API tools faq
paste
paladin316

Purchase_doc.json

paladin316
Jun 19th, 2019
2,186
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 211.38 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Purchase.doc"
  7. [*] File Size: 11647
  8. [*] File Type: "Rich Text Format data, version 1, unknown character set"
  9. [*] SHA256: "74a1e104945c54eacc5c7ed1ac79917dabaab6f9fe3048d98c847d34b64deca8"
  10. [*] MD5: "62d783e99d3a2fdf140314c20af0b653"
  11. [*] SHA1: "16c63f914e5d30b7986a05145b4d1139679455ef"
  12. [*] SHA512: "57a055757a0a5b527b68b84dc8e2e3c10aca969bea483a82a31c5ad16113cb1755491ab3fa5af64e14fe8422145dcf4d1037de34111d0fcb5655e9219659c962"
  13. [*] CRC32: "626DCFB2"
  14. [*] SSDEEP: "192:JFPnC/IHybL/iufs9r9x+GlSX/pUzlPJ4gMWB1:LneIHybWuiBi6z5WgMWB1"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE"
  18. ]
  19.  
  20. [*] Signatures Detected: [
  21. {
  22. "Description": "A process attempted to delay the analysis task.",
  23. "Details": [
  24. {
  25. "Process": "WINWORD.EXE tried to sleep 266 seconds, actually delayed analysis time by 0 seconds"
  26. }
  27. ]
  28. },
  29. {
  30. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  31. "Details": [
  32. {
  33. "IP": "52.109.20.1:443"
  34. },
  35. {
  36. "IP": "52.109.20.4:443"
  37. },
  38. {
  39. "IP": "104.85.240.25:443"
  40. },
  41. {
  42. "IP": "104.18.24.243:80"
  43. },
  44. {
  45. "IP": "66.210.41.17:80"
  46. },
  47. {
  48. "IP": "66.210.41.16:80"
  49. },
  50. {
  51. "IP": "72.21.91.29:80"
  52. },
  53. {
  54. "IP": "23.64.189.123:443"
  55. }
  56. ]
  57. },
  58. {
  59. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  60. "Details": [
  61. {
  62. "ioc": "gosttitle.xsl"
  63. },
  64. {
  65. "ioc": "ontent.inf"
  66. },
  67. {
  68. "ioc": "ieee2006officeonline.xsl"
  69. },
  70. {
  71. "ioc": "e.gu"
  72. },
  73. {
  74. "ioc": "iso690.xsl"
  75. },
  76. {
  77. "ioc": "chicago.xsl"
  78. },
  79. {
  80. "ioc": "ist.glox"
  81. },
  82. {
  83. "ioc": "architecture.glox"
  84. },
  85. {
  86. "ioc": "nline.xsl"
  87. },
  88. {
  89. "ioc": "iso690nmerical.xsl"
  90. },
  91. {
  92. "ioc": "rc.glox"
  93. },
  94. {
  95. "ioc": "gostname.xsl"
  96. },
  97. {
  98. "ioc": "rid.glox"
  99. },
  100. {
  101. "ioc": "..3b"
  102. },
  103. {
  104. "ioc": "gb.xsl"
  105. },
  106. {
  107. "ioc": "sist02.xsl"
  108. },
  109. {
  110. "ioc": "rings.glox"
  111. },
  112. {
  113. "ioc": "pictureorgchart.glox"
  114. },
  115. {
  116. "ioc": "rame.glox"
  117. },
  118. {
  119. "ioc": "mlaseventheditionofficeonline.xsl"
  120. },
  121. {
  122. "ioc": "ccent.glox"
  123. },
  124. {
  125. "ioc": "anded.thmx"
  126. },
  127. {
  128. "ioc": "content.inf"
  129. },
  130. {
  131. "ioc": "adial.glox"
  132. },
  133. {
  134. "ioc": "ext.glox"
  135. },
  136. {
  137. "ioc": "turabian.xsl"
  138. },
  139. {
  140. "ioc": "rocess.glox"
  141. },
  142. {
  143. "ioc": "arallax.thmx"
  144. },
  145. {
  146. "ioc": "harvardanglia2008officeonline.xsl"
  147. },
  148. {
  149. "ioc": "quations.dotx"
  150. },
  151. {
