0\\xf1\\xe3\\x16\\x87\\xf98d\\xfe\\xa0\\xb8\\xaav\\x9c3\\x93q\\x80\\xfam!\\x93l]\\xc4a\\xca\\xf5\\x99\\x88\\x90\\x80\\x86>u\\x04u!z\\xd6\\x05\"\\xe7\\xa8\\xe3\\xbax\\xc0o\\xacy\\x01t"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xbb\\xab\\xeay\\x06\\x8a\\x1b<\\x010p\\x03{e\\x02\\x8b&6g>\\x81\\xf7\\x1d\\x19\\x00\\xc0\\x03\\xa4\\xa9\\xa4\\xde\\xee\\x00t\\x92\\x8c}{\\x84:\\xecm\\xbd=\rvq\\xd3\\x8cb-\\xf4\\x8e_\\xf6qkr\\x1a\\x9f\r\\x15b\\xd8\\x7f\\x06\\x03d\\xd8m\\x1c\\xfbl\n`\\x02\\x95\\x00\\x10\\xed\\x98{_j\\x1d0\\xca+}~il\\xbf\\xa4\\x97\\xdf\\x911\\xa7\\xa3\\xf5\\xc0\\x8d\\xf5~\\xa5b\\xac\\x93\\xf3\\xe2\\xfcr\\xab\\x1c\\xec\\xde\"\\xd0id{\\xaf\\x0e\\x17\\xc6\\x10<!\\xa8/o\\x959\\xfcb\\xb5\\xb3\r\\x03\\x8c\\xcf\\xdd.tu\\xd1j9o\\xf9\\xb9#|c;\\xf0\\x01\\xf8\\xdd\\xf4\"\\xa6\\x11\\x85\\xecf\\x13o\\xca\\xad\\x94o\\xfc8y^\\xf9\\x1dje\\x93\\xce\\xee*l\\x87\"\\x8f6\\x93\\xe0\\xe8\\xcf\\x7f\\xf6\\x01\\x969zl\\xbe\\xe0\\x11\\x9fc\\xab\\x1c7>\\x0e<\\x96\\x14\\xca\\xd9\\xd54\\xf6\\xbe\\x86\\xaa\\xea\\xbb\\x9d1.\\xdbh\\xaeh\\x16\\xf68g\\xea\n\\x05\\x1a\\x14\\x0c\\xddor\\xa4k\\xec\\xb7\\xb5\\xe3\\xa7"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x01\\xb0\\x8f\\x88'\\xe8.:\\xd5:\\xc1\\xbckr\\xad\\xf9o\r\\x03\\xee\\xde\n{\\xf2\\xeav\\xdc\\x1e*&\\xbe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h\n\\xd3\\xeb\\x8d\\x08\\xf9\\xf3x\\xdf\\xf9\\xef;\\x1b\\xc3i7\\x90@\\x03qdi\\xbd\\x02\\xab\\xa54\\x96q\\x8a\\x0b\\xea\\xb4\\x8f\\x83m\\xec\\xb6m\\xde\\xdc}\\xd5\\xf3ls\\x0f\\xb3\\x8a\\x19\ny!\\xc3\\x7f\\x94\\xac\\xed\\xa2g\\xbc\\x11/\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000w\\xc2\\xcb@\\xec\\xc5k4\\x07\\x1c\\xe4\\xb3](*\\xb8t#\\xfd\\xfb/v\\x9f\\x9b\\x06\\xee\\xfd#\\x08l\\xcb\\x8b+\\x1f\\xf6\\xef\\x95\\xf4\\xafe\\xe7+v\\xbe\\xa4\\x9a\\xc3\\xaa"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\n;\\x01p:h\\xf8v\\xc0\\xb1z\\xeb\\xaa1s\\x92\\xd1s\\x9d\\x06\\xd9\\xf1\\xa2\\x847\\xb0z\\xce\\xb2\\x8d\\xa7o\\xae\\xc2\\xf6\\xf4\\x9b/\\x1c\\xe9cne\\x1a\\xd7\\xaac}\\x0f\\xb6&\\x07}s8\\x10\\xfd\\\\xed\\xa545h\\xa6q\\xf4\\xc0f)f\\xa0w\\xdf\\x1e\\x13\\x0b\\xc6bbfzx\"c\\xe8\t\\\\x00$y\\xef\\xf7\\xae\\xfa\\x0fzy%\\xd4\\xa0_\\xe2}\\xc5\\xee\\xed.\\x9b_\\xf8l\\xfbq\\xb0\\x94w@q\\xbe\\x1d\\xea\\xa2-1la\\x19\\x0et\\xe0\\x17\\xe1$\\xdfx\\xe4kn:tn\\xb7\\x1bdbbn\\x1a\\xe2<\\xcft\\x1ek=\\xc2x0va=j@\\xc4\\xbe 7d'\\xf0\\x04\\xc8\\xfc\\xec\\xb47\\x9e\\xac6\rtj\\xa8\\xc1\\xdc\\xbf8\\xd3m\\xf6?\\xfdd\\x14x\n\\xdb\\x8ajw\\x9em\\xfa\\xc2\\xd6\\x8d5\\xdf\\xb1.\\x9a\\xd8w\\xf7\\xd72\\xa5 n'\\x91\\xfc\\xf6\\xe8f\\xa2\\x10m]\\xb4\\xb4\\xccz3\\xf8\\x10\\xde;i\\xac\\x81r\\xf4\\xbc\\x97\\x10s,\\x87\\x05q"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x01\\xb0\\xb3b0\\xc7s\\x93l\\xc0\\xd0\\x06\\x0c\\xc8r\\xe3\\xef@g_\\x9e\\xbaa\\xc8\\x88\\xa9\\xf5\\x05\\xa9\\xe7c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04y\\xa9\\xb6o\\x00\\x10\\x10\\xae-\\x1b\\x12\\xb6\\xd6\\x18\\x1f\\x8c\\x8e4\\xf4\\xae/\\x1a\\xc8\\x99y\\x80ou\\\\xad\\x1b\\xfe\\xba\\xe7\\xd6\\xb9n\\xe9\\xf8\\x14h?\\xaf&:\\xc6\\x9c\\x8c\\xe6\\xd8!zz\\xab\\xd2o\\xf9\\xc5\\xc7\\x000\\xeb?\\xd0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000;\\xc3\\x02\\xe4;\\x99\\xea\\xf7\\xb0\\xb5\\x14\\x83at\\xbb\\x0fp4i\\xa8\\xd5o\\x9f\\xf5\\xd3\\xe0\\xfay\\x1b\\xa3\\xc6\t~\\xf5\\x9a,\\xdb\\xc3\\xb2\\xfe=\\x01j)\r\\xb6\\xf8)"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xccn$\\xb4-\\xad\\xd8\\xb555\\x933\\xdbr\\x9d\\xda\\x81\\xa9\t\\xf4u\\x93\\xf5\\xf6'_\\x91\\x9c\\xfey|~\\xfau\\xfdvg\\xab%\\x14\\x02\\xcc\\xc0\\x02\\x85q\\xb1\\xffu]\\xbdi'k\\xf5m\\xf01\\xa8\\x85uwp!