API tools faq
paste
paladin316

Docs_554b6ae3e1c18a03d00ebba444a46e48_doc_2019-06-26_08_30.json

paladin316
Jun 26th, 2019
2,178
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 166.13 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 2.7
  5.  
  6. [*] File Name: "Docs_554b6ae3e1c18a03d00ebba444a46e48.doc"
  7. [*] File Size: 7427
  8. [*] File Type: "Rich Text Format data, version 1, unknown character set"
  9. [*] SHA256: "e50a5dfccc69c11ada06becab145370b7461d3306e64def88acb63da3b9e8e96"
  10. [*] MD5: "554b6ae3e1c18a03d00ebba444a46e48"
  11. [*] SHA1: "a1f8417980f154a0d2ef49db08fbdc021d5dc851"
  12. [*] SHA512: "baf21de62dc71bd5739ab945f710369a59b61b79ee49c8246c7fce7909bd8062b941e397d83e97625addab20d3ae5157c6f64e12393af1234fce8c672eadcf81"
  13. [*] CRC32: "0366DC12"
  14. [*] SSDEEP: "96:x3DLv7t3UlxN+sypYRFCaj8jNazhp+14dK5:tDT7tO+syp8FCaj8jNauiM5"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Attempts to connect to a dead IP:Port (9 unique times)",
  23. "Details": [
  24. {
  25. "IP": "93.184.220.29:80"
  26. },
  27. {
  28. "IP": "65.52.98.231:443"
  29. },
  30. {
  31. "IP": "104.18.24.243:80"
  32. },
  33. {
  34. "IP": "96.16.108.26:443"
  35. },
  36. {
  37. "IP": "23.36.217.46:443"
  38. },
  39. {
  40. "IP": "92.122.253.88:443"
  41. },
  42. {
  43. "IP": "89.249.74.41:80"
  44. },
  45. {
  46. "IP": "52.109.28.23:443"
  47. },
  48. {
  49. "IP": "52.109.76.5:443"
  50. }
  51. ]
  52. },
  53. {
  54. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  55. "Details": [
  56. {
  57. "ioc": "rop.thmx"
  58. },
  59. {
  60. "ioc": "ontent.inf"
  61. },
  62. {
  63. "ioc": "eadlines.thmx"
  64. },
  65. {
  66. "ioc": "adge.thmx"
  67. },
  68. {
  69. "ioc": "erlin.thmx"
  70. },
  71. {
  72. "ioc": "content.inf"
  73. },
  74. {
  75. "ioc": "ircuit.thmx"
  76. },
  77. {
  78. "ioc": "g.n9"
  79. },
  80. {
  81. "ioc": "roplet.thmx"
  82. },
  83. {
  84. "ioc": "vent.thmx"
  85. }
  86. ]
  87. },
  88. {
  89. "Description": "Performs some HTTP requests",
  90. "Details": [
  91. {
  92. "url": "http://www.vaileather.com/rpp/roc/rock.exe"
  93. },
  94. {
  95. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  96. },
  97. {
  98. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  99. }
  100. ]
  101. },
  102. {
  103. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  104. "Details": [
  105. {
  106. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x13$[\\xc3\\xfb@-\\xe5\\x17\\xcbl\\xa8\\xe1#\\xf4\\xe9u\\xf6\\xe78\\x1e\\xd7\\xd2c\\xc0%6(\\x81\\xdb\\x04\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1coffice15client.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  107. },
  108. {
  109. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04}\\xeb\\xc9\\x9e_\\x8e\\xe8o\"\\xf5)\\xef\\x86$\\xbf\\x03>\\xaf\\xe1\\xefz\\xd8[\\x9ek\\xdaw\\xbdzf\\xb6)d\\xd9\\xf9\\x04t^\\xbb|\\xf5\\xb6\\xc7\\x93|\\xe2\\xde\n.\\xa1)$\\x81\\x90b\\xd4h\\x18\\x97[\\xe0\\x9b\\x89\\x02\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xde\\xfc\\x93%k\\x17u\\x18\\xc5\\x13\\x92]r\\x14\\xedy8e\\x05\\xc4\\x0c\\x8d6\\x04\\xef]\\xcc8\\xf5\\x05\\xf7\\xf9m\\xd7>\\xdf\\xfa\n\\x15\\x1c\\xdb4\\xc6\\x11\\x8f\\xebw\\x00"
  110. },
  111. {
  112. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x1f\\xaan\\xfb=to\\x05\\x8c\\xad\\xddr\\xbbb\\x0c\\xbb\\x883@drd\\xfe\\xf2\\xf7}\\x10\\x9b\\x05n\\xe9\\xd8&g\\xe3\\xd6\\x1c\\xd3\\xfb\\xb8\\x06\\x15@\\xb9\\x8b_${o\\xec\\x08\\xf4zlb\\x06\\xc65\\xdc#\\xe5qw\\x02j\\x82\\xddv\\xd4\\xb8\\x9e\\xf8pd?1\\xfcnjn\\x873\\x81z~\\xe6\\x13\\xb5\\x85\\x96\\xe3\\x97\"\\xa4w\\x04\\xfb\\x1f\\xb5x\"\\xcd\\xe5\\xa4@\\x98\\xfe\\x9b\\xbd\\xc7\\x15\\xc2\\xbb?\\x15\\x9c\\xd7-\\x02\\xa0.\\xfa\\xf7y\\x91\\xb1\\xce&\\xe7\\xb2c\\xc6)c\\xa7\\xab<(\\xea\\xdfk\\x96\\x878\\xdf\\x80\\xf7\\xedqf2~\\x05\\xaf\\x19\\x1czf/2\\xa0l\\x86\\xc4i\\xbe\\xa1)z\\x03\\x9a\\xe5d\\x03\\xf7\\x8e.a\\xc4\\x1b\\xe2\\xcc\\xee\\xd3\\xf3\\xdd\\x83\\x01\\xc8\\x97\\x0bd\\xb3\\x1c\\xf5\\xb0\\x90\\x80\\xff\\x10\\x01\\x04\\xdc:\\xa9*\\x9bn\\xe2\\xa3\\xbf\\x00[0>\\xc5\\xca\\xbf pw\\xf93l\\x06n|\\xc5\\xf5:\\xa1\\x1a\"\\x1e\\x1d\\xc7%\\xcb\\xf4d\\xa7\\xf3\\x92\\xec\\x8c8\\xc5\\xaa!\\xc4\\x91"
  113. },
  114. {
  115. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x13$]\\xc5d\\x87\\xb1ty\\xach\\xedu\\xc5\\x03\\xbb\\xf9\\xc3e\\xb6u\\x96b\\xc2\\x8f\\xb8\\x05\\x82\\xf6\\xec\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  116. },
  117. {
  118. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l'\\x9e\\xd0\\x94\\xe2\\xed\\x84\\xe7\\xfb\\xd2\\x10\\xc3\\x8b;\\x0b\\xedd\\x9d\r\\xf1v\\x9c\\x83|\\xed\\xd3\\x9b}\\x87\\xcc\\xf8s\\xd1 \\xfa\\xa8\\xcd\\x9c$e\\x981)(<:\\xb0i\\xb4l\\xa1\\x95\\x1d\\xe3\\xd5\\xdd\\x93\\x1a\\xf6\\x07i\\x7f\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf1s/\\xa0x/\\xfb\\xc8\\xa6b\\x182\\x9b1\\xdc\\xde]\\x8b\\x8c p\\xf7v\\xb3\\xa6,|\\xb9\\xbd\\x1f\\xc7\\x0c9y\\xe8\\xad\\xfb\\x93\\xa9r\\xc4\\xdd\"\\xf0:\\xc8\\xf3\\xc4"
  119. },
  120. {
  121. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  122. },
  123. {
  124. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  125. },
  126. {
  127. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01po\\x03<l\\xa2\\x1d3\\x94zua\\xdc,\\xc5\\xae\\xe4]\\xa5\rt\\xcbq\\xea\\x8clck\\xd6$bq\\xa3\\xfe\\xd0\\x81\\xad\\x18\\xd6u\\xa2\\xe7\\x1bnu\\xdet\\xd4\\xd2\\x99'\\xbc\\xd2=u\\xaf\\xbcl\\xb6\\xa0\\xe1\\xdda\\xbbo\\x92j\\xdcit\\xa5z\\xb0]\\x94\\x15\\xd8\\xbe\\xee'^kn\\x1dj\\xa6\\xe5<\\xeen\\x07n\\x88\\xe2\\xb49\\x01q\\x96]\\xd3w\\xc4s\\xcc\\xd5\\xb3l\\xa7\\xfdl\\xf4\\xc6u/\\xa6i\\x94\\xf6da\\x8b\\xb8u\\x10\\xa0\\xd2\\xf3_\\x1ef#,2\\xe4\\xc8`\\xbc\\x1f\\x8a\\xf8\\xd7ho`\\x0fx\\xe0\\xc2\\xbf;\\x99\\xcc\\xc5\\x90\\xaafj\\xec\\x82o\\xf28=\\xb8\\x89'\\x03\\x9abwj\\x91\\xbb\\x10\\xa4\\x89\\\\x83\\x15n\\x9c\\xef\\x87\\x7f\\x89\\x00 \\xa8\\x99\\x9fy=?\\x94c\\xa9\\x14\\xa4\\x12 \\x92\\xda\\xf3lh\\xfa\\x18\\xe9\\xae\\xcex\\xb1\\xff\\xc7s\\xd0?5\\x01t\\xaa\\x82.\\xbf\\xa8;\\x05\\xba[\\x92i\\xcfu\\xa7\\xdb\\xf9\\xbc\\xdc\\x12u{\\xc7\\xa8\\xbd&\\x8c-\\x0b<\rk"
  128. },
  129. {
  130. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xbd`r\\x85\\xa2@\\xe5\\xa4\\x98i\\x8d\\xc9\\xaf\\xe6s\\x86\\x90\\x1fx\\xba\\xde\\xa7\n\\xde\\x94\\x86\\xcan\\xa9jl\\x98\\x05k\\xa6\\xba*\\xafps\\xea\\x86\\xaf\\xe9\\xd1w\\xf1\\xe8\\xf1\\xd7\\x82$\\xf4\\xe0\\xe6\\xd2\\x00\nai\\x880qq\\xe4\\xdf\\x8c\\xed@\\x1f\\x1a/\\x18`@p\n\\xb1{\\xc26\\x93,\\x90\\x0f\\xef?\\xebm\\x93\\xa5b\\x1a\\xb8\\x08\\x85l\\x7f\\xc2sm\\xb0\\xbe\\xaf\\xcd\\xb3\\x98\\xd8\\x9d\\xe1\\x1e\\\\xba\\xf6)\\xe1w\\x02\\x85\\xee\\x1f\\xb7\\xa7\\xc6\\x03\\x9d\\xe6\rk6\\xdb\\xa9\\xab\\xe2\\xae\\x00\\xa2d\\xc1\\x17\\xa6\\x12r\\xed\\x87n\\xf8\\x94o\\x93ec\\xc3\\x92\\xb0\\x04\\xbew\\xfa\\xe7\\xaee\nq\\xa2=\\x9d\\x1d\\xa3h\\xc2\\x8c\\xf0\\x06;\\x83\\xd6\\x86,i\\xb8\\xc3\\x8e\\xb2\\xad<s|:\\x9e\\x90\\x99i\\xdcn\\x16\\x9a\\xc2\\xa5\\xbbe\\xf1\\xc5\\xccj\\x07f\\x19\\xa5\\xbe\\x11\\xd5@\\xc96\\x83\\xb5{\\x15\\xe2\\xda\\x8a\\xfe\\x0e\\x87q\\xfd\\xee0\\xed\\xdd\\xaf\\x7f\\xe8\\xb3m\\xbb\\xe9\\x85\\xb4v\\xab!\\x90\\xe0~y\\x04j^\\x1c"
  131. },
  132. {
  133. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x13$`p\\x1d\\xcc!xlm\\xf5v2\\xc7\\xf0\\xa2\\x08n\\x92\\x86\\x19\nos\\xd1e\\x88'\\x00r\\x99\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  134. },
  135. {
  136. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x18\\x92^\\xfc\\xcbm\\x089s6uuw\\xe5\\xab\\xfb\\x8f\\x93}#\\xf4\\xeb\\xa2-\\xe2bdq5\\x14\\xbfi!\\xa9\\x10\\xa5\\xa93hsla\\xe2\\x0e\\xc2\\xbe\\x1f\\x0c\\xb5du\\xc9(f\\x94\\xa7r%\\x9a0ylp'\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x86\\xa3\\xa4u\\xb6\\x98\\x1d\\x00n\\xbc\\x0ea\\x9f\\xfd\\x02?\\x12\\x1a1\\xa2\\xa9\\x9b\\x84r={\\x86\\xab\\x9b$\\xd6\\xa9,\\x0b\\xb0v\\xff\\xd3b\\x8e\\xb1\\xb83\\xf8(\\xc1\\x02v"
  137. },
  138. {