\rg_\\x980\\xdc\\x15\\x1a\\x8f4\\xdf;42w\\xd1\\xd4\\xbeog\\x91\\x97\\xef+\\xa64\\x9b\\xd6x\\xf5\\x92\\x14r\\xdd\\xf5\\xd4!\\x19mf\\xcc\\xc0f;\\xd7ac\\x04w\\xf0\\x89f\\x8f@\\xad\\xcd\\xc5\\xefv^\\x13\\xea\\xb3v\\x01&\\xfcn\\xce\\xa9\\x9a\\xd7\\xf5o\\x03\\xed \\xdb&\\xb3\\x92\\xd0!\\xb2\r5\\xdf\\x1a\\xafg\\xa3\\xb7n'\\x97\\x9a\\xe5\\x95g\\x17a4\\x83\\xf3g\\x96\\x89n\\x9f\\x9b\\x1f`\\xc1n\\x10qd\\x14\\xfd\\x1dl\\x81\\x8a=_\\x07\\x89l\\x91\\xb6\\x1b\\x14n7q\\x16\\xd1\\xe4@\\xaaccg\\x90\\x8a\\xb8s\\xbe3e\\xd0\\xf7\\xb7qx\\x9d\\xcc\\x80m\\xe34>\\x15w\\x8e\\x1b\\x83\\xfa\\x15\\x9b\\x1f\\xfb\\xa0%\\x12\\xb4\\xa1\\x10m\\x02\\xbb\\xce\\x7fjbi*"
            }
        ]
    },
    {
        "Description": "File has been identified by 32 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "Exploit.RTF-ObfsStrm.Gen"
            },
            {
                "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
            },
            {
                "Cyren": "CVE-2017-11882!Camelot"
            },
            {
                "Symantec": "Bloodhound.RTF.12"
            },
            {
                "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.A"
            },
            {
                "TrendMicro-HouseCall": "Possible_SMBCVE20170199"
            },
            {
                "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
            },
            {
                "BitDefender": "Exploit.RTF-ObfsStrm.Gen"
            },
            {
                "Rising": "Exploit.CVE-2017-11882/SLT!1.AEE3 (CLASSIC)"
            },
            {
                "Ad-Aware": "Exploit.RTF-ObfsStrm.Gen"
            },
            {
                "Emsisoft": "Exploit.RTF-ObfsStrm.Gen (B)"
            },
            {
                "Comodo": "Exploit.W97M.CVE2017-11882.AG@843jmy"
            },
            {
                "F-Secure": "Heuristic.HEUR/Rtf.Malformed"
            },
            {
                "DrWeb": "Exploit.Rtf.CVE2012-0158"
            },
            {
                "TrendMicro": "Possible_SMBCVE20170199"
            },
            {
                "McAfee-GW-Edition": "Exploit-CVE2017-11882.ah"
            },
            {
                "FireEye": "Exploit.RTF-ObfsStrm.Gen"
            },
            {
                "Sophos": "Exp/201711882-P"
            },
            {
                "Ikarus": "Exploit.CVE-2017-11882"
            },
            {
                "Avira": "HEUR/Rtf.Malformed"
            },
            {
                "Antiy-AVL": "Trojan[Exploit]/OLE.CVE-2017-11882"
            },
            {
                "Microsoft": "Exploit:O97M/CVE-2017-11882.T"
            },
            {
                "Arcabit": "Exploit.RTF-ObfsStrm.Gen"
            },
            {
                "ZoneAlarm": "HEUR:Exploit.RTF.CVE-2017-11882.gen"
            },
            {
                "GData": "Exploit.RTF-ObfsStrm.Gen"
            },
            {
                "AhnLab-V3": "RTF/Malform-C.Gen"
            },
            {
                "McAfee": "Exploit-CVE2017-11882.ah"
            },
            {
                "TACHYON": "Trojan-Exploit/RTF.CVE-2017-11882"
            },
            {
                "Zoner": "Probably RTFObfuscation"
            },
            {
                "Tencent": "Office.Exploit.Generic.Pbpd"
            },
            {
                "MAX": "malware (ai score=80)"
            },
            {
                "Qihoo-360": "susp.rtf.objupdate.gen"
            }
        ]
    }
]

[*] Started Service: [
    "osppsvc"
]

[*] Executed Commands: []

[*] Mutexes: [
    "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
    "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
    "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1",
    "Global\\552FFA80-3393-423d-8671-7BA046BB5906"
]

[*] Modified Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\file.doc",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~$file.doc",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{D31FB1FC-1B2E-4EF8-8E30-4E20DF73710E}.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{E69568CB-EF3E-4F7A-8B89-1031BCD12A8A}.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{C58F7B78-2EEE-4F6E-9116-7E2D3088A472}.tmp",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabEFB3.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarEFB4.tmp"
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\CabEFB3.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\TarEFB4.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\"
]

[*] Modified Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\p*s",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\D2E712",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\D2E712\\D2E712",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925"
]

[*] Deleted Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\p*s",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\1!q",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate"
]

[*] DNS Communications: [
    {
        "type": "A",
        "request": "paroquiadamarinhagrande.pt",
        "answers": [
            {
                "data": "188.93.230.15",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "ipapi.co",
        "answers": [
            {
                "data": "104.25.210.99",
                "type": "A"
            },
            {
                "data": "104.25.209.99",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "ocsp.comodoca4.com",
        "answers": [
            {
                "data": "t3j2g9x7.stackpathcdn.com",
                "type": "CNAME"
            },
            {
                "data": "151.139.128.14",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "vemvemserver.duckdns.org",
        "answers": [
            {
                "data": "104.244.75.220",
                "type": "A"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "104.244.75.220",
        "domain": "vemvemserver.duckdns.org"
    },
    {
        "ip": "151.139.128.14",
        "domain": "ocsp.comodoca4.com"
    },
    {
        "ip": "188.93.230.15",
        "domain": "paroquiadamarinhagrande.pt"
    },
    {
        "ip": "104.25.210.99",
        "domain": "ipapi.co"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.msocsp.com",
        "version": "1.1",
        "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://paroquiadamarinhagrande.pt/jiftxq.msi",
        "user-agent": "Windows Installer",
        "method": "GET",
        "host": "paroquiadamarinhagrande.pt",
        "version": "1.1",
        "path": "/jiftxq.msi",