  139. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xc2\\xd4\\x05\\xec\\x1c\\x10\\x1f\\xb1i\\x9a\\x8a\\x86\\x17\\x0c\\xe2~\\xc9\\xb0\\xfa\\xde\\x07e?\\xeeb2y\\x80~ffic\\xeds\\xee[v\\xa4qst^s\\xb2\\xd3\\xea\\x90\\x14\\xac\\x8f\\xe7\\x12o\\x95\\x1d\\xf9ur\\xd9z7\\xa1\\xdeu\\x88\n\\xfe,\\xec\\x9c|\\xa8\\xb1\\xc09\\xbew\\xc6\\x89\\xc9\\xd6\\xa9q\\xcbu\\xeb{\\xba\\x0c\\xc6at\\\\x81\\x1c\\xc6\\xa6#8\\x97\\x91\\x18\\xab\\xfb\\xc7\\x8b>?+p\\xd6\\x1c\\xcb\\x16\\xa5\\x8a\\x85\\x93s]\\x91i\\xa6\\xc9\\xc1\\xd2\\xa9\\x99\\x03\\x1f\\xe2\\xfdr+\\xd9a:<\\xcb@\\x1dt\\xf5\\xd2\\x92,\\xe3t_\\x9a[d\\xccr\\xee\\x87\\x0c\\xd4o\\xc0\n\\xdd\\x81\\x99y\\x83\\x07\\xe5k\\xdd\\x96\\xa6~\\xa0\\x12\\xe3(]fq\"\\x97\\x1e\\x00\\xffhv\\xbb\\xbfl\\xb1(\\xa4\nz\\xf0\\xae\\x0fix\\xf7\\x0fg\\xcbc\\xa6\\x80\\xab\\x08\\xbem\\xeb\\xf8\\x85\\xfbk\\xa6f'2\\xcf/\\xe2\\x81\\x1b2`\\xc0\\xa7\\xfd\\xf2\\xcc5\\xbd\\xae=\\x9b\\x01.v\\xe3\\x14\\x8c\\x85\\xbf\\xb5\\xf2n\\xc4d"
  140. },
  141. {
  142. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x13$csh+\\x1e\\x07!\\x03\\xff|g\\xafp^\\xbc\\xc3x]\\xd5\\x8fzx)8\\xce\\x86.\\xfc\\xf3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  143. },
  144. {
  145. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1c(`\\x03\\xc1\\xf1\\xb9\\xf7\\xfdh\\xdc\\xbe\\xe8\\x80\\xbdk\\xdf\\x9bjfw\\xec\\x92:\\xdey\\x196q\\xbf\\x112\\xc8\\x19xdi\\x17\\xf8\\xc2j\\xa2\\x01\\x15\\x11\\xde\\xdb\\xa3|<\\x19m\\xb8en\\x02of\\xb9\\x84\\xa0\\x84\\xc4\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb6\\xd4\t9\\xaby\\x1e\\xce\\xc9\\xf5\\x98\\x11e*\\xd0\\xf0-\\xdckm\\xe5wt\\x93\\xda\\xf6tl\\xc1\\xee\"\\xdb\\x16\\x17\\xf0\\xf3\\xd6\\x94j\nv626\n\\x1e\\xb7z"
  146. },
  147. {
  148. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xc3\\xb3\\x14\\xfasq&\\xe2\\xd2\\x17\\xb3.\\xe3\\xd1\\x14z\\x9a_]fn\\xf3\\x95k\\xb4\\xb4f\\xde-\\xe5}\\xc1+\\xaavl@*cnv\\xbf\\xf3\\x97t\\xf9$\\x00\\x9f\\xb0x\\xba}\\xb5\\xee\\xe5\\x85\\x96hru\\xf0jgm\n\\x1a\\xae\\xb6}~ouje9bye\\xe0w\\x1c\\x95h\\xfa\\xd1\\xfe\\x93h\\x00\\xc1\\xd48\\x1c\\x91`-\\x08b\"\\x95\\x12\\xe3\\x83y\\x10c0ra\\xa7>\\xd5\\x87\\x19\\x0b'~ncq\\xa8\\xad\\x93\\xc9\\xf7\\xce)\\x80gu\\x8a\\xa3g&\\xda\\xa3\\xd9\\xba\\x83\\x8bm\\xaa;\\xb4g\\xae\\x7f\\x06\\\\xde\\xd9\\x02\\x15\\x123\\x8d\\x97xnd\\x97\\x1d\\xb4\\x1b\\xee/\\x1a#p\\xef\\xde)\\xfa.\\x9ddk\\x1e\\x19\\xb9\\xc0\\xef\\xdf9\\x11\\xf0\\xa8\\xa9y\\x0cd\\x15\\xe8\\xde\\xab\\xb9\\xce>\\xd8\\xd2r\\xf4vg\\xcd\\xcay\r\\x8e+q\\xec3\\x0f6w\\x1d\\x1f\\x1ew4s\\xd0\n\\x07k\\xa4\\xcd\\xe4\\x0c\\xa2c\\xb1\\xa5f\\xc5\\xa2\\xe2yd\\x02\\x02\\xaa\\x82\\x1bo\\xf0\\xf5\\xa8\\x91"
  149. },
  150. {
  151. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x13$e\\xf6*\\xd6m\\xba}\\xd9\\xe5\\xa3\\x04\\x14\\xdb\\x07f\\xf0y\\xbf\t\\x00\\xdev\\xa0\\x14\\xfb\\xccnl(\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  152. },
  153. {
  154. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x13$e\\x90m\\xbf\\x8d\\7\r}\\xf1\\xaca2\\xb6\\xb1\\x84~\\xce\\xc2k\\xb9\\xa8h\\xf0v\\x8d\\xef\\x99=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  155. },
  156. {
  157. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x13$e{y\\xb1\\xbb\\xbf\\xb1\\xb8:\\x8f\\x89*\\xf3p\t\\xb2\\xd9!\\xe5i\\x8c\\xbe\\xe2u#\\xac\\xbb\\x93g\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  158. },
  159. {
  160. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x13$e\\x0f\\xc4z\\x1b\\x9b\\xbc\\xaa\\x84\\xfc\\x17s\\xb6\\x99\\x89u\\xe1\\xad\\xae\\xb1\\xbb\\x8f\\xbcpp$\\xb6-\\xbb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  161. },
  162. {
  163. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x13$e[/\\xa6\\xb1kl\\xa2\\x90\\x97,\\x07@\\x90\\xdd\\xbd|\\xad!f_\\x89p\\xd6m\\xdd,\\xf2\\xdf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  164. },
  165. {
  166. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x13$en+\\xdc\\x12\\x98\n\\xb8\\xf7\\xe8\\x1c9(\\x86?y`\\x186\\x1c\\x1bhlg>@8f\\xfe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  167. },
  168. {
  169. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x13$e\\x8c\\xcd\\xb5\\xcdmm\\x1c!\\xd9\\xf1hk\\xb5\\xeez\\x89\\xd5\\xde\\xd7>y\\xf1\\xeal9r\\xfd\\xc5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  170. },
  171. {
  172. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x13$e`\\xbb<\\xc8l\\xa1\\x16\\xb3+\\xbd\\x928\\xb6\\xb91\\\\xda\\xe30/r\\xfd\\x17\\xaa\\x8d\\xd0\\xc6v\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  173. },
  174. {
  175. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x13$e\\xfa]\\xd0\\xdd\\xca\\x92q\\x00\\x19\\xf6c\\x87?\\x0e\\x10{\\x80\\xa0\\x96\\xea\\xbb'\\xef\\x19(n\\x0e\\x8a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  176. },
  177. {
  178. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x13$e\\xe0\\x05\\x9d\\xd6\\xb0\nw\\xbd\\x06\\x06\\xd0\\xb5\\x86\\xf2\\x94\\xb8\\xab\\x14\\xc6\\xa8\\xdf\\x86\\x06u\\xda\\xa4\\xf7\\xa1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  179. },
  180. {
  181. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x13$e\\x16\\xe1\\x0f\\x99\\x97&\\xff\\xb8\t*\\x11\\x1e\\xc7\\x12\\xb9>\\x1d\\xf8w\\xb2\\xb0\\x1a\\xcb\\x9c\\x97&\\xa7[\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  182. },
  183. {
  184. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x83\\xda\\xbf\\xfa\\x87'\\xc4\\xb6\\xdf\\x7ft\\xc3\\xd2!-$\\x0ez\\xf8\r\\xf5\\x96?\\xaa\\xa5\\x1f0\\xee!\\xa73\\xa4j\\xdc\\xaa\\xd3\\x85\\xeb\\xd9\\x02\\xb3\\xdbib\\x93?}\\x9dj\\xba\\xd2\\x194\\xaa\\xef\\xed\\xab*xw\\x03\\xba\\xc3\\xd8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000%\\x93l\\xfa\\xd3<`e\\xd92\\xec\\xff=\\x97\\x0e\\x0f\\xae\\xec\\x0e\\xe2\\x1e\\x84\\xf3\\xech\r\\x84j\\x03\\xb4\\x7f!}\\x90|\"\\xbab8\\x85{)9\\xb7b\\x8b4\\xca"
  185. },
  186. {
  187. "http_request": "winword.exe_WSASend_b\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04wj\\x15\\xe5g\\x0fk\\xa9\\x0et(\\xf5\\xf3k|\\x12[\\x0b\\xf7\\xd8\\xb7v|\\xb7\\x1e\\xdc\\x04\\xf1\\xef\\xec.\\xa3\\x7f\\x9c\\xe0l\\x9d#\\xfbq\\xf2k\\xcfn\\x8c\\x9aaqk\\xd4\\x02\\xeb25\\x19\\xa6z\\xbc\\xc2b\\xdcr\\x192\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd40\\xb7r>n\\x94le\\xb3\\x8fru\\xf7t\\xe0\\x8a\\x90=\\xda<q\\xf9,\\x96\\xac\\x01\r\\xc9yry\\x97\\x849#\\x07\\x8f\\xbd\\x81\\x94\\xac\\xe0u\\x15\\xe8\\xbf{"
  188. },
  189. {
  190. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xad\\x1dx\\xbf&\\xdd\\x98\\xfe6\r\\x97\\xe1\\x89\\xa5\\xb3\\xd1av\\x88e\\x0b\\x9f\\xef\\xe1lq-\\x97p\\xf0upt\\xbf\\xd6\\xcc\\x842\\x12\\x94\\x91\\x86ifm\\xf59\\xac\\x89s 0*y\\x08\\xe2\\xe0\\x1dp\\x8f\\xe7\\xd4\\xe9\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3\\x80\\xe6\\xcc!\\xc2\\xd1f\\x83pjf\\xed<jg\\xa7p:j\\xb0\\xaaj]\\xad\\xdd\\xe2=\\xfct\\xa58\\xdar\\x89\\xe8*\\xe4l\\x10\\x91e\\xde\\xc4\\xd1\\x83\\x85\\x94"
  191. },
  192. {
  193. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@\\xf4<po%)<\\x11t\\x1bg\\xfc*\\xa0\\xe2\\xb6\\xcc\\x87\\xb6\\xdc\\xa1^\\x18cm\\xd8_\\xd3\\xf0\\xb2\\xa3\\xcds[\\xe1\\xc5\\xd7\\x12\\x16\\x1a\\xb6\\xbf\\x9a\\x82\\xa7\\xed\\xb4|\\xc9~'a`\\xc8\\x14\\xbd\\xce\\xe8\\xfd\\xf6\ni\\x8e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcfry\\x06\\x96h\\xd3_v\\xa2w\\x9a\\xc1\\x18\\xc5\\xf8d\\x17\\x82\\x1e\\x8eo\\x95?\\xd9\\xed\\xd1he!\\xda\\x1f\\xdfp\\x13\\x1e\\x06\\xd7\\xbe\\xcb\\x17^\\xa1m\\xc5ln\\x9e"
  194. },
  195. {
  196. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe0@\\x8c&\\xf7o\\x08\\xc9jti\\xd3~qgy\\x03\\x9c\\x7f\\x87\\x1e\\x98\\xbdrb\\xc3\\x8f0\\xd8\\xd7x\\xa1p\\x0b\\x86>\\x0f<\\x7f\\xc9\\xd5a\\xab\\xae\\x05w\\x19p\\x11\\xa4\\xfap\\x0b\\xb1y\\xe2\\xcb\\xa2\\xda\\x00\\xe7y\\xc4\\x7f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000+u\\xb1\\xfc\\xd9\\xb7\\xd0\\x15!\\xfa\\xdd\\xd6\\xc97\\x01\\xdf\\xe0\\x86\\xb2,\\\\xf8t\\xfe\\xbe\\xe7\\xa4!8\\xd6\\xa2 ?\\xf5\\x89\\xb54u[\"\\xec\\x06\\x1e^\\xb7\\x1a\\x8d\\x9a"
  197. },
  198. {
  199. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc8\\xae\\xd4\\xec\\xd62\\xa6\\xa2\\xbc\\xf4\\xb6\\x94+\\xfd\\x90\\x17p\t\\xa5\\x8f\\x1f[\\x0b0i,\\xda1jm\\xf7\\xe4\\xec\\xf16\\xdfpv\\xcd\\x1at\\xa6m\\xd8\\xe0\\xee\\xdb\\xc44#>\\x94\\x00\\xad\\xcc\\x16\\x96q*$\\xea\\xdd\\x0es\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\x8a\\xa2\\xde\\x16\\x15i\\xcfgs\\xf9\\x08\\x12\\xb9\\x8e1\\x8f \\xf08g[,2\\xcfm\\x82\\x9d\\x8f\\x9e[ $\\x90\\xc7\\x1f/[\\x89*\\xaa\\xfd\\x04\\xd3\\x9fp\\x08\\xcb"
  200. },
  201. {
  202. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x13$et\\x80\\xc4\\xa3\\x96\\x16z\\xbbh\\xe6\r\\xcb\\x91\\x07)\\xac<w=\\xca[\\xfda\\xa1\\x97%\\xa5o\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  203. },
  204. {
  205. "http_request": "winword.exe_WSASend_b\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe0>\\x85s\\xff\\xfb\\xff)\\xb1\\x9e~\\xdep\\xbda\\x87\\xe0\\xd5\r\\xb8\\xdb|\\x82-\\xba\\xd4\\xd2\\xc1d\\xfc\\xa3_fg\\x9a^\\xc22\"\\xc4\\xb7\\xb42b\\x80\\xcenqrsl\\x1a?\\xed\t\\xbcc\\xc2o4\\xe3\\x074z\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000}\\xees\\xd7\\xd0\\xd1w\\xa6\\xd5(j\\x11t\\xf4\\xc4\\xa1\\xdec\\xe5\\xd9}\\x81\\x19w.;#}\\x14\\x86(\\xb7\\xc2\\xc6\\xc4\\xa2^\\xee}\\x83\\xe0\\x19\\xf3\\x94s\\xb0\\x94p"
  206. },
  207. {
  208. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04b\\xfabklr\\x93\\xe5f\\xce[v\\xac\\xcf\\x1d\\xb1\\x02c\\x95\\x99\\xc1\\x8b+\\xf4z\\xd2\\x04\\x915\\xd9\\xa7]r\\x81\\xcc\\xd1\\x80-\\xb3\\xa2\\xcd\\xc3\\xae\\xb1\\x05\\xfb\\xa6a\\x9bgc,\\xa06w\\x97\\x8d\\xcd\\x9a\\x04\\xe6 z\\xa4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcb\\xd2\\x9b4y\\x8cq}\\x08\\x0f \\xf3pn\\xb6k(\\xc7]h@\\x8ex\\xf7\\x91\\x05\\x81\\xc4\\x8d{!\\x9a^\\x84\\x83\\xc5\\xa6\\xfa\\x96xh\\xda.v \\x12\\xbd3"
  209. },
  210. {
  211. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x00\\xb0\\x0b\\xf8\\xde\\xba+\\x93\\xb9\\x17o&\\x05\\x1f\\xc83\\x10\\xa2t\\xce\\xa39=\\x8d\\xe0\\xd1\\xbc=9,\\xd2\\x90\\xc1k\\xdf{\\xd2/\\xe9\\x05\\x06i\\xd3\\xbe{\\xa2\\xd5\\xf2g\\xdb\\xfc\\xfa\\xcb\\xa8&!6}m\\xa7s\tv\\xec\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe4\\x90\\xe0w\\x9es/6e\\x00%\\xfb\\xec\\xb3\\xfa\\xee\\xde\\x1cyo9\\xb9\\xaf\\x83\\x8e\\xdf\\xf1\\xd8\\xd0\\xb9\\x1bd\\x9d\\xc0\\x8b\\xb0\\xe8la\\xc9ub`\\xbf\\x92\\x89\\xf7\\x1e"
  212. },
  213. {
  214. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe8o\\x97\\x7f\\xbe\\xc0z\\xe9\\x8b\\x92\\xa16\\xad\\x98o\\xcc\\x11li\\xb2\\xf3i\\xbd(j'ie\\xc19n\\x1e\\xcf\\x0e\\x80\\xb2\\x9f\\xc7\\xa5\\xa0\\xf5t\\x1e,\\x00\\x97\\xc9\\x8ar\\xd0@\\x81\\xe9\\x10t\\xf5m\\xb7s\\x14m\\xe9*%\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000se\\x1dp\\x9f\\x07'>\\xdf\\xc9r\\xf5\\xe4\\xddw\\xc3\\xa9\\x7f\\xd2\\x16\\x8e\\x1ap$\\x02\\xfd\\xdc\\xf6\\xe71f\\xce\\xcd\\x90\\xc9v\\x06\\x81\\xb5\\x162\\xe1\r\\xe1\\xab\\x16\\xc7\\x88"
  215. },
  216. {
  217. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe2\\xa1\\xbc\\xa8\\xe0\\xb3\\xc8\\x08/p\\x8a\\x82\\xf8\\xb0\\xf1\\xd5]\\xcb\\x17d\\x1a\\x86k}a\\xe6\\xeb%\\xd1\\xd6\\xe2*\\xc6\\x17\\xba3\\xc2\\x1e4s\\x02\\xe2\\xac\\x1d#\\xdd8\\x9dt\\xb6@?9\\x9a\\x9d\\xfeoa2\\xa7\\x9a7s\\x1b\\x88\\xa2y5._\\xfd\\xc4\\xa8p_s\\x16\\x85\\xf5\\x1cwvxs\\xdeo\\xc1\\xf0\\xee\\xd9\\x9fj\\x1bwx\\xdbe&\\x98\\xe9\\xd9\\xac\\xa6\\xe7`\\xb2\\xb5$\\x1f\\x08\\x91\\xf5\\xd7\\xd0q\\x8db[\\xbb\\xd8vjy\t\\x17\\x1b\\xa4\\x1c\\x83\\xe0\\x9d=\\xcbs\\xe1\\xd3\\xd5\\x95j_\\xf6j\\xf6\\xe7\\xfc\\x7f-\\xea\\x9d\\x95c\\xe1?a\\x07!\\xb5p\\x81\\xf1>\\xdbch\\xd0o\\xf0\\x9a\\xde\\xc13\\x89\\x18\\x16mhv\\xf9^dsw\\x98x\\xc2^@r\\x12\\xc9b}\r\\x92\\x1d\\xa5\\x1d\\xa6\\xf3\\xbc\\xaa\\xdf\\xa8\\x0b\\x85$\\x91\\x12/\\x9f@\\x9e\\xb7mo\\x0fo\\x84\\xc81\\x0b\\xd4#\\xf0u\\x8c\\xff\\x8a.p\\x14\\x86\\x00\\x80/\\xe4^(d\\x0c:\\x00\\xab*\\x1a\\x19[m\\x9a\\xd2\\xb1"
  218. },
  219. {
  220. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xac\\xb6\\xc0\\xbb}\\x073a=(\\x99pyv\\xd6l\\x9b\\xf0\\xa7\\xb5\\x04\\x817/ v\\x18\\xf1x\\x80\\xe5\\xaf\\xab\\x0b,\\xc3\\x12n\\xa9.\\xf7\\xd0\\x03\\xb9\n\\xfa\\xb0`\\xc1&ii\\xe0\\x86.\\xbf\\xefl\\x80\\xaet(yv\\x1c\\xab\\xc8\\x8a\\xd0\\xd6f\\xc4\\xc0'n\\xc3b'\\xd7@\\x88\\x9e=\\xd6\\xc6&\\x15s\\xa0\\xdby{\\xee\\xdef\\x82v\\xf4w\\xfd\\x18\\xc7r\\xf5\\x0e\\\\xb7\\x0e\\x1b\\xaa\\xbe\\xcd\\xf0\\x06\\x8d)\\xe2\\xd7\\xfc=$_\\x17p\\x0by1\\xad\\x02\\xfc\\xdbdx\\x1ct\\xd1\\x81\\xd1\\xbb\\xfbn\\x91\\x87\\x908\\x91\n\\x92&\\xe47\\xb6zk\\xcc~\\x0b\\x0f}\\xe4\\xfd*\\x03\\x18\\x02n\\x18\\xd0k\\xa1\\x8e\\xf6\\xf8\\x87\\xb0\\xe2\\xc6\\xb9m\\xdb\\x8b\\xcb\\x8ci\\x99zz d\\xc1\\x13)xs\\xf9\\x1b\"\\x1fa\\x98\\xc1\\x02\\x92\\xf9\\x8fl\\xbc\\x0b6\\x04\\xea\\x06`\\xdb\\xce'pp< \\x18\\xb0\\xee\\x87\\xf49o\nrva\\xa0\\xa2vk):\\xe5k\\x963\\xdf\\xf6@dmy\\xbaynw"
  221. },
  222. {
  223. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x047\\x80\\xa7\\xcaj\\xa21\\xf4\\xdax\\xf6\\xd6\\xfae\\x1c\\x04\\xb0\\xb1\\xab\\xcb\\x18.hh\\xc5\\x01\\x97\\x98\\x8f\\x8b\\xee}5[\"\\xf0\\xcfd\\xef\\x9a?\\x86\\x96\\xd01\\xe8\\x9a\\xccv|\\x18\\xd5\\xb2\\x93\\xc4\\xe8|\\xdc>\\xd4\\xd2a\\xbe5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ft\\xdb\\xc8\\xa6t\\x85\\xfb\\x00\\xb9&y\\x0f0\\x1e\\x19\\xa7\\xbd\\x03\\\\x82+=\\x8en\\x07\\xda|\\xc4\\x15fi,\\xd2\\xa66u\\x05\\xb3\\xf6\\xc2h{\\xc4\\xb6}\\x11\\xef"
  224. },
  225. {
  226. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf5\\x03\\xe3\\xc3f\\xb7\\xa5#\\xdak\\xcc\\x06\\x98w\\xd2}j\\x1c6\\x01\\xc5.g\n\\xe8\\xaex\\xf0\\x1a\\xf4q\\xba\\x81|\\xd0\\x89\\x1e\\xa1yj)\\x00\\xd9z\\x88\\xa4p\\xd6e\\xfa\\xd5\\xad\\x95d\\xe3\\x95\\xb5\\xb3\\x1a\\xb3@\\xa8\\xea\\x8f\\x9f\\xe6\\x92w\\xe4l.j\\xa5\\x0c\\xf6\\xb7\\xee>\\xf9n\\x1du\\x1a(h\\xc0\\x14\\x8d\\x99\n\\xc2j)\"\\x1a\\x87)<\\xe86g.\\x8e\\x07\\x84\\x10\\x04<\\xfe\\x96\\x070\\x1d\\xa2f\\x9c\\x8agi\\x81\\xff\\xbb\\xd6{\\xebs\\xfab\\xa4\\xdb\\x1d\\xb1?\ro\\xc9\\xf4tt\\x925\\xa3j\\x9a.\\xa3\\xb8ze\\xced\\x03-\\xb9\\xd7\\\\xdf\\xacam@\\xd1>\\xc8x`\\x9b\\xb9\\xe3\\x85r\\x1c\\xfa\\x85\\x07\\xa9lnc\\x14a.z*\\xb3\\xebk(\\xe2jlc\\x80\\xb2\\xa2(\\x00\\xbcu\\x15\\xee\\x8e\\xec\\xf9\\xe8_b:\\x06\\xbck\\x17\\x16\\xfc\\x05\\xe7r\\x02=\\xc0\\xdd\\xde\\x9fr\\xfe\\x97\\x9a\\xff-\\xe8`\\xd3\\xbf\\xbf\\xd7\\xdc\\xe57\\\\x0b\\xd8t~q\\x1a\\x92\\xe0\\xdaa4\\xc5"
  227. },
  228. {
  229. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x86#\\x16h\\xbe\\xa4sr\\xabc\\x01h\\x99z_\\xf3.\\xf2\\xee0\\xe8\\x86rinvq\\xe8\\xc4@r{\\x87\\x9d\\x94x\\xaf\\x16\\xd1q\\xd4\\x9a\\xceh\\xf2w\\x03\\x97\\x9d\\xb1\\xe2?\\xaf\\x01:\\xf8c\\x8b\\xd7\\xcby*,\\x8e\\x89xp\\xbe\\xd3'x+\\x97\\x80\\x8d\\x07naz\\xcea\rz\\xd9o\\xc9\\x107\\xf2-\\xe3rp\\xeb\\xa2\\x93\\xb7(\\x00\\xa3\\xa4\\x05\\x9b\\xef!p}5%v)'\\xb0\\xd9mj(\n\\xb4'\\xaelh\\xfe\\xe5\\xd8\\xc7{xt\\x9e\\x9ab\\x04<~4\\xfa\\xd6\\xf42\\x1b\\xa4#\\xe4\\xe6\\x8d%\\xf1\\x7f\\x0c\\xa6*\\xaa\\x95\\xea\\x80s\\xd9\\x14y\\x05\\x95\\xf8\\x0b2q\\xd14ml\\x92\\xcco-\\xd0\\xdc\\xb9\\xd1\\x10dq\\xc81\\x91\\x1a\\x82l\\x0e\\x82\\x85\\xa6\\xaa>k\\x07k\\x97w\\xf1z\\xf6\\xbakj\\xf0\\x99\\xad\\xe8\\x11\\x98\\xec\\xa0}\\xcac\\x1fp\\x96\"h\\xc9z[\\s\\xb8wi1\\xc6\\xdc\\x93\\xa0\n\\x7f\\xf3\\xa19k\r\\xc8\\xc2m\\xec{\\xdf\\x01;t]"
  230. },
  231. {
  232. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xecw\\x10\\xf7]\\xfd\\x1c\\xddk\\xef+\\x94\\x182\\x99\\xadx\\x8e\\xc3q\\x98\\xd8\\xc98\\x9c\\xdad\\xc70\\xff\\xf7b\\x1a\\x11\\xc8\\xe5\\xef-4\\x91y\\xfa\\xe6\\x04\\xf1x\\x82\\xab~]\\xc7s\t\\xa1\\x13yvn\\xe5\\xd9\\x8b|\\x8a\\x7f\\xa5\\xf1so\\xf3\\x02\\xf0\\xb9\\x83\\xb9\\x08\\x84\\xc7*]b\\x17\\x9d\\x8bm\\x95\\xa2\\xd2\\xbfro,\\xe4\\xa1\\xe7#6\\xb6\\xfe3\\x1cg\\xaa\\x14\\x91\\xf0g\\xfc8@\\xa3\\xf5\\xe7\\xbb\\xfdy[\\xb2b\\xd55\\xa1]q\\xb0\\xc8\\xee\\xc4\\x96\\x1f\\x98$v\\x07\\x97\\x16m\\xfa\\xcc(\\xaa\\xdb\\x85\\xab\\x16(&\\x0b#\\xb2+t\\xd3l\\x0b\\xc7\"\\x91s\\xdc\\xd4\\x9e\\xbcp\\xa7*\\xa7\\x00\\x13\\xcf\\x8bb\\x02\\<\\x8e\\x043\\xf1\\x05t\\xc5\\xefi'\\x87\\xa7\\\n\\x902\\x81+`\\xd3@x\\x04\\xaax\\xfe\"\\xfb\\x1co\\x9b\\xcc\\x93uz\\x8a#qn\\x9a0\\xa2:\\xa8\\xca\\x83x%\\xaa\\x15\\x84\\xbfu\\xc8\\xf9\\xb2\\x1f+\\xbe\\xbd$3\\xd3\\x8eg\\x17\\xf7=<\\xa8\\xbf)\\xbdel\\x0cy"
  233. },
  234. {
  235. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x81\\xdf_n\\x0bc\\xf2\\xab\\xc4\\xfa\\xb7=\\xa8\\x970ti\\xc6\\xc6\\x81\\x00\r\\x85\\x13\\xcd\\x8ee\\x80\\xad\\xe7\\x9e\\x7f\\x8d\\xcb>\\x9a6\n'\\x8d\t\\xac\\xfdx\\xae\\x873\\xc6\\xb0\\xe1\\xfa\\xd4,\\xa7i\\x1e\\xb9p\\xb5\\xack\\xc3\\xfd\\xed\\xe9~\\x86da\\x8a n\\xa9\\xcfh\\x978\\x97\\xdc.{l\\xf7\\xa6\\xe4,g\\xcd\\x89\\xfe\\x98m\\xc1\\x0bn\\xcb\\xcc.\\xf5\\x82z\\x01\\x00\\xdc\\xaa\\x8f\\xc7\\xb8\\xf0~`\\xbf\\xf4e\\xfc\\xf1\\xdd\\xf5%b\\x8c4\\xdc\\x89\\xac\\x19s\\xb0hr\\xdbp\\xba\\x1cj\\xa0\\x90h\\x95x\\xd0\\x83`\\x85\\x072\\x91\\\\x91k\\xa4\\xec\\xe5ly0sef\\xd4a\\xd6\\xbe\\xb6\\x8ee\\xb9d\\xf6\\x7fr\\xe5m+\\xdd#\\xf7\\xcb\\x8cr\\x8b\\xe8\\x96\\xd3\\x8b\\xa5a\\xe7\\xa5\\xf9nf\\xdf7\\x08y\\x93\\x0c)\\xd2a\\xab>i\\xa8b\\xeb\\x17^\\xaes\\x9c\\x15$-c\\xa6\\xa4\\xb4\\xee\\xfb=/\\xfc\\x9d\\x1fh\\xe2\\xb6!\\xe7\\xe4'\\x18\\xda\\xb7\\xbe\\xc7\\xd7g\\x04f\\xb93\\xbd\\x99\\x8d\\x9b\n\\xb0\\x19"