        "data": "GET /jiftxq.msi HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Windows Installer\r\nHost: paroquiadamarinhagrande.pt\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.usertrust.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.comodoca4.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEAui0B3Ly3d26KxlCXrBJUE%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca4.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {}

[*] Resolved APIs: [
    "mso.dll.#1443",
    "mso.dll.#9214",
    "mso.dll.#199",
    "mso.dll.#1073",
    "mso.dll.#4255",
    "mso.dll.#3459",
    "mso.dll.#1262",
    "mso.dll.#5709",
    "mso.dll.#7353",
    "mso.dll.#5228",
    "mso.dll.#2155",
    "mso.dll.#1283",
    "mso.dll.#2024",
    "mso.dll.#5274",
    "mso.dll.#3195",
    "mso.dll.#6221",
    "mso.dll.#2314",
    "mso.dll.#408",
    "mso.dll.#2714",
    "mso.dll.#8622",
    "mso.dll.#3380",
    "mso.dll.#2052",
    "mso.dll.#677",
    "mso.dll.#469",
    "mso.dll.#7974",
    "mso.dll.#2609",
    "bcryptprimitives.dll.GetHashInterface",
    "cryptnet.dll.CertDllVerifyRevocation",
    "sechost.dll.ConvertSidToStringSidW",
    "profapi.dll.#104",
    "mso.dll.#8499",
    "sensapi.dll.IsNetworkAlive",
    "rpcrt4.dll.RpcBindingFromStringBindingW",
    "rpcrt4.dll.RpcBindingSetAuthInfoExW",
    "rpcrt4.dll.NdrClientCall2",
    "winhttp.dll.WinHttpOpen",
    "winhttp.dll.WinHttpSetTimeouts",
    "winhttp.dll.WinHttpSetOption",
    "winhttp.dll.WinHttpCrackUrl",
    "winhttp.dll.WinHttpConnect",
    "winhttp.dll.WinHttpOpenRequest",
    "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
    "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
    "oleaut32.dll.#7",
    "winhttp.dll.WinHttpSendRequest",
    "winhttp.dll.WinHttpReceiveResponse",
    "winhttp.dll.WinHttpQueryHeaders",
    "shlwapi.dll.StrStrIW",
    "winhttp.dll.WinHttpQueryDataAvailable",
    "winhttp.dll.WinHttpReadData",
    "winhttp.dll.WinHttpCloseHandle",
    "winhttp.dll.WinHttpTimeFromSystemTime",
    "cryptnet.dll.I_CryptNetGetConnectivity",
    "cryptnet.dll.CryptRetrieveObjectByUrlW",
    "setupapi.dll.SetupIterateCabinetW",
    "kernel32.dll.RegOpenKeyExW",
    "kernel32.dll.RegCloseKey",
    "cabinet.dll.#20",
    "cabinet.dll.#22",
    "devrtl.dll.DevRtlGetThreadLogToken",
    "cryptsp.dll.CryptSetHashParam",
    "sechost.dll.OpenSCManagerW",
    "sechost.dll.OpenServiceW",
    "sechost.dll.QueryServiceConfigA",
    "sechost.dll.QueryServiceStatus",
    "sechost.dll.CloseServiceHandle",
    "rpcrt4.dll.RpcStringBindingComposeA",
    "rpcrt4.dll.RpcBindingFromStringBindingA",
    "rpcrt4.dll.RpcEpResolveBinding",
    "sechost.dll.LookupAccountSidLocalW",
    "rpcrt4.dll.RpcStringFreeA",
    "rpcrt4.dll.RpcBindingFree",
    "webservices.dll.WsResetHeap",
    "webservices.dll.WsCloseServiceProxy",
    "ws2_32.dll.#3",
    "ncrypt.dll.SslDecrementProviderReferenceCount",
    "webservices.dll.WsFreeServiceProxy",
    "ncrypt.dll.SslFreeObject",
    "mso.dll.#1725",
    "user32.dll.RegisterWindowMessageW",
    "mso.dll.#4314",
    "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
    "mso.dll.#6484",
    "mso.dll.#9871",
    "mso.dll.#4743",
    "mso.dll.#5452",
    "mso.dll.#2088",
    "mso.dll.#5315",
    "mso.dll.#8140",
    "user32.dll.IsWindowEnabled",
    "ole32.dll.CoGetCallState",
    "ole32.dll.CoGetActivationState",
    "advapi32.dll.RegisterWaitChainCOMCallback",
    "mso.dll.#9175",