  236. },
  237. {
  238. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x07z\\x9a\t\\xdf6\\xa9\\xdf\\x1e\\xdc\\xfa\\x7f0%\\x89\\x1944d\\x8ay\\xa5t\\x86\\x98\\xd4\\xe6\\x00\\x125\\xcale\\x1dm9n\\xe4\\xfb=c\\xfd\\x18e.\\xb3\\xd5\r\\xb1\\xc9\\x83\\xa2\\x8a\t\\x0e\\xa5\\xd5\\xf8d\\xd5[\\xf4um\\xa0\\x1c\\xa2\\xd3\\x06\\x9d+\\xa9ef\\x00\\x9b\\x04p\\xad2\\xa66\\xc1\\xea\\xbb\\x93q\\x93\\x8e\\xd3\\x03\\x1aav\\xa6\\xd7\\xed\\xf1\\x18\\xd9\\xbf\\xcag?\\xc0\r\\xbd\"<\\x81\\xa0xq\\x15^\\xe8c\\x11\\x83\\x802\\xc6\\x8b\n\\xeft\\xa8\\xd4\\x8b@k\\xb6\\x19\\x94\\xf1\\xb3\\xd2\\x8f:\\xcbm\\xcd\\x99b\\x9d\\xe3\\x15\\xb0\\x91\\xff>r\\x80x2hx\\xdb\\x0e\\xd6\\xdew\\xe4\\xd7m\\x99\\xc0\\xbd\\x9f\\xa5,\\x96`r\\xe0\\xd4\\x10\\xaai\\x8cl\\x0by\\xc8\\xcb\\xe0\\x90\\xd3=u\\xa8\\xde\\xaa\\xee\\x8f\\xc9\\xac\\xf1<o\\x8d\\xff\\xb7v\\xd1\\xb0i\\xfa\\xaf\\xdc\\xdd\\xde\\x99\\x9bm\\x1d\\xbf\\xd5a\\xd6\\xb2\\xc9!\\xd7rs\\xc6ks&\\xea\\xa6\\xa9\\xd9i\\xff\\xd5)\\xe1y\\x8d\\xefs\\xd6\\xb35\\xdb\\xadh>\\xa2"
  239. },
  240. {
  241. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xaei\\xd9w\\xec\\xc3\\xbf\\xd5\\x90\\xa0\\xb7o\\x8d/\\xadz\\xe1jpjz\\xaa0r\\xec<\n\\xd7o\\xe2\\xde=\\xb7\\x12\\x92\\x1a%\\x0f\\xccw\\xb1:bc\\xf1?\\xec\\xb3\\xc2\\xc0-\\x01js\\xd9\\xfe\\x04\\xad$f\\x85\\xe0\\x12\\x1a\\xb1\\xf5}\\x0b\\x0fu\\x90x\\xc2\\xb2\\x85\\xb5\\xbc\\x8a\\x8d\\x0e\\xd2\\xc5\\x17\\xc4c\\xd1\\xca\\x06\\xd5g\\x0b\\xe0{\\x17ss\\xdfjh\\xe3\\xf8\\xd8\\x82\\xfd\\xd1/\\x8d\\x8e9\\xaa\\xd4\\x1e\\xb4;\\xcaz\\x7f\\x8d\\x97)\\xd37\\xec\\x8c\\xa6x_\\xa9\\x8c\\\\xee\"k\\xcf\\xd7\\xb9\\xb8\\xed\\x92\\xee\\xa4\\xba\\xbb\tv\\xb3\\xa6\\xd5\\x91z}=k\\x0c\\xec^\\xc6\\xa3\\xf8\\x13\\x8d\\x02ru\\x9f9\\x85\\xd46\\xa7\\x072-?\\x95\\xa3\\xd2m\te@1\\x1e\\x95\\x8d\\xf8\\xc9@j\\xcd\\xadw\\x19\\x8c\\xd4d\\x06\\xb0\\xa1\\xa9\\xa1\\x8c\\xb3\\x9d<\\x18gj\\x15f\\x99}\\x91\\xd1\\x81\\x01\\x03z\\xd7\\xe7\\x19\\xd2d\\x05\\x92\\x0b\\x98'-\\xbf\\xea\\x9b\\xc3fv\\xe6ba\\xeeg\\xc5\\xb5`\\x98\\x03\\xaa\\xd9\\xae\\xd0~\\x8e"
  242. },
  243. {
  244. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010yw\\xbf\\x0e\"\\xba]\\x1c\\x02d\\xa7\\xfat\\xee\\xcf\\xb1\\xa0\\xacz.\\x8dq\\x84\\x0e\\xc7\\xf2\\x90\\xda\\xbe\\x92\\x98\\xec\\xfd@6oh!o\\xf1\\xf4\\x06\\xd5!?\\x7f\\xbar\\xd2\\x99\\xf6\\x8e\\xb0\\8#\\xff\\xd6}\\xdb\\xa9\\xc5\\x85\\xfabe\\xc1$u\\x075\\xbcw\\xbf\\x82\\xcc\\xd8\\x83f9+v\\x8b\\xaf\\xb8\\x11\\xf3\\x7fs\\xd9$\\x995\\x8f\\xc8\\x18\\xfb\\xe9\\xd2\\xde\\x9d=\\xd5\\x19\\xd4*\\xa4\\xde\\xda\\xb7s\\x99\t'\\xd3t\\xbc\\x02\\x84\\x9a\\`*\\x92\\x16h\\xc9@v\\xdc\\x03\\x162(\\xd1\\x80\\xe8uf\\xe7\\xb7sm\\x92n\\xe5\\x15\\xae\\x9c+\\xedp\\xf4e\\x995\\xd3p\r\\x7fo\\xe4z\\xbe\\x92\\xb5\\xe7\\x90\\xabr\\x08\\xd6or<\\x99=\\xdf_b\\x02t\\x90\\xe9k\\x1a\\xc0\\x9cs\\xf5\\xe3\\xf0/\\xe7\\xbcp\\x99\\xdbc[bi\\x13\\xf0\n=\\x81\\x12\\x10\\x87\\xdf\\xbf)\\x84\\x8fv\\xc5\\x1d\\xc0\\xa6o\\xc37\\xb4\\xa9\\xd8\\xd0\\x84\\xa6x\\x97\\x94\\x94\\x8a\\x04i\\xef\\xc3l6\\xe1\\x19\\xfe\\xfc\\xe4\\x0f\\x1b\\xe9\\x96\\x81\\x97"
  245. },
  246. {
  247. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd9\\xaaq\\xe9l>*}\\x0c`\\xf4\\xa5\\xf6p\\x1f\\xc7\\x90\\xcb=\\xf9^\\xb4\\xd7\\xb7h\\xec\\x1b_\\x81k\\x9e\\xb1c\\xd3t\\x17\\xee\\xde\\xbd.\\xf8\\xf7\\xa2'\\xb53\\xab\\xa4\\xa1\\xa4\\xd39?\\xa8z\\xabvr\\xe7\\x0b0\\xea|\\x85`\\xa1d\\xa9,\\x1a43p\\xec\"bw\\xad\\xaa\\xb8\\xab}9{e|\\xc6\\xab\\xba\\xb5\\x83\\x96\\xb1\\x99\\xd6\\xb3\\xc6\\x82\\x9fk[.\\xc0\\x04\\xbe\\xfe\\xf0\\xac\\x7f\\xcf\\u\\x1f:\\xd8\\xe6\\xdb\\xf7\\x93qw\\xdd\\xd8q\\x1c\\xd9\\xc7\\x9cu@)\\xe2)\\xc2do\\x94\\xae\\x91\\x95pp,\\xe0\\xc9\\xc7\\x00\\x1a\\x9ep\\xd4;\\xc8p8\\xa8b;?\\x1f\\x0e\\xde^{\\xfc\\xc9/\\x15?&\\xc5\\xa2\\xe5\\xb3\\xaf\\x05\\x85\\xac\\xa3y\\x9c\\xf8\\xd2{\\x15>\\x98\\xf1(~,\\xff\\x96+z\\x85\\xf8\\xab\\xdc\\x1d\\xcb\\xcd\\x08&o\\xc9\\xceg\\xd96\\x06\\xcd;\t\\xe5\\xd2=`\\xfa;\\xad\\xff\\x18\\x10[\\x11\\x9f\\xef\\xa0_\\xa5k\\x15\\xd0\\x13\\x12\\x8c\\xee\\x7f\\xb7\\xeb\\xd9\\x17p\\x1ce\\xb2\\xac\\x16\\xa8\\x8d"
  248. },
  249. {
  250. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010os\\xbe\\x8a\\x06\\x7ff(\\x0b\\xe0d\\xb0\\xeck\\xb9l\\xfda\\xc5}\\x99\\xf2\\xf5\\x8c)&\\x7f\\xd8\\xfd\\xd2\\x92\\x11\\xadk#)\\xc8\\xd4b\\x07\\xa3\\xcavfx\\xa1\\xc0%a\\x0c\\x18\\xf5sw5\\x05\\xc2yl\\xe7l\\xba\\xa8\\x1etawg\\xdd\\xf5\\xbcy\\x02\\x01\\xd3\\xf0\\x82\\xfci&!\\xf8:;\\xfe8\\xc7\\xc8lo\\x0b^\\xb30\\xdb\\xe7\\xa6\\xac9\\x81l\\xe17\\x14#\\xf0\\xbf\\x95\\xea\\x8fr\\xa1h\\xa1\\x8fj\\xe0+\\x8a\\xcc\\x81\\x1f\\\\x1c\\x15p\\xfdgj>s\\x88x\\x07v\\xd8ty\\xcc\\xbd@\\xe9\\xfc\\xeb\\x03]\\x15\\xf2vmn\\x8bd\\xa5\\xc1\\x86vq\\xd6\\x17(m\\x03s\\xcf\\x84yw\\x01l;\\\\xe7a)\\x0e\\xad\\xcfh\\x9d\\xc2\\xfb\\xf7$e:\\xb5]z\\xbed\\x82\\9\\xd9\\x04\\x14k\\xde\\x90\\xfa\\x92\\x98\\x0b$\\xe1a,@\\x9ba\\xff\\x9cirr\\x88[\\xb3\\xed\\xe6\\xae\\xb5\\x1cq\\xf8\\xe9\\xd01!\\xc2a\\xe0\\xda\\x0e~\\x85\\xe2#\\xa4$\\x04p\\xd7\\x10)\\x08>p\\x98k"
  251. },
  252. {
  253. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00do\t\n\\x8fec\\xf8>ll\\xaa<\\xc1q\\x0c\\xb1z\\x7f\\x11w?i\\x86z\\xcbc\\xec\\xc6t\\x9d\\xa7$\\x95\\x97u\\xa1;\\x84\\xcb\\x9d$o\\xa1f\\xe0;p\\xbb\\xca\\x0cey\\x89\\x1f\\xa2bm\\xa4\\xb4\\x98\\xfckw9g\\x12\\xe5r\\xd4\\x80qo\\xfa\\x06\\xe7\\xd7\\x8c\\x13']q\\xfb\\xd2\\xc9\\xb8\\x80\\xeaj\\xb3^\\x1b\\xc2w\\x91l:+\\xa1&\\x97\\x11\\xba8\\xe8\\xe2i.\\x9b\\x01k\\xfeq/\\xaf\\x1b&\\x0e#\\xab<\\xf5\\xfb\\xef-\\x18xu\"\\xba\\x14\\x19\\xe1\\xdetr\\xf3\\x8d\\x1a\\xaat\\x8e?\\x8a\\xf0\\x1007\\x99\\xb4\\xe3{#0\\xf7\\xea\\x05\\xa5\\xebw s\\x99\\xbc\\xcax@?\\x180zm\\x9fv\\x10\\xf0\\xa1\\xcd\\x93c\\xecz\\x97\\xccza0\\xf8m\\xfee\\x90y\\xff\\xb0\\x1e\\xcd?\\x962\\xefp\\x9co\\x80\\xf1\\xef\\xe9\\x82#\\xa8\\x0e\\xdc\\xd8\\xa6z\\xf3:w\\x97\\xa8\\xab\\xc7\\xd7$s\\xefd\\x86\\x96\\xfe\\x98\\xc3%:\\xc0\\x94g\\xeax\\x85s\\x8aj~"
  254. },
  255. {
  256. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\xfeb\\xd6\\xb2\\xab!!u\\xc4'\\xfc\n\\x85\\x0c\\x8f*\\xed\\xec-\\xcf\\xcf\\x0b>\\xfd\\x03\\xb3\\xdf\\x9as\\xe2w\\xf1\\xee\\xa3\\x96\\xcbfj2l\\x8f\\xa9\\xc4thw\\xb5\\xa3\\x8e\\xb7>p\\xb2\\xcctd\\xb5\\x03u\\x9c\\xa1!\\x93l\\x82&+\\xb7\\x1f\\x93\\xed\\xa6\\xc4\\xf5\\xbd\\x19hz\\x15\\x14\\xf0m\\xd4\\x85\\x08~\\xd0\\x15c\\x1e\\xbcp\\xbe\\xf24x\\x94\\xa8:\\xec\\x04.\\xf9\\x96\\xb8ze\\xdcz}g\\xedy\\x95x\\xd0\\x9b\\x8b\\x1fn\\xe3g\\x85\\x06\\x1b3\\x1f\\x8ca\\x7f\\x1e\\xdcg\\x9c1`}t@\\xa3$\\\\xa1\\x07w\\xc6#\\xd8bb\\x85\\xef*=\\x1bt\\xa4\\xf5\\xe3$\\xd0(\\x06?\\xea${\\x89v\\xb3#_t\\xe0\\x19\\x9fuy\\xf6\\xeb\\xf6\\xaa\\xb1\\x89\\xc6/\\x8c\\x0f\n\\xbfs\\xa1\\xb8o\\xe5ea\\xf9\\xddk.,\\x96c}\\x82}\\xedf4\\xc0\\xc9\\xd2\\x8f\\x8d\\x9c\\xcflb\\xd9\\x02%\\xaf`\\xf3w\\x1c\\xa2\\xf4r\\xf1\\xec\\xa7r\\x18\\x81c{\\xfdb\\x16-p\\xe00<{(}\\xfb "
  257. },
  258. {
  259. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019pv\\x94w,\\xa21zx0\\x85q\\xbe&\\x05\\xde\\xdc\\xf2\\xc8\\xaca\\xd9\\xb7\\xd5\\xe8\\xad\\x14*\\x15_\\xf5\\xebvw\\xd7yi.\\x80\\x81&\\x1a\\xa2\\x8f\\xd3\\xb3a\\xfd'y\\xcf\\xe1\\xca\\xdb\\xd5\\xca,b\\xef\\x8b\\xec\\x80\\xabgm&\\x9fb\\xb0:\\x81j\\x913>\\xdc\\xf1\\xe0\\xb3d\\xa7f+\\xe0\\x8b\\xfe\\xe8\\x17\\xdc\\xeewyk\\xe7\\x89\\xe4\\xdbr0\\x96\\xc8\\xcfc\\xb7;\\xc1g\\xab\\x8c'c}f}d]\n@\\xa0hw\\xc8.\\xeb\\x04ie\\xcd\\x99\\x0f\\xbd\\xc2\\xeb\\xb0\\xefjngv\\x10\\xd6)o!\\xbbl\\x9bl\\xe5\\x90m,\\xbbxx\\x9f=r:\\\\xb9\\xd7;lsm\\xd3<#[\\x96p\\x14d\\xd4\\xda\\x9c\\xe6\\x96\\x8em\\xc8\\x95en2\\x19k\\\\xda7\\x0f\\xc3\\x95\\xb0\n\\xa9d\\xd2e\\xa3\\xfcm\\xd6^\\xc8\\xv#sz\\x1cw\\xad\\x07\\x84\\xd0`\\xc7\\x85=x&\\xc7\\xa2\\xae\n0i\\xd1\\x18\\xe6pv\\x01p\\xd9\\xbc\\x0f\\xc3\\x03f8\\x8f\\xac\\xd9\\xa7\\xce\\x1c\\x02\\xcb"
  260. },
  261. {
  262. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  263. }
  264. ]
  265. },
  266. {
  267. "Description": "Creates a hidden or system file",
  268. "Details": [
  269. {
  270. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  271. },
  272. {
  273. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  274. }
  275. ]
  276. }
  277. ]
  278.  
  279. [*] Started Service: [
  280. "osppsvc"
  281. ]
  282.  
  283. [*] Executed Commands: []
  284.  
  285. [*] Mutexes: [
  286. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  287. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  288. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  289. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  290. "CicLoadWinStaWinSta0",
  291. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  292. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  293. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  294. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}"
  295. ]
  296.  
  297. [*] Modified Files: [
  298. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_554b6ae3e1c18a03d00ebba444a46e48.doc",
  299. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_554b6ae3e1c18a03d00ebba444a46e48.doc",
  300. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{D7BE9455-07D7-4ED5-BBA4-F9F26631FE53}.tmp",
  301. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  302. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  303. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  304. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  305. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  306. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDD3E.tmp",
  307. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDD3F.tmp",
  308. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{7E79C557-1E74-4850-B9D8-F6B6FABED893}.tmp",
  309. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_554b6ae3e1c18a03d00ebba444a46e48.asd",
  310. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  311. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  312. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF126834CEA3D4E568.TMP",
  313. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  314. "C:\\Users\\user\\AppData\\Local\\Temp\\cab23D.tmp",
  315. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3D4.tmp",
  316. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  317. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  318. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5B9.tmp",
  319. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5BA.tmp",
  320. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  321. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FA.tmp\\Crop.thmx",
  322. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FA.tmp\\Content.inf",
  323. "C:\\Users\\user\\AppData\\Local\\Temp\\cab62A.tmp",
  324. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  325. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A8.tmp\\Headlines.thmx",
  326. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  327. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  328. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B8.tmp\\Badge.thmx",
  329. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A8.tmp\\Content.inf",
  330. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B8.tmp\\Content.inf",
  331. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  332. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  333. "C:\\Users\\user\\AppData\\Local\\Temp\\cab978.tmp",
  334. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D7.tmp\\Berlin.thmx",
  335. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D7.tmp\\content.inf",
  336. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
  337. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1198.tmp",
  338. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1236.tmp\\Circuit.thmx",
  339. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1236.tmp\\content.inf",
  340. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
  341. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1544.tmp",
  342. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD15C2.tmp\\content.inf",
  343. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD15C2.tmp\\Droplet.thmx",
  344. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
  345. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2BAC.tmp",
  346. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2C69.tmp",
  347. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2C6A.tmp",
  348. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2C9A.tmp",
  349. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2CAA.tmp",
  350. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2CDA.tmp\\content.inf",
  351. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2CDA.tmp\\Main_Event.thmx",
  352. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
  353. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  354. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  355. ]
  356.  
  357. [*] Deleted Files: [
  358. "C:\\Users\\user\\AppData\\Local\\Temp\\CabDD3E.tmp",
  359. "C:\\Users\\user\\AppData\\Local\\Temp\\TarDD3F.tmp",
  360. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  361. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  362. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Docs_554b6ae3e1c18a03d00ebba444a46e48.asd",
  363. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  364. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  365. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457464[[fn=Dividend]].eftx",
  366. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457444[[fn=Basis]].eftx",
  367. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457475[[fn=Frame]].eftx",
  368. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090430[[fn=Banded]].eftx",
  369. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457510[[fn=Savon]].eftx",
  370. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457485[[fn=Mesh]].eftx",
  371. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457515[[fn=View]].eftx",
  372. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457464[[fn=Dividend]].xml",
  373. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457475[[fn=Frame]].xml",
  374. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457444[[fn=Basis]].xml",
  375. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090430[[fn=Banded]].xml",
  376. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457503[[fn=Quotable]].eftx",
  377. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457485[[fn=Mesh]].xml",
  378. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457491[[fn=Metropolitan]].eftx",
  379. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457475[[fn=Frame]].xml",
  380. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457444[[fn=Basis]].xml",
  381. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090430[[fn=Banded]].xml",
  382. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457515[[fn=View]].xml",
  383. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457510[[fn=Savon]].xml",
  384. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457464[[fn=Dividend]].xml",
  385. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457503[[fn=Quotable]].xml",
  386. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457515[[fn=View]].xml",
  387. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457496[[fn=Parallax]].eftx",
  388. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457485[[fn=Mesh]].xml",
  389. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457491[[fn=Metropolitan]].xml",
  390. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03090434[[fn=Wood Type]].eftx",
  391. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457510[[fn=Savon]].xml",
  392. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457503[[fn=Quotable]].xml",
  393. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457496[[fn=Parallax]].xml",
  394. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457491[[fn=Metropolitan]].xml",
  395. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03090434[[fn=Wood Type]].xml",
  396. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457496[[fn=Parallax]].xml",
  397. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03090434[[fn=Wood Type]].xml",
  398. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033929[[fn=Slate]].eftx",
  399. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033929[[fn=Slate]].xml",
  400. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033929[[fn=Slate]].xml",
  401. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5B9.tmp",
  402. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5BA.tmp",
  403. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FA.tmp",
  404. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5FA.tmp\\Crop.thmx",
  405. "C:\\Users\\user\\AppData\\Local\\Temp\\cab23D.tmp",
  406. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A8.tmp",
  407. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B8.tmp",
  408. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B8.tmp\\Badge.thmx",
  409. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A8.tmp\\Headlines.thmx",
  410. "C:\\Users\\user\\AppData\\Local\\Temp\\cab62A.tmp",
  411. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3D4.tmp",
  412. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D7.tmp",
  413. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9D7.tmp\\Berlin.thmx",
  414. "C:\\Users\\user\\AppData\\Local\\Temp\\cab978.tmp",
  415. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1236.tmp",
  416. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1236.tmp\\Circuit.thmx",
  417. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1198.tmp",
  418. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD15C2.tmp",
  419. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD15C2.tmp\\Droplet.thmx",
  420. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1544.tmp",
  421. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001104[[fn=Feathered]].eftx",
  422. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033921[[fn=Damask]].eftx",
  423. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001104[[fn=Feathered]].xml",
  424. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033937[[fn=Vapor Trail]].eftx",
  425. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033937[[fn=Vapor Trail]].xml",
  426. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033921[[fn=Damask]].xml",
  427. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033937[[fn=Vapor Trail]].xml",
  428. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033921[[fn=Damask]].xml",
  429. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001104[[fn=Feathered]].xml",
  430. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2C69.tmp",
  431. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2C6A.tmp",
  432. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2C9A.tmp",
  433. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2CAA.tmp",
  434. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2CDA.tmp",
  435. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2CDA.tmp\\Main_Event.thmx",
  436. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2BAC.tmp",
  437. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  438. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{7E79C557-1E74-4850-B9D8-F6B6FABED893}.tmp",
  439. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_554b6ae3e1c18a03d00ebba444a46e48.doc"
  440. ]
  441.  
  442. [*] Modified Registry Keys: [
  443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\r!4",
  444. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\22CABCB",
  464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\22CABCB\\22CABCB",
  465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  467. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  468. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\22CABCB\\248AC60",
  713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  994. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1000. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1001. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1002. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1003. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1004. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1005. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1006. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1007. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1008. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1009. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1010. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1011. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1012. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1013. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1014. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1015. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1016. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1017. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1018. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1019. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1020. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1021. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1022. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1023. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1024. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1025. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1026. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1027. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1028. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1029. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1030. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1031. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1032. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1033. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1034. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1035. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1036. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1037. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1038. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1039. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1040. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1041. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1042. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1043. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1044. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1045. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1046. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1047. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1048. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1049. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1050. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1051. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1052. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1053. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1054. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1055. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1056. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1057. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1058. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1059. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1060. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1061. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1063. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1064. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1065. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1066. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
  1073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT",
  1074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position"
  1079. ]
  1080.  
  1081. [*] Deleted Registry Keys: [
  1082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\r!4",
  1083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\gf2",
  1084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT",
  1137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\22CABCB\\248AC60",
  1138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\22CABCB\\22CABCB"
  1139. ]
  1140.  
  1141. [*] DNS Communications: [
  1142. {
  1143. "type": "A",
  1144. "request": "www.vaileather.com",
  1145. "answers": [
  1146. {
  1147. "data": "vaileather.com",
  1148. "type": "CNAME"
  1149. },
  1150. {
  1151. "data": "103.23.20.237",
  1152. "type": "A"
  1153. }
  1154. ]
  1155. }
  1156. ]
  1157.  
  1158. [*] Domains: [
  1159. {
  1160. "ip": "103.23.20.237",
  1161. "domain": "www.vaileather.com"
  1162. }
  1163. ]
  1164.  
  1165. [*] Network Communication - ICMP: []
  1166.  
  1167. [*] Network Communication - HTTP: [
  1168. {
  1169. "count": 1,
  1170. "body": "",
  1171. "uri": "http://www.vaileather.com/rpp/roc/rock.exe",
  1172. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1173. "method": "GET",
  1174. "host": "www.vaileather.com",
  1175. "version": "1.1",
  1176. "path": "/rpp/roc/rock.exe",
  1177. "data": "GET /rpp/roc/rock.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.vaileather.com\r\nConnection: Keep-Alive\r\n\r\n",
  1178. "port": 80
  1179. },
  1180. {
  1181. "count": 1,
  1182. "body": "",
  1183. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1184. "user-agent": "Microsoft-CryptoAPI/6.1",
  1185. "method": "GET",
  1186. "host": "ocsp.digicert.com",
  1187. "version": "1.1",
  1188. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1189. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1190. "port": 80
  1191. },
  1192. {
  1193. "count": 1,
  1194. "body": "",
  1195. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1196. "user-agent": "Microsoft-CryptoAPI/6.1",
  1197. "method": "GET",
  1198. "host": "ocsp.msocsp.com",
  1199. "version": "1.1",
  1200. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1201. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1202. "port": 80
  1203. },
  1204. {
  1205. "count": 2,
  1206. "body": "",
  1207. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1208. "user-agent": "Microsoft-CryptoAPI/6.1",
  1209. "method": "GET",
  1210. "host": "crl.microsoft.com",
  1211. "version": "1.1",
  1212. "path": "/pki/crl/products/microsoftrootcert.crl",
  1213. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1214. "port": 80
  1215. },
  1216. {
  1217. "count": 1,
  1218. "body": "",
  1219. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1220. "user-agent": "Microsoft-CryptoAPI/6.1",
  1221. "method": "GET",
  1222. "host": "crl.microsoft.com",
  1223. "version": "1.1",
  1224. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1225. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1226. "port": 80
  1227. }
  1228. ]
  1229.  
  1230. [*] Network Communication - SMTP: []
  1231.  
  1232. [*] Network Communication - Hosts: []
  1233.  
  1234. [*] Network Communication - IRC: []
  1235.  
  1236. [*] Static Analysis: {}
  1237.  