    "user32.dll.SetRect",
    "mso.dll.#25",
    "mso.dll.#1056",
    "mso.dll.#8136",
    "mso.dll.#8931",
    "shell32.dll.SHGetFileInfoW",
    "mso.dll.#5362",
    "mso.dll.#6044",
    "mso.dll.#6516",
    "mso.dll.#5780",
    "mso.dll.#4870",
    "mso.dll.#6046",
    "mso.dll.#1241",
    "mso.dll.#2821",
    "mso.dll.#2340",
    "mso.dll.#7287",
    "mso.dll.#5290",
    "mso.dll.#1508",
    "user32.dll.IsZoomed",
    "user32.dll.GetWindowPlacement",
    "user32.dll.GetWindowRect",
    "mso.dll.#821",
    "user32.dll.GetSystemMetrics",
    "user32.dll.MonitorFromWindow",
    "user32.dll.MonitorFromRect",
    "user32.dll.MonitorFromPoint",
    "user32.dll.EnumDisplayMonitors",
    "user32.dll.GetMonitorInfoA",
    "user32.dll.EnumDisplayDevicesA",
    "mso.dll.#2378",
    "user32.dll.SetWindowPos",
    "user32.dll.AdjustWindowRect",
    "mso.dll.#5912",
    "mso.dll.#9719",
    "mso.dll.#8824",
    "mso.dll.#6117",
    "mso.dll.#3307",
    "user32.dll.SendMessageW",
    "user32.dll.DestroyIcon",
    "mso.dll.#3813",
    "mso.dll.#1815",
    "user32.dll.PtInRect",
    "mso.dll.#1613",
    "user32.dll.SetWindowTextW",
    "user32.dll.GetClassLongW",
    "mso.dll.#8572",
    "gdi32.dll.CreateDIBSection",
    "gdi32.dll.CreateCompatibleDC",
    "gdi32.dll.GetViewportOrgEx",
    "gdi32.dll.SetViewportOrgEx",
    "gdi32.dll.SetBkColor",
    "gdi32.dll.ExtTextOutA",
    "mso.dll.#1573",
    "mso.dll.#8612",
    "user32.dll.SetScrollRange",
    "mso.dll.#2509",
    "user32.dll.BeginDeferWindowPos",
    "user32.dll.DeferWindowPos",
    "user32.dll.EndDeferWindowPos",
    "user32.dll.OffsetRect",
    "user32.dll.EnumChildWindows",
    "gdi32.dll.DeleteDC",
    "user32.dll.GetScrollInfo",
    "user32.dll.MapWindowPoints",
    "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
    "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
    "mso.dll.#6126",
    "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
    "gdi32.dll.GetFontRealizationInfo",
    "gdi32.dll.GetFontFileInfo",
    "gdi32.dll.GetFontFileData",
    "mso.dll.#7261",
    "mso.dll.#9540",
    "usp10.dll.ScriptGetFontScriptTags",
    "usp10.dll.ScriptGetFontLanguageTags",
    "usp10.dll.ScriptGetFontFeatureTags",
    "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
    "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
    "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
    "gdiplus.dll.GdipCreatePath",
    "gdiplus.dll.GdipStartPathFigure",
    "gdiplus.dll.GdipAddPathLine2",
    "gdiplus.dll.GdipClosePathFigure",
    "gdiplus.dll.GdipCreateMatrix2",
    "gdiplus.dll.GdipTransformPath",
    "gdiplus.dll.GdipDeleteMatrix",
    "gdiplus.dll.GdipGetPathWorldBounds",
    "gdiplus.dll.GdipCreatePathIter",
    "gdiplus.dll.GdipPathIterRewind",
    "gdiplus.dll.GdipPathIterNextSubpath",
    "gdiplus.dll.GdipPathIterCopyData",
    "gdiplus.dll.GdipDeletePathIter",
    "gdiplus.dll.GdipAddPathLine",
    "gdiplus.dll.GdipDeletePath",
    "gdiplus.dll.GdipClonePath",
    "msptls.dll.?FsTransformPoint@Ptls6@@YGJKPBUtagFSRECT@1@PBUtagFSPOINT@1@KPAU31@@Z",
    "msptls.dll.?FsTransformVector@Ptls6@@YGJKPBUtagFSVECTOR@1@KPAU21@@Z",
    "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
    "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
    "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
    "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