  1238. [*] Resolved APIs: [
  1239. "mso.dll.#1443",
  1240. "mso.dll.#9214",
  1241. "mso.dll.#199",
  1242. "mso.dll.#1073",
  1243. "mso.dll.#4255",
  1244. "ws2_32.dll.#6",
  1245. "ws2_32.dll.#5",
  1246. "schannel.dll.SpUserModeInitialize",
  1247. "advapi32.dll.RegCreateKeyExW",
  1248. "advapi32.dll.RegQueryValueExW",
  1249. "advapi32.dll.RegCloseKey",
  1250. "ws2_32.dll.WSASend",
  1251. "ws2_32.dll.WSARecv",
  1252. "mso.dll.#3459",
  1253. "mso.dll.#1262",
  1254. "mso.dll.#5709",
  1255. "mso.dll.#7353",
  1256. "mso.dll.#5228",
  1257. "mso.dll.#2155",
  1258. "mso.dll.#1725",
  1259. "user32.dll.RegisterWindowMessageW",
  1260. "mso.dll.#4314",
  1261. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  1262. "mso.dll.#6484",
  1263. "mso.dll.#8499",
  1264. "mso.dll.#9871",
  1265. "mso.dll.#4743",
  1266. "mso.dll.#5452",
  1267. "mso.dll.#2088",
  1268. "mso.dll.#5274",
  1269. "mso.dll.#3195",
  1270. "mso.dll.#8165",
  1271. "mso.dll.#9175",
  1272. "mso.dll.#5315",
  1273. "mso.dll.#8140",
  1274. "user32.dll.IsWindowEnabled",
  1275. "ole32.dll.CoGetCallState",
  1276. "ole32.dll.CoGetActivationState",
  1277. "advapi32.dll.RegisterWaitChainCOMCallback",
  1278. "secur32.dll.FreeContextBuffer",
  1279. "ncrypt.dll.SslOpenProvider",
  1280. "ncrypt.dll.GetSChannelInterface",
  1281. "bcryptprimitives.dll.GetHashInterface",
  1282. "ncrypt.dll.SslIncrementProviderReferenceCount",
  1283. "ncrypt.dll.SslImportKey",
  1284. "bcryptprimitives.dll.GetCipherInterface",
  1285. "ncrypt.dll.SslLookupCipherSuiteInfo",
  1286. "user32.dll.LoadStringW",
  1287. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  1288. "ncrypt.dll.BCryptGetProperty",
  1289. "ncrypt.dll.BCryptCreateHash",
  1290. "ncrypt.dll.BCryptHashData",
  1291. "ncrypt.dll.BCryptFinishHash",
  1292. "ncrypt.dll.BCryptDestroyHash",
  1293. "crypt32.dll.CertGetCertificateChain",
  1294. "userenv.dll.GetUserProfileDirectoryW",
  1295. "sechost.dll.ConvertSidToStringSidW",
  1296. "sechost.dll.ConvertStringSidToSidW",
  1297. "userenv.dll.RegisterGPNotification",
  1298. "gpapi.dll.RegisterGPNotificationInternal",
  1299. "sechost.dll.OpenSCManagerW",
  1300. "sechost.dll.OpenServiceW",
  1301. "sechost.dll.CloseServiceHandle",
  1302. "sechost.dll.QueryServiceConfigW",
  1303. "cryptsp.dll.CryptAcquireContextA",
  1304. "cryptsp.dll.CryptCreateHash",
  1305. "cryptsp.dll.CryptHashData",
  1306. "cryptsp.dll.CryptVerifySignatureA",
  1307. "cryptsp.dll.CryptDestroyKey",
  1308. "cryptsp.dll.CryptDestroyHash",
  1309. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  1310. "ncrypt.dll.BCryptImportKeyPair",
  1311. "ncrypt.dll.BCryptVerifySignature",
  1312. "ncrypt.dll.BCryptDestroyKey",
  1313. "crypt32.dll.CertVerifyCertificateChainPolicy",
  1314. "crypt32.dll.CertFreeCertificateChain",
  1315. "crypt32.dll.CertDuplicateCertificateContext",
  1316. "ncrypt.dll.SslEncryptPacket",
  1317. "ncrypt.dll.SslDecryptPacket",
  1318. "winhttp.dll.WinHttpReceiveResponse",
  1319. "winhttp.dll.WinHttpQueryHeaders",
  1320. "winhttp.dll.WinHttpQueryDataAvailable",
  1321. "winhttp.dll.WinHttpReadData",
  1322. "webservices.dll.WsCreateError",
  1323. "ntdll.dll.EtwEventWrite",
  1324. "ntdll.dll.EtwEventRegister",
  1325. "ntdll.dll.EtwEventUnregister",
  1326. "webservices.dll.WsCreateHeap",
  1327. "webservices.dll.WsCreateReader",
  1328. "webservices.dll.WsSetInput",
  1329. "webservices.dll.WsFillReader",
  1330. "webservices.dll.WsReadToStartElement",
  1331. "webservices.dll.WsReadStartElement",
  1332. "webservices.dll.WsReadType",
  1333. "winhttp.dll.WinHttpCloseHandle",
  1334. "crypt32.dll.CertFreeCertificateContext",
  1335. "rpcrt4.dll.RpcBindingFree",
  1336. "webservices.dll.WsFreeReader",
  1337. "webservices.dll.WsFreeError",
  1338. "webservices.dll.WsFreeHeap",
  1339. "webservices.dll.WsCreateServiceProxyFromTemplate",
  1340. "winhttp.dll.WinHttpOpenRequest",
  1341. "winhttp.dll.WinHttpAddRequestHeaders",
  1342. "winhttp.dll.WinHttpSendRequest",
  1343. "winhttp.dll.WinHttpConnect",
  1344. "winhttp.dll.WinHttpCrackUrl",
  1345. "winhttp.dll.WinHttpSetStatusCallback",
  1346. "winhttp.dll.WinHttpOpen",
  1347. "winhttp.dll.WinHttpSetOption",
  1348. "winhttp.dll.WinHttpWriteData",
  1349. "winhttp.dll.WinHttpSetCredentials",
  1350. "winhttp.dll.WinHttpQueryAuthSchemes",
  1351. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1352. "winhttp.dll.WinHttpGetProxyForUrl",
  1353. "winhttp.dll.WinHttpQueryOption",
  1354. "webservices.dll.WsOpenServiceProxy",
  1355. "webservices.dll.WsCall",
  1356. "webservices.dll.WsAddCustomHeader",
  1357. "shlwapi.dll.StrStrA",
  1358. "shlwapi.dll.UrlUnescapeA",
  1359. "user32.dll.IsHungAppWindow",
  1360. "user32.dll.GetForegroundWindow",
  1361. "mso.dll.#7531",
  1362. "cryptnet.dll.CertDllVerifyRevocation",
  1363. "profapi.dll.#104",
  1364. "sensapi.dll.IsNetworkAlive",
  1365. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1366. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1367. "rpcrt4.dll.NdrClientCall2",
  1368. "winhttp.dll.WinHttpSetTimeouts",
  1369. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  1370. "shlwapi.dll.StrStrIW",
  1371. "winhttp.dll.WinHttpTimeFromSystemTime",
  1372. "cryptnet.dll.I_CryptNetGetConnectivity",
  1373. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  1374. "setupapi.dll.SetupIterateCabinetW",
  1375. "kernel32.dll.RegOpenKeyExW",
  1376. "kernel32.dll.RegCloseKey",
  1377. "cabinet.dll.#20",
  1378. "cabinet.dll.#22",
  1379. "devrtl.dll.DevRtlGetThreadLogToken",
  1380. "cryptsp.dll.CryptSetHashParam",
  1381. "sechost.dll.QueryServiceConfigA",
  1382. "sechost.dll.QueryServiceStatus",
  1383. "rpcrt4.dll.RpcStringBindingComposeA",
  1384. "rpcrt4.dll.RpcBindingFromStringBindingA",
  1385. "rpcrt4.dll.RpcEpResolveBinding",
  1386. "sechost.dll.LookupAccountSidLocalW",
  1387. "rpcrt4.dll.RpcStringFreeA",
  1388. "mso.dll.#25",
  1389. "mso.dll.#1056",
  1390. "mso.dll.#8136",
  1391. "mso.dll.#8931",
  1392. "shell32.dll.SHGetFileInfoW",
  1393. "mso.dll.#5362",
  1394. "mso.dll.#6044",
  1395. "mso.dll.#6516",
  1396. "mso.dll.#6221",
  1397. "mso.dll.#5780",
  1398. "mso.dll.#4870",
  1399. "mso.dll.#6046",
  1400. "mso.dll.#1241",
  1401. "mso.dll.#2821",
  1402. "mso.dll.#2340",
  1403. "mso.dll.#7287",
  1404. "mso.dll.#5290",
  1405. "mso.dll.#1508",
  1406. "user32.dll.IsZoomed",
  1407. "user32.dll.GetWindowPlacement",
  1408. "user32.dll.GetWindowRect",
  1409. "mso.dll.#821",
  1410. "user32.dll.GetSystemMetrics",
  1411. "user32.dll.MonitorFromWindow",
  1412. "user32.dll.MonitorFromRect",
  1413. "user32.dll.MonitorFromPoint",
  1414. "user32.dll.EnumDisplayMonitors",
  1415. "user32.dll.GetMonitorInfoA",
  1416. "user32.dll.EnumDisplayDevicesA",
  1417. "mso.dll.#2378",
  1418. "user32.dll.SetWindowPos",
  1419. "user32.dll.AdjustWindowRect",
  1420. "mso.dll.#5912",
  1421. "mso.dll.#9719",
  1422. "mso.dll.#8824",
  1423. "mso.dll.#6117",
  1424. "mso.dll.#3307",
  1425. "user32.dll.SendMessageW",
  1426. "user32.dll.DestroyIcon",
  1427. "mso.dll.#3813",
  1428. "mso.dll.#1815",
  1429. "user32.dll.PtInRect",
  1430. "mso.dll.#1613",
  1431. "user32.dll.SetWindowTextW",
  1432. "user32.dll.GetClassLongW",
  1433. "mso.dll.#8572",
  1434. "gdi32.dll.CreateDIBSection",
  1435. "gdi32.dll.CreateCompatibleDC",
  1436. "gdi32.dll.GetViewportOrgEx",
  1437. "gdi32.dll.SetViewportOrgEx",
  1438. "gdi32.dll.SetBkColor",
  1439. "gdi32.dll.ExtTextOutA",
  1440. "mso.dll.#1573",
  1441. "mso.dll.#8612",
  1442. "user32.dll.SetScrollRange",
  1443. "mso.dll.#2509",
  1444. "user32.dll.BeginDeferWindowPos",
  1445. "user32.dll.DeferWindowPos",
  1446. "user32.dll.EndDeferWindowPos",
  1447. "user32.dll.OffsetRect",
  1448. "user32.dll.EnumChildWindows",
  1449. "user32.dll.GetScrollInfo",
  1450. "user32.dll.MapWindowPoints",
  1451. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  1452. "gdi32.dll.DeleteDC",
  1453. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  1454. "mso.dll.#6126",
  1455. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  1456. "gdi32.dll.GetFontRealizationInfo",
  1457. "gdi32.dll.GetFontFileInfo",
  1458. "gdi32.dll.GetFontFileData",
  1459. "mso.dll.#7261",
  1460. "mso.dll.#9540",
  1461. "usp10.dll.ScriptGetFontScriptTags",
  1462. "usp10.dll.ScriptGetFontLanguageTags",
  1463. "usp10.dll.ScriptGetFontFeatureTags",
  1464. "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
  1465. "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
  1466. "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
  1467. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  1468. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  1469. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  1470. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  1471. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  1472. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  1473. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  1474. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  1475. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  1476. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  1477. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  1478. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  1479. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  1480. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  1481. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  1482. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  1483. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  1484. "user32.dll.SetRectEmpty",
  1485. "user32.dll.InflateRect",
  1486. "mso.dll.#1100",
  1487. "mso.dll.#7047",
  1488. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  1489. "user32.dll.GetCursor",
  1490. "user32.dll.GetClientRect",
  1491. "user32.dll.SetScrollInfo",
  1492. "user32.dll.SetScrollPos",
  1493. "mso.dll.#3747",
  1494. "mso.dll.#8218",
  1495. "mso.dll.#5394",
  1496. "mso.dll.#331",
  1497. "mso.dll.#6829",
  1498. "mso.dll.#539",
  1499. "mso.dll.#4959",
  1500. "mso.dll.#6463",
  1501. "mso.dll.#4987",
  1502. "user32.dll.GetWindow",
  1503. "mso.dll.#7195",
  1504. "mso.dll.#7573",
  1505. "mso.dll.#5932",
  1506. "mso.dll.#2071",
  1507. "mso.dll.#1024",
  1508. "mso.dll.#6245",
  1509. "mso.dll.#9041",
  1510. "mso.dll.#1767",
  1511. "mso.dll.#9369",
  1512. "mso.dll.#4617",
  1513. "user32.dll.FillRect",
  1514. "mso.dll.#343",
  1515. "mso.dll.#9636",
  1516. "mso.dll.#2022",
  1517. "mso.dll.#4750",
  1518. "mso.dll.#4577",
  1519. "webservices.dll.WsResetHeap",
  1520. "webservices.dll.WsCloseServiceProxy",
  1521. "user32.dll.RegisterPowerSettingNotification",
  1522. "powrprof.dll.PowerSettingRegisterNotification",
  1523. "user32.dll.GetWindowThreadProcessId",
  1524. "user32.dll.GetWindowTextW",
  1525. "shell32.dll.SHAddToRecentDocs",
  1526. "mso.dll.#850",
  1527. "ole32.dll.PropVariantClear",
  1528. "oleaut32.dll.#9",
  1529. "ws2_32.dll.#3",
  1530. "webservices.dll.WsFreeServiceProxy",
  1531. "advapi32.dll.RegQueryValueW",