    "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
    "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
    "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
    "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
    "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
    "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
    "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
    "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
    "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
    "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
    "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
    "msptls.dll.?FsQueryAttachedObjectList@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfsattachedobjectdescription@1@PAJ@Z",
    "msptls.dll.?FsQueryFigureObjectDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfsfiguredetails@1@@Z",
    "mso.dll.#2566",
    "mso.dll.#1429",
    "mso.dll.#6502",
    "uiautomationcore.dll.UiaClientsAreListening",
    "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
    "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
    "user32.dll.SetRectEmpty",
    "user32.dll.IntersectRect",
    "user32.dll.InflateRect",
    "mso.dll.#1100",
    "mso.dll.#7047",
    "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
    "user32.dll.GetCursor",
    "user32.dll.GetClientRect",
    "user32.dll.SetScrollInfo",
    "user32.dll.SetScrollPos",
    "mso.dll.#3747",
    "mso.dll.#8218",
    "mso.dll.#5394",
    "mso.dll.#331",
    "mso.dll.#6829",
    "mso.dll.#539",
    "mso.dll.#4959",
    "mso.dll.#6463",
    "mso.dll.#4987",
    "user32.dll.GetWindow",
    "mso.dll.#7195",
    "mso.dll.#7573",
    "mso.dll.#445",
    "user32.dll.GetCaretBlinkTime",
    "user32.dll.CreateCaret",
    "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
    "user32.dll.DestroyCaret",
    "user32.dll.GetCaretPos",
    "user32.dll.SetCaretPos",
    "mso.dll.#5932",
    "mso.dll.#2071",
    "mso.dll.#1024",
    "mso.dll.#6245",
    "mso.dll.#9041",
    "mso.dll.#1767",
    "mso.dll.#9369",
    "mso.dll.#4617",
    "user32.dll.FillRect",
    "mso.dll.#343",
    "mso.dll.#9636",
    "mso.dll.#2022",
    "mso.dll.#4750",
    "mso.dll.#4577",
    "mso.dll.#850",
    "mso.dll.#1776",
    "mso.dll.#9026",
    "mso.dll.#4497",
    "mso.dll.#4647",
    "mso.dll.#8926",
    "mso.dll.#7212",
    "mso.dll.#5407",
    "mso.dll.#5152",
    "mso.dll.#3327",
    "shell32.dll.SHAddToRecentDocs",
    "mso.dll.#6333",
    "mso.dll.#420",
    "mso.dll.#1335",
    "mso.dll.#2041",
    "mso.dll.#7834",
    "mso.dll.#239",
    "mso.dll.#6357",
    "mso.dll.#7026",
    "mso.dll.#1671",
    "ole32.dll.PropVariantClear",
    "oleaut32.dll.#9",
    "mso.dll.#8263",
    "mso.dll.#9307",
    "mso.dll.#1441",
    "mso.dll.#9223",
    "mso.dll.#6453",
    "mso.dll.#8044",
    "mso.dll.#3698",
    "mso.dll.#8565",
    "mso.dll.#8373",
    "mso.dll.#9741",
    "mso.dll.#478",
    "mso.dll.#479",
    "mso.dll.#340",
    "bcrypt.dll.BCryptOpenAlgorithmProvider",
    "bcrypt.dll.BCryptGetProperty",
    "bcrypt.dll.BCryptCreateHash",
    "bcrypt.dll.BCryptHashData",
    "bcrypt.dll.BCryptFinishHash",
    "bcrypt.dll.BCryptDestroyHash",
    "bcrypt.dll.BCryptCloseAlgorithmProvider",
    "mso.dll.#8633",
    "mso.dll.#5213",
    "mso.dll.#6163",
    "mso.dll.#552",
    "mso.dll.#5630",
    "mso.dll.#2513",
    "mso.dll.#1607",
    "mso.dll.#791",
    "mso.dll.#1848",
    "mso.dll.#8735",
    "mso.dll.#9374",
    "mso.dll.#5286",
    "mso.dll.#6368",
    "mso.dll.#4262",
    "mso.dll.#1010",
    "mso.dll.#7979",
    "mso.dll.#8549",
    "mso.dll.#8970",
    "mso.dll.#9198",
    "mso.dll.#4795",
    "mso.dll.#1865",
    "mso.dll.#9688",
    "mso.dll.#320",
    "advapi32.dll.RegDeleteKeyA",
    "user32.dll.DestroyCursor",
    "mso.dll.#7173",
    "mso.dll.#8511",
    "mso.dll.#3299",
    "mso.dll.#7001",
    "mso.dll.#3913",
    "user32.dll.PeekMessageA",
    "mso.dll.#1380",
    "mso.dll.#9500",
    "user32.dll.TranslateMessage",
    "user32.dll.IsWindowUnicode",
    "user32.dll.DispatchMessageA",
    "user32.dll.DispatchMessageW",
    "user32.dll.UpdateWindow",
    "mso.dll.#999",
    "mso.dll.#287",
    "dwmapi.dll.DwmIsCompositionEnabled",
    "mso.dll.#1575",
    "mso.dll.#5034",
    "mso.dll.#1517",
    "mso.dll.#718",
    "mso.dll.#4708",
    "mso.dll.#8046",
    "mso.dll.#4175",
    "mso.dll.#8672",
    "mso.dll.#1990",
    "mso.dll.#3051",
    "mso.dll.#1819",
    "mso.dll.#1419",
    "oleaut32.dll.#147",
    "kernel32.dll.WerRegisterMemoryBlock",
    "advapi32.dll.RegDeleteTreeW",
    "dwrite.dll.DWriteCreateFactory",
    "xmllite.dll.CreateXmlReader",
    "user32.dll.RegisterPowerSettingNotification",
    "powrprof.dll.PowerSettingRegisterNotification",
    "user32.dll.GetWindowThreadProcessId",
    "user32.dll.GetWindowTextW",
    "gdi32.dll.GetCurrentObject",
    "gdi32.dll.BitBlt",
    "gdi32.dll.GetClipBox",
    "gdi32.dll.StretchDIBits",
    "riched20.dll.REExtendedRegisterClass",
    "user32.dll.GetWindowLongW",
    "user32.dll.GetSysColor",
    "user32.dll.SetWindowLongW",
    "user32.dll.RegisterWindowMessageA",
    "user32.dll.RegisterClipboardFormatW",
    "user32.dll.GetDoubleClickTime",
    "user32.dll.SetCaretBlinkTime",
    "user32.dll.SystemParametersInfoW",
    "user32.dll.GetKeyboardLayoutList",
    "mso.dll._MsoGetFidUspDll@0",
    "mso.dll._MsoLoadLocalizedLibraryEx@12",
    "usp10.dll.ScriptGetProperties",
    "usp10.dll.ScriptItemize",
    "user32.dll.LoadCursorW",
    "user32.dll.IsWindowVisible",
    "user32.dll.GetKeyboardLayout",
    "user32.dll.PostMessageW",
    "user32.dll.DefWindowProcW",
    "uxtheme.dll.IsThemeActive",
    "uxtheme.dll.IsAppThemed",
    "uxtheme.dll.OpenThemeData",
    "user32.dll.GetDC",
    "user32.dll.ReleaseDC",
    "user32.dll.IsIconic",
    "user32.dll.GetParent",
    "usp10.dll.ScriptGetCMap",
    "user32.dll.InvalidateRect",
    "user32.dll.HideCaret",
    "user32.dll.ShowCaret",
    "user32.dll.NotifyWinEvent",
    "user32.dll.GetWindowTextLengthW",
    "user32.dll.EnableWindow",
    "msctf.dll.SetInputScope",
    "user32.dll.GetWindowRgn",
    "gdi32.dll.CreateCompatibleBitmap",
    "gdi32.dll.SaveDC",
    "gdi32.dll.SetPixel",
    "gdi32.dll.GetPixel",
    "gdi32.dll.RestoreDC",
    "imm32.dll.ImmAssociateContext",
    "mso.dll.#806",
    "mso.dll.#4908",
    "mso.dll.#8439",
    "mso.dll.#2736",
    "gdi32.dll.GetTextAlign",
    "gdi32.dll.ExtTextOutW",
    "mso.dll.#8122",
    "mso.dll.#2114",
    "advapi32.dll.RegQueryValueW",
    "apphelp.dll.ApphelpCheckShellObject",
    "mso.dll.#6558",
    "gdi32.dll.GetFontData",
    "usp10.dll.ScriptItemizeOpenType",
    "usp10.dll.ScriptLayout",
    "usp10.dll.ScriptShapeOpenType",
    "usp10.dll.ScriptPlaceOpenType",
    "mso.dll.#1318",
    "ole32.dll.CoRevokeInitializeSpy",