  1532. "apphelp.dll.ApphelpCheckShellObject",
  1533. "ncrypt.dll.SslDecrementProviderReferenceCount",
  1534. "ncrypt.dll.SslFreeObject",
  1535. "mso.dll.#1776",
  1536. "mso.dll.#9026",
  1537. "mso.dll.#4497",
  1538. "ole32.dll.CoRevokeInitializeSpy",
  1539. "comctl32.dll.#388",
  1540. "mso.dll.#4647",
  1541. "mso.dll.#8926",
  1542. "mso.dll.#7212",
  1543. "mso.dll.#5407",
  1544. "mso.dll.#5152",
  1545. "mso.dll.#3327",
  1546. "mso.dll.#6333",
  1547. "mso.dll.#420",
  1548. "mso.dll.#1335",
  1549. "mso.dll.#2041",
  1550. "mso.dll.#7834",
  1551. "mso.dll.#239",
  1552. "mso.dll.#6357",
  1553. "mso.dll.#7026",
  1554. "mso.dll.#1671",
  1555. "oleaut32.dll.#7",
  1556. "mso.dll.#8263",
  1557. "mso.dll.#9307",
  1558. "mso.dll.#1441",
  1559. "mso.dll.#9223",
  1560. "mso.dll.#6453",
  1561. "mso.dll.#8044",
  1562. "mso.dll.#3698",
  1563. "mso.dll.#8565",
  1564. "mso.dll.#8373",
  1565. "mso.dll.#9741",
  1566. "mso.dll.#478",
  1567. "mso.dll.#479",
  1568. "mso.dll.#340",
  1569. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  1570. "bcrypt.dll.BCryptGetProperty",
  1571. "bcrypt.dll.BCryptCreateHash",
  1572. "bcrypt.dll.BCryptHashData",
  1573. "bcrypt.dll.BCryptFinishHash",
  1574. "bcrypt.dll.BCryptDestroyHash",
  1575. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  1576. "mso.dll.#8633",
  1577. "mso.dll.#5213",
  1578. "mso.dll.#6163",
  1579. "mso.dll.#552",
  1580. "mso.dll.#5630",
  1581. "mso.dll.#2513",
  1582. "mso.dll.#1607",
  1583. "mso.dll.#791",
  1584. "mso.dll.#1848",
  1585. "mso.dll.#8735",
  1586. "mso.dll.#9374",
  1587. "mso.dll.#5286",
  1588. "mso.dll.#6368",
  1589. "mso.dll.#4262",
  1590. "mso.dll.#1010",
  1591. "mso.dll.#7979",
  1592. "mso.dll.#8549",
  1593. "mso.dll.#8970",
  1594. "mso.dll.#9198",
  1595. "mso.dll.#4795",
  1596. "mso.dll.#1865",
  1597. "mso.dll.#9688",
  1598. "mso.dll.#320",
  1599. "advapi32.dll.RegDeleteKeyA",
  1600. "user32.dll.DestroyCursor",
  1601. "mso.dll.#7173",
  1602. "mso.dll.#8511",
  1603. "mso.dll.#3299",
  1604. "mso.dll.#7001",
  1605. "mso.dll.#3913",
  1606. "user32.dll.PeekMessageA",
  1607. "mso.dll.#1380",
  1608. "mso.dll.#9500",
  1609. "user32.dll.TranslateMessage",
  1610. "user32.dll.IsWindowUnicode",
  1611. "user32.dll.DispatchMessageA",
  1612. "user32.dll.DispatchMessageW",
  1613. "user32.dll.UpdateWindow",
  1614. "mso.dll.#999",
  1615. "mso.dll.#287",
  1616. "dwmapi.dll.DwmIsCompositionEnabled",
  1617. "mso.dll.#1575",
  1618. "mso.dll.#5034",
  1619. "mso.dll.#1517",
  1620. "mso.dll.#718",
  1621. "mso.dll.#4708",
  1622. "mso.dll.#8046",
  1623. "mso.dll.#4175",
  1624. "mso.dll.#8672",
  1625. "mso.dll.#1990",
  1626. "mso.dll.#3051",
  1627. "mso.dll.#1819",
  1628. "mso.dll.#1419",
  1629. "oleaut32.dll.#147",
  1630. "kernel32.dll.WerRegisterMemoryBlock",
  1631. "dwrite.dll.DWriteCreateFactory",
  1632. "gdi32.dll.GetCurrentObject",
  1633. "gdi32.dll.BitBlt",
  1634. "gdi32.dll.GetClipBox",
  1635. "user32.dll.IntersectRect",
  1636. "gdi32.dll.StretchDIBits",
  1637. "riched20.dll.REExtendedRegisterClass",
  1638. "user32.dll.GetWindowLongW",
  1639. "user32.dll.GetSysColor",
  1640. "user32.dll.SetWindowLongW",
  1641. "user32.dll.RegisterWindowMessageA",
  1642. "user32.dll.RegisterClipboardFormatW",
  1643. "user32.dll.GetDoubleClickTime",
  1644. "user32.dll.SetCaretBlinkTime",
  1645. "user32.dll.SystemParametersInfoW",
  1646. "user32.dll.GetKeyboardLayoutList",
  1647. "mso.dll._MsoGetFidUspDll@0",
  1648. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  1649. "usp10.dll.ScriptGetProperties",
  1650. "usp10.dll.ScriptItemize",
  1651. "user32.dll.LoadCursorW",
  1652. "user32.dll.IsWindowVisible",
  1653. "user32.dll.GetKeyboardLayout",
  1654. "user32.dll.PostMessageW",
  1655. "user32.dll.DefWindowProcW",
  1656. "uxtheme.dll.IsThemeActive",
  1657. "uxtheme.dll.IsAppThemed",
  1658. "uxtheme.dll.OpenThemeData",
  1659. "user32.dll.GetDC",
  1660. "user32.dll.ReleaseDC",
  1661. "user32.dll.IsIconic",
  1662. "user32.dll.GetParent",
  1663. "usp10.dll.ScriptGetCMap",
  1664. "user32.dll.InvalidateRect",
  1665. "user32.dll.HideCaret",
  1666. "user32.dll.ShowCaret",
  1667. "user32.dll.NotifyWinEvent",
  1668. "user32.dll.GetWindowTextLengthW",
  1669. "user32.dll.EnableWindow",
  1670. "msctf.dll.SetInputScope",
  1671. "user32.dll.GetWindowRgn",
  1672. "gdi32.dll.CreateCompatibleBitmap",
  1673. "gdi32.dll.SaveDC",
  1674. "gdi32.dll.SetPixel",
  1675. "gdi32.dll.GetPixel",
  1676. "gdi32.dll.RestoreDC",
  1677. "imm32.dll.ImmAssociateContext",
  1678. "mso.dll.#806",
  1679. "mso.dll.#4908",
  1680. "user32.dll.SetRect",
  1681. "mso.dll.#8439",
  1682. "mso.dll.#2736",
  1683. "gdi32.dll.GetTextAlign",
  1684. "gdi32.dll.ExtTextOutW",
  1685. "mso.dll.#8122",
  1686. "mso.dll.#2114",
  1687. "mso.dll.#6558",
  1688. "gdi32.dll.GetFontData",
  1689. "usp10.dll.ScriptItemizeOpenType",
  1690. "usp10.dll.ScriptShapeOpenType",
  1691. "usp10.dll.ScriptPlaceOpenType",
  1692. "mso.dll.#8395",
  1693. "mso.dll.#379",
  1694. "mso.dll.#6338",
  1695. "mso.dll.#7964",
  1696. "mso.dll.#1437",
  1697. "mso.dll.#1427",
  1698. "mso.dll.#6137",
  1699. "winmm.dll.timeGetTime",
  1700. "mso.dll.#5940",
  1701. "usp10.dll.ScriptPlace",
  1702. "usp10.dll.ScriptShape",
  1703. "usp10.dll.ScriptJustify",
  1704. "usp10.dll.ScriptTextOut",
  1705. "usp10.dll.ScriptCPtoX",
  1706. "usp10.dll.ScriptXtoCP",
  1707. "usp10.dll.ScriptFreeCache",
  1708. "usp10.dll.ScriptCacheGetHeight",
  1709. "usp10.dll.ScriptLayout",
  1710. "usp10.dll.ScriptBreak",
  1711. "usp10.dll.ScriptIsComplex",
  1712. "usp10.dll.ScriptGetLogicalWidths",
  1713. "usp10.dll.ScriptApplyLogicalWidth",
  1714. "usp10.dll.ScriptGetGlyphABCWidth",
  1715. "usp10.dll.ScriptGetFontProperties",
  1716. "usp10.dll.ScriptApplyDigitSubstitution",
  1717. "usp10.dll.ScriptRecordDigitSubstitution",
  1718. "usp10.dll.ScriptGetFontAlternateGlyphs",
  1719. "mso.dll.#7578",
  1720. "mso.dll.#8483",
  1721. "mso.dll.#2613",
  1722. "gdi32.dll.GdiIsMetaPrintDC",
  1723. "mso.dll.#7848",
  1724. "user32.dll.GetWindowDC",
  1725. "gdi32.dll.SetLayout",
  1726. "gdi32.dll.RectVisible",
  1727. "gdi32.dll.GetClipRgn",
  1728. "gdi32.dll.ExcludeClipRect",
  1729. "gdi32.dll.SelectClipRgn",
  1730. "mso.dll.#445",
  1731. "user32.dll.BeginPaint",
  1732. "gdi32.dll.SetWindowOrgEx",
  1733. "user32.dll.EndPaint",
  1734. "user32.dll.IsWindowRedirectedForPrint",
  1735. "gdi32.dll.CreateRectRgnIndirect",
  1736. "user32.dll.GetUpdateRgn",
  1737. "gdi32.dll.GetRgnBox",
  1738. "user32.dll.ValidateRect",
  1739. "user32.dll.GetUpdateRect",
  1740. "user32.dll.GetCaretBlinkTime",
  1741. "user32.dll.CreateCaret",
  1742. "mso.dll.#3624",
  1743. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  1744. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  1745. "mso.dll.#6247",
  1746. "gdi32.dll.TranslateCharsetInfo",
  1747. "mso.dll.#3300",
  1748. "mso.dll.#7465",
  1749. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  1750. "user32.dll.DestroyCaret",
  1751. "user32.dll.GetCaretPos",
  1752. "user32.dll.SetCaretPos",
  1753. "user32.dll.GetFocus",
  1754. "user32.dll.GetClassNameA",
  1755. "mso.dll.#8662",
  1756. "mso.dll.#732",
  1757. "mso.dll.#5804",
  1758. "ole32.dll.CoCreateInstance",
  1759. "mso.dll.#434",
  1760. "user32.dll.GetMessageExtraInfo",
  1761. "user32.dll.TrackMouseEvent",
  1762. "mso.dll.#4746",
  1763. "mso.dll.#9465",
  1764. "msptls.dll.?LsPointUV2FromPointUV1@Ptls6@@YGJKPBUtagLSPOINTUV@1@0KPAU21@@Z",
  1765. "msptls.dll.?LsQueryLinePointPcp@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINTUV@1@JPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  1766. "user32.dll.IsWindow",
  1767. "user32.dll.GetInputState",
  1768. "mso.dll.#8461",
  1769. "user32.dll.GetClipboardOwner",
  1770. "user32.dll.GetActiveWindow",
  1771. "user32.dll.GetAncestor",
  1772. "user32.dll.SendNotifyMessageW",
  1773. "mso.dll.#3544",
  1774. "mso.dll.#900",
  1775. "mso.dll.#1422",
  1776. "user32.dll.MsgWaitForMultipleObjectsEx",
  1777. "mso.dll.#1885",
  1778. "mso.dll.#832",
  1779. "advapi32.dll.NotifyServiceStatusChangeW",
  1780. "user32.dll.GetClassNameW",
  1781. "mso.dll.#8202",
  1782. "mso.dll.#5360",
  1783. "mso.dll.#8574",
  1784. "msi.dll.#39",
  1785. "mso.dll.#8318",
  1786. "mso.dll.#1283",
  1787. "mso.dll.#8705",
  1788. "mso.dll.#9685",
  1789. "mso.dll.#3579",
  1790. "mso.dll.#8747",
  1791. "mso.dll.#2880",
  1792. "mso.dll.#7615",
  1793. "mso.dll.#4219",
  1794. "mso.dll.#3244",
  1795. "mso.dll.#408",
  1796. "mso.dll.#2714",
  1797. "mso.dll.#8622",
  1798. "mso.dll.#3380",
  1799. "mso.dll.#2566",
  1800. "mso.dll.#1429",
  1801. "mso.dll.#6502",
  1802. "mso.dll.#2968",
  1803. "mso.dll.#709",
  1804. "mso.dll.#5913",
  1805. "mso.dll.#8051",
  1806. "mso.dll.#6505",
  1807. "advapi32.dll.RegDeleteTreeW",
  1808. "xmllite.dll.CreateXmlReader",
  1809. "mso.dll.#3901",
  1810. "advapi32.dll.CryptAcquireContextA",
  1811. "advapi32.dll.CryptGenKey",
  1812. "cryptsp.dll.CryptGenKey",
  1813. "advapi32.dll.CryptImportKey",
  1814. "cryptsp.dll.CryptImportKey",
  1815. "advapi32.dll.CryptExportKey",
  1816. "cryptsp.dll.CryptExportKey",
  1817. "advapi32.dll.CryptDestroyKey",
  1818. "advapi32.dll.CryptCreateHash",
  1819. "advapi32.dll.CryptSetHashParam",
  1820. "advapi32.dll.CryptHashData",
  1821. "advapi32.dll.CryptGetHashParam",
  1822. "cryptsp.dll.CryptGetHashParam",
  1823. "advapi32.dll.CryptDestroyHash",
  1824. "msi.dll.#90",
  1825. "user32.dll.WindowFromPoint",
  1826. "user32.dll.IsClipboardFormatAvailable",
  1827. "user32.dll.GetCursorInfo",
  1828. "user32.dll.GetCapture",
  1829. "user32.dll.GetMessagePos",
  1830. "user32.dll.ScreenToClient",
  1831. "user32.dll.SetFocus",
  1832. "user32.dll.GetDesktopWindow",
  1833. "user32.dll.FindWindowExW",
  1834. "uiautomationcore.dll.UiaClientsAreListening",
  1835. "mso.dll.#8837",
  1836. "advapi32.dll.ConvertSidToStringSidW",
  1837. "msi.dll.DllGetVersion",
  1838. "msi.dll.#111",
  1839. "mso.dll.#7009",
  1840. "mso.dll.#6429",
  1841. "mso.dll.#5667",
  1842. "mso.dll.#86",
  1843. "mso.dll.#2052",
  1844. "mso.dll.#7778",
  1845. "mso.dll.#5127",
  1846. "mso.dll.#7590",
  1847. "mso.dll.#2687",
  1848. "user32.dll.GetQueueStatus",
  1849. "mso.dll.#8060",
  1850. "mso.dll.#5925",
  1851. "mso.dll.#3638",
  1852. "mso.dll.#3258",
  1853. "mso.dll.#7974",
  1854. "mso.dll.#2609",
  1855. "mso.dll.#3500",
  1856. "mso.dll.#3347",
  1857. "mso.dll.#1905",
  1858. "mso.dll.#2812",
  1859. "mso.dll.#4416",
  1860. "mso.dll.#4008",
  1861. "mso.dll.#7366",
  1862. "mso.dll.#7546",
  1863. "mso.dll.#1406",
  1864. "mso.dll.#4926",
  1865. "user32.dll.GetScrollPos",
  1866. "mso.dll.#629",
  1867. "mso.dll.#676",
  1868. "mso.dll.#8644",
  1869. "mso.dll.#3141",
  1870. "mso.dll.#8472",
  1871. "mso.dll.#2281",
  1872. "mso.dll.#2628",
  1873. "mso.dll.#3425",
  1874. "mso.dll.#5291",
  1875. "mso.dll.#1718",
  1876. "mso.dll.#4777",
  1877. "mso.dll.#1455",
  1878. "user32.dll.LoadImageW",
  1879. "user32.dll.CreateWindowExW",
  1880. "comctl32.dll.HIMAGELIST_QueryInterface",