    "comctl32.dll.#388",
    "gdi32.dll.GetTextExtentExPointWPri",
    "mso.dll.#8395",
    "mso.dll.#379",
    "mso.dll.#6338",
    "mso.dll.#7964",
    "mso.dll.#1437",
    "mso.dll.#1427",
    "mso.dll.#6137",
    "winmm.dll.timeGetTime",
    "mso.dll.#7578",
    "mso.dll.#8483",
    "mso.dll.#3055",
    "user32.dll.GetForegroundWindow",
    "user32.dll.GetFocus",
    "user32.dll.GetClassNameA",
    "user32.dll.IsWindowRedirectedForPrint",
    "gdi32.dll.CreateRectRgnIndirect",
    "user32.dll.GetUpdateRgn",
    "gdi32.dll.GetRgnBox",
    "user32.dll.ValidateRect",
    "user32.dll.GetUpdateRect",
    "user32.dll.BeginPaint",
    "user32.dll.EndPaint",
    "mso.dll.#3624",
    "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
    "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
    "gdi32.dll.TranslateCharsetInfo",
    "mso.dll.#3300",
    "mso.dll.#7465",
    "mso.dll.#6247",
    "mso.dll.#5070",
    "gdiplus.dll.GdipCreateSolidFill",
    "gdiplus.dll.GdipCreatePen1",
    "gdiplus.dll.GdipSetPenLineCap197819",
    "gdiplus.dll.GdipSetPenLineJoin",
    "gdiplus.dll.GdipSetPenMiterLimit",
    "gdiplus.dll.GdipCreateFromHDC",
    "gdiplus.dll.GdipSetPixelOffsetMode",
    "gdiplus.dll.GdipSetSmoothingMode",
    "gdiplus.dll.GdipSetCompositingQuality",
    "gdiplus.dll.GdipSetPageUnit",
    "gdiplus.dll.GdipSetInterpolationMode",
    "gdiplus.dll.GdipGetSmoothingMode",
    "gdiplus.dll.GdipFillPath",
    "gdiplus.dll.GdipDeleteGraphics",
    "gdiplus.dll.GdipDrawPath",
    "mso.dll.#6899",
    "gdi32.dll.GetClipRgn",
    "gdi32.dll.SelectClipRgn",
    "gdi32.dll.SetWindowOrgEx",
    "mso.dll.#732",
    "mso.dll.#5804",
    "ole32.dll.CoCreateInstance",
    "mso.dll.#434",
    "user32.dll.GetMessageExtraInfo",
    "user32.dll.TrackMouseEvent",
    "mso.dll.#4746",
    "mso.dll.#424",
    "user32.dll.IsWindow",
    "user32.dll.GetInputState",
    "mso.dll.#8461",
    "user32.dll.GetClipboardOwner",
    "user32.dll.GetActiveWindow",
    "user32.dll.GetAncestor",
    "user32.dll.SendNotifyMessageW",
    "mso.dll.#3544",
    "mso.dll.#900",
    "mso.dll.#1422",
    "user32.dll.MsgWaitForMultipleObjectsEx",
    "advapi32.dll.NotifyServiceStatusChangeW",
    "user32.dll.GetWindowDC",
    "gdi32.dll.SetLayout",
    "gdi32.dll.RectVisible",
    "gdi32.dll.ExcludeClipRect",
    "user32.dll.WindowFromPoint",
    "user32.dll.IsClipboardFormatAvailable",
    "user32.dll.GetCursorInfo",
    "user32.dll.GetCapture",
    "user32.dll.GetMessagePos",
    "user32.dll.ScreenToClient",
    "user32.dll.SetFocus",
    "user32.dll.GetDesktopWindow",
    "user32.dll.FindWindowExW",
    "mso.dll.#9465",
    "user32.dll.GetScrollPos",
    "mso.dll.#629",
    "advapi32.dll.CryptAcquireContextA",
    "cryptsp.dll.CryptAcquireContextA",
    "advapi32.dll.CryptGenKey",
    "cryptsp.dll.CryptGenKey",
    "advapi32.dll.CryptImportKey",
    "cryptsp.dll.CryptImportKey",
    "advapi32.dll.CryptExportKey",
    "cryptsp.dll.CryptExportKey",
    "advapi32.dll.CryptDestroyKey",
    "cryptsp.dll.CryptDestroyKey",
    "advapi32.dll.CryptCreateHash",
    "cryptsp.dll.CryptCreateHash",
    "advapi32.dll.CryptSetHashParam",
    "advapi32.dll.CryptHashData",
    "cryptsp.dll.CryptHashData",
    "advapi32.dll.CryptGetHashParam",
    "cryptsp.dll.CryptGetHashParam",
    "advapi32.dll.CryptDestroyHash",
    "cryptsp.dll.CryptDestroyHash",
    "user32.dll.IsHungAppWindow"
]

[*] Static Analysis: {}