  1881. "comctl32.dll.DrawShadowText",
  1882. "comctl32.dll.DrawSizeBox",
  1883. "comctl32.dll.DrawScrollBar",
  1884. "comctl32.dll.SizeBoxHwnd",
  1885. "comctl32.dll.ScrollBar_MouseMove",
  1886. "comctl32.dll.ScrollBar_Menu",
  1887. "comctl32.dll.HandleScrollCmd",
  1888. "comctl32.dll.DetachScrollBars",
  1889. "comctl32.dll.AttachScrollBars",
  1890. "comctl32.dll.CCSetScrollInfo",
  1891. "comctl32.dll.CCGetScrollInfo",
  1892. "comctl32.dll.CCEnableScrollBar",
  1893. "comctl32.dll.QuerySystemGestureStatus",
  1894. "uxtheme.dll.#49",
  1895. "uxtheme.dll.CloseThemeData",
  1896. "user32.dll.EnableScrollBar",
  1897. "user32.dll.ShowScrollBar",
  1898. "user32.dll.ShowWindow",
  1899. "user32.dll.SetParent",
  1900. "user32.dll.KillTimer",
  1901. "user32.dll.ClientToScreen",
  1902. "user32.dll.MoveWindow",
  1903. "user32.dll.DestroyWindow",
  1904. "gdi32.dll.GetViewportExtEx",
  1905. "gdi32.dll.GetWindowExtEx",
  1906. "gdi32.dll.GetTextCharset",
  1907. "gdi32.dll.GetMapMode",
  1908. "gdi32.dll.GetLayout",
  1909. "oleaut32.dll.SysAllocString",
  1910. "oleaut32.dll.SysStringLen",
  1911. "oleaut32.dll.SysAllocStringLen",
  1912. "oleaut32.dll.SysFreeString",
  1913. "uxtheme.dll.GetThemePartSize",
  1914. "user32.dll.GetMessageW",
  1915. "gdi32.dll.IntersectClipRect",
  1916. "gdi32.dll.SetTextColor",
  1917. "gdi32.dll.SetBkMode",
  1918. "gdi32.dll.SetTextAlign",
  1919. "gdi32.dll.ExtSelectClipRgn",
  1920. "gdi32.dll.GetTextColor",
  1921. "uxtheme.dll.DrawThemeBackground",
  1922. "user32.dll.WaitMessage",
  1923. "kernel32.dll.FlsAlloc",
  1924. "kernel32.dll.FlsGetValue",
  1925. "kernel32.dll.FlsSetValue",
  1926. "kernel32.dll.FlsFree",
  1927. "ieawsdc.dll.HrExtractTemplateToPath",
  1928. "wininet.dll.InternetGetConnectedState",
  1929. "rasapi32.dll.RasConnectionNotificationW",
  1930. "sechost.dll.NotifyServiceStatusChangeA",
  1931. "cryptsp.dll.CryptAcquireContextW",
  1932. "osppcext.dll.SLActivateProduct",
  1933. "osppcext.dll.SLGetTokenActivationGrants",
  1934. "osppcext.dll.SLGetTokenActivationCertificates",
  1935. "osppcext.dll.SLGenerateTokenActivationChallenge",
  1936. "osppcext.dll.SLSignTokenActivationChallenge",
  1937. "osppcext.dll.SLDepositTokenActivationResponse",
  1938. "osppcext.dll.SLFreeTokenActivationGrants",
  1939. "osppcext.dll.SLFreeTokenActivationCertificates",
  1940. "gdi32.dll.GdiFlush",
  1941. "advapi32.dll.RegDeleteValueW",
  1942. "mso.dll.#1541",
  1943. "mso.dll.#3702",
  1944. "mso.dll.#3484",
  1945. "mso.dll.#1966",
  1946. "mso.dll.#1266",
  1947. "gdi32.dll.GetStockObject",
  1948. "mso.dll.#6501",
  1949. "riched20.dll.REMSOHInst",
  1950. "mso.dll.#511",
  1951. "mso.dll.#8118",
  1952. "gdi32.dll.GetGlyphIndicesW",
  1953. "mso.dll.#844",
  1954. "mso.dll.#6960",
  1955. "mso.dll.#7892",
  1956. "mso.dll.#7931",
  1957. "mso.dll.#3837",
  1958. "mso.dll.#8398",
  1959. "mso.dll.#2477",
  1960. "msproof7.dll.DllGetClassObject",
  1961. "msproof7.dll.DllCanUnloadNow",
  1962. "mso.dll.#4172",
  1963. "mso.dll.#1439",
  1964. "mso.dll.#9566",
  1965. "mso.dll.#111",
  1966. "mso.dll.#4191",
  1967. "mso.dll.#3802",
  1968. "mso.dll.#6982",
  1969. "mso.dll.#8800",
  1970. "mso.dll.#3572",
  1971. "mso.dll.#167",
  1972. "mso.dll.#5737",
  1973. "mso.dll.#590",
  1974. "mso.dll.#3758",
  1975. "msgr3en.dll.CheckVersion",
  1976. "msgr3en.dll.#29",
  1977. "msgr3en.dll.#30",
  1978. "msgr3en.dll.#31",
  1979. "msgr3en.dll.#32",
  1980. "msgr3en.dll.#33",
  1981. "msgr3en.dll.#34",
  1982. "msgr3en.dll.#35",
  1983. "msgr3en.dll.#45",
  1984. "msgr3en.dll.#46",
  1985. "msgr3en.dll.#47",
  1986. "msgr3en.dll.#48",
  1987. "msgr3en.dll.#51",
  1988. "msgr3en.dll.#50",
  1989. "msgr3en.dll.#49",
  1990. "msgr3en.dll.#43",
  1991. "msgr3en.dll.#41",
  1992. "msgr3en.dll.#42",
  1993. "msgr3en.dll.#44",
  1994. "msgr3en.dll.#39",
  1995. "msgr3en.dll.#40",
  1996. "msgr3en.dll.#36",
  1997. "msgr3en.dll.#38",
  1998. "msgr3en.dll.#37",
  1999. "msgr3en.dll.#56",
  2000. "msgr3en.dll.#52",
  2001. "msgr3en.dll.#53",
  2002. "msgr3en.dll.#57",
  2003. "msgr3en.dll.#58",
  2004. "msgr3en.dll.#59",
  2005. "user32.dll.LoadStringA",
  2006. "mso.dll.#2561",
  2007. "mso.dll.#6420",
  2008. "advapi32.dll.CryptReleaseContext",
  2009. "cryptsp.dll.CryptReleaseContext",
  2010. "crypt32.dll.CryptQueryObject",
  2011. "wintrust.dll.CryptSIPPutSignedDataMsg",
  2012. "wintrust.dll.CryptSIPGetSignedDataMsg",
  2013. "cryptsp.dll.CryptGetDefaultProviderW",
  2014. "crypt32.dll.CertEnumCertificatesInStore",
  2015. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  2016. "wintrust.dll.WinVerifyTrust",
  2017. "wintrust.dll.WintrustCertificateTrust",
  2018. "wintrust.dll.SoftpubAuthenticode",
  2019. "wintrust.dll.SoftpubInitialize",
  2020. "wintrust.dll.SoftpubLoadMessage",
  2021. "wintrust.dll.SoftpubLoadSignature",
  2022. "wintrust.dll.SoftpubCheckCert",
  2023. "wintrust.dll.SoftpubCleanup",
  2024. "wintrust.dll.CryptSIPVerifyIndirectData",
  2025. "user32.dll.SetCursor",
  2026. "mso.dll.#424",
  2027. "mso.dll.#5071",
  2028. "mso.dll.#6889",
  2029. "mso.dll.#3633",
  2030. "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  2031. "gdi32.dll.GetTextExtentPointA",
  2032. "user32.dll.MessageBeep",
  2033. "advapi32.dll.RegisterEventSourceW",
  2034. "advapi32.dll.ReportEventW",
  2035. "advapi32.dll.DeregisterEventSource",
  2036. "user32.dll.DialogBoxIndirectParamW",
  2037. "comctl32.dll.RegisterClassNameW",
  2038. "uxtheme.dll.EnableThemeDialogTexture",
  2039. "uxtheme.dll.GetThemeBool",
  2040. "user32.dll.GetDlgItem",
  2041. "mso.dll.#6900",
  2042. "user32.dll.CallNextHookEx",
  2043. "uxtheme.dll.BufferedPaintInit",
  2044. "uxtheme.dll.BufferedPaintRenderAnimation",
  2045. "uxtheme.dll.GetThemeTransitionDuration",
  2046. "uxtheme.dll.BeginBufferedAnimation",
  2047. "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
  2048. "uxtheme.dll.DrawThemeParentBackground",
  2049. "uxtheme.dll.GetThemeBackgroundContentRect",
  2050. "uxtheme.dll.DrawThemeText",
  2051. "uxtheme.dll.EndBufferedAnimation",
  2052. "user32.dll.GetDlgCtrlID",
  2053. "advapi32.dll.SaferiSearchMatchingHashRules",
  2054. "wintrust.dll.WTHelperProvDataFromStateData",
  2055. "wintrust.dll.WTHelperGetProvSignerFromChain",
  2056. "crypt32.dll.CertCloseStore",
  2057. "cabinet.dll.#23",
  2058. "user32.dll.IsDlgButtonChecked",
  2059. "user32.dll.EndDialog",
  2060. "uxtheme.dll.BufferedPaintStopAllAnimations",
  2061. "uxtheme.dll.BufferedPaintUnInit",
  2062. "user32.dll.UnhookWindowsHookEx",
  2063. "user32.dll.SetActiveWindow",
  2064. "mso.dll.#4702",
  2065. "mso.dll.#1414",
  2066. "user32.dll.EnumThreadWindows",
  2067. "user32.dll.EnumWindows",
  2068. "user32.dll.InSendMessage",
  2069. "user32.dll.SetForegroundWindow",
  2070. "mso.dll.#7651",
  2071. "mso.dll.#2802",
  2072. "mso.dll.#4111",
  2073. "mso.dll.#2386",
  2074. "mso.dll.#816",
  2075. "mso.dll.#2620",
  2076. "shell32.dll.SHGetKnownFolderPath",
  2077. "mso.dll.#9748",
  2078. "mso.dll.#3496",
  2079. "mso.dll.#2901",
  2080. "mso.dll.#7830",
  2081. "mso.dll.#5396",
  2082. "mso.dll.#6895",
  2083. "mso.dll.#8986",
  2084. "mso.dll.#7945",
  2085. "mso.dll.#988",
  2086. "mso.dll.#5177",
  2087. "mso.dll.#3334",
  2088. "mso.dll.#7320",
  2089. "mso.dll.#9639",
  2090. "mso.dll.#9436",
  2091. "mso.dll.#5541",
  2092. "advapi32.dll.GetFileSecurityW",
  2093. "advapi32.dll.SetFileSecurityW",
  2094. "advapi32.dll.GetSecurityInfo",
  2095. "advapi32.dll.SetSecurityInfo",
  2096. "advapi32.dll.GetSecurityDescriptorControl",
  2097. "mso.dll.#2955",
  2098. "mso.dll.#1914",
  2099. "mso.dll.#1401",
  2100. "mso.dll.#5919",
  2101. "mso.dll.#4597",
  2102. "mso.dll.#7189",
  2103. "mso.dll.#2738",
  2104. "mso.dll.#8691",
  2105. "mso.dll.#6079",
  2106. "mso.dll.#7167",
  2107. "mso.dll.#7163",
  2108. "mso.dll.#333",
  2109. "mso.dll.#1785",
  2110. "mso.dll.#8693",
  2111. "user32.dll.RemovePropW",
  2112. "mso.dll.#5973",
  2113. "mso.dll.#2014",
  2114. "mso.dll.#9668",
  2115. "mso.dll.#2294",
  2116. "advapi32.dll.RegDeleteKeyW",
  2117. "mso.dll.#235",
  2118. "mso.dll.#9398",
  2119. "mso.dll.#1442",
  2120. "mso.dll.#4388",
  2121. "mso.dll.#8022",
  2122. "mso.dll.#3144",
  2123. "mso.dll.#1213",
  2124. "mso.dll.#4220",
  2125. "mso.dll.#3214",
  2126. "mso.dll.#6521",
  2127. "mso.dll.#6489",
  2128. "mso.dll.#613",
  2129. "mso.dll.#6344",
  2130. "mso.dll.#9099",
  2131. "mso.dll.#8320",
  2132. "mso.dll.#7770",
  2133. "mso.dll.#6216",
  2134. "user32.dll.GetLastInputInfo",
  2135. "ws2_32.dll.#116",
  2136. "ws2_32.dll.WSAGetOverlappedResult",
  2137. "gdi32.dll.D3DKMTOpenAdapterFromGdiDisplayName",
  2138. "gdi32.dll.D3DKMTCloseAdapter",
  2139. "gdi32.dll.D3DKMTQueryAdapterInfo",
  2140. "gdi32.dll.D3DKMTOpenAdapterFromDeviceName",
  2141. "setupapi.dll.SetupDiGetClassDevsW",
  2142. "setupapi.dll.SetupDiEnumDeviceInterfaces",
  2143. "setupapi.dll.SetupDiGetDeviceInterfaceDetailW",
  2144. "setupapi.dll.SetupDiDestroyDeviceInfoList",
  2145. "setupapi.dll.SetupDiGetDevicePropertyW",
  2146. "d3d10warp.dll.D3DKMTOpenAdapterFromGdiDisplayName",
  2147. "d3d10warp.dll.D3DKMTOpenAdapterFromDeviceName",
  2148. "d3d10warp.dll.D3DKMTGetDisplayModeList",
  2149. "d3d10warp.dll.D3DKMTSetVidPnSourceOwner",
  2150. "d3d10warp.dll.D3DKMTSetDisplayMode",
  2151. "d3d10warp.dll.D3DKMTCloseAdapter",
  2152. "d3d10warp.dll.D3DKMTSetGammaRamp",
  2153. "d3d10warp.dll.D3DKMTGetDeviceState",
  2154. "d3d10warp.dll.D3DKMTQueryAdapterInfo",
  2155. "d3d10warp.dll.D3DKMTWaitForVerticalBlankEvent",
  2156. "gdi32.dll.D3DKMTCreateDCFromMemory",
  2157. "gdi32.dll.D3DKMTDestroyDCFromMemory",
  2158. "gdi32.dll.D3DKMTCheckVidPnExclusiveOwnership",
  2159. "gdi32.dll.D3DKMTCheckMonitorPowerState",
  2160. "gdi32.dll.D3DKMTCheckSharedResourceAccess",
  2161. "d3d10warp.dll.D3DKMTGetMultisampleMethodList",
  2162. "d3d10warp.dll.D3DKMTSetDisplayPrivateDriverFormat",
  2163. "d3d10warp.dll.D3DKMTDestroySynchronizationObject",
  2164. "d3d10warp.dll.D3DKMTCreateSynchronizationObject",
  2165. "d3d10warp.dll.D3DKMTDestroyContext",
  2166. "d3d10warp.dll.D3DKMTCreateContext",
  2167. "d3d10warp.dll.D3DKMTGetContextSchedulingPriority",
  2168. "d3d10warp.dll.D3DKMTSetContextSchedulingPriority",
  2169. "d3d10warp.dll.D3DKMTPresent",
  2170. "d3d10warp.dll.D3DKMTDestroyDevice",
  2171. "d3d10warp.dll.D3DKMTCreateDevice",
  2172. "d3d10warp.dll.D3DKMTQueryAllocationResidency",
  2173. "d3d10warp.dll.D3DKMTSetAllocationPriority",
  2174. "d3d10warp.dll.D3DKMTDestroyAllocation",
  2175. "d3d10warp.dll.D3DKMTOpenResource",
  2176. "d3d10warp.dll.D3DKMTQueryResourceInfo",
  2177. "d3d10warp.dll.D3DKMTCreateAllocation",
  2178. "d3d10warp.dll.D3DKMTSignalSynchronizationObject",
  2179. "d3d10warp.dll.D3DKMTWaitForSynchronizationObject",
  2180. "d3d10warp.dll.D3DKMTEscape",
  2181. "d3d10warp.dll.D3DKMTUnlock",
  2182. "d3d10warp.dll.D3DKMTLock",
  2183. "d3d10warp.dll.D3DKMTRender",
  2184. "d3d10warp.dll.OpenAdapter10_2"
  2185. ]
  2186.  
  2187. [*] Static Analysis: {}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!