  152. "ioc": "rame.thmx"
  153. },
  154. {
  155. "ioc": "iew.thmx"
  156. },
  157. {
  158. "ioc": "etropolitan.thmx"
  159. },
  160. {
  161. "ioc": "set.dotx"
  162. },
  163. {
  164. "ioc": "uotable.thmx"
  165. },
  166. {
  167. "ioc": "chevronaccent.glox"
  168. },
  169. {
  170. "ioc": "adge.thmx"
  171. },
  172. {
  173. "ioc": "eadlines.thmx"
  174. },
  175. {
  176. "ioc": "ype.thmx"
  177. },
  178. {
  179. "ioc": "avon.thmx"
  180. },
  181. {
  182. "ioc": "ividend.thmx"
  183. },
  184. {
  185. "ioc": "asis.thmx"
  186. },
  187. {
  188. "ioc": "rop.thmx"
  189. },
  190. {
  191. "ioc": "ircuit.thmx"
  192. },
  193. {
  194. "ioc": "g.n9"
  195. },
  196. {
  197. "ioc": "erlin.thmx"
  198. },
  199. {
  200. "ioc": "vent.thmx"
  201. },
  202. {
  203. "ioc": "esh.thmx"
  204. },
  205. {
  206. "ioc": "amask.thmx"
  207. },
  208. {
  209. "ioc": "roplet.thmx"
  210. },
  211. {
  212. "ioc": "eathered.thmx"
  213. },
  214. {
  215. "ioc": "rail.thmx"
  216. },
  217. {
  218. "ioc": "late.thmx"
  219. }
  220. ]
  221. },
  222. {
  223. "Description": "Performs some HTTP requests",
  224. "Details": [
  225. {
  226. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  227. },
  228. {
  229. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  230. },
  231. {
  232. "url": "http://sripipat.com/precious/PurchaseOrder.exe"
  233. },
  234. {
  235. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  236. },
  237. {
  238. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  239. },
  240. {
  241. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D"
  242. },
  243. {
  244. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D"
  245. }
  246. ]
  247. },
  248. {
  249. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  250. "Details": [
  251. {
  252. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x01\\xafi\\x8d\\x80b\\x8d\\xb0%\\xb7\\x1b0\\xdf\\xe7\\xfc\\xab'?\\xe0\\xf3<d\\x93\\x8e`\\x85\\xff_1\\xe3\\xff\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  253. },
  254. {
  255. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe9\":3i4\\xf9\\x95uz_\\x8a\\xbb\\xf6\\xb3#\\x86\\xec(c\\xc4h\\x86,2d\\x89*\\xadf\\xdc=\\xdb\\xa1\\x90\\xf2\\x9f7\\xe23{6\\xd0&\\xf9w\\x88\\x18\\xaa\\xd4\\x8f\\x9a5\\xd9\t|\\x01\\xd67\\xc8d3\\xa4}\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83,\\x95*\\x0f\\x07cs\\xabk\\xcf-)\\xf6\\x86\\x7f%\\xa7\\x87\\x99+\\xd2\\x87\\xa8\\xc7c\\x87\\x17\\x89\\xdb\\x02p6}\\xbb'\\xda\\xf0\\xf3\\x9e$\\xa6\\xcc\\x90\\xd5\\x96$w"
  256. },
  257. {
  258. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  259. },
  260. {
  261. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  262. },
  263. {
  264. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p{\\xb2\\x0f\\xae\\x04\\xf7\\xaae\\x06n\\xdb\\xd9a\\x8bi.{5\\x81\\x7f\\xdf\\x13\\xfc@\\x07xt\\xae\\x95\\xef\\x11\\x90\\xb0\\xd6v\\xf0\\xd4z\\xb04\\xb0\\%prf\\xac|o\\xaba\\xe8\\xbf\\x86\\xbd\"n\\xfchxy\\xaa\\x19\\x8a\\x19\\xb0\\x04\\x0c\\xd2ah\\xb7\\xe5`\\x9b\\xc9c#\\xfe\\x11\\x84\\xdcbf8\\x18\\xc0\\x8a\\xb5\t\\xe4d\\xc9\\x00\\xc1\\xa6}\\xef/\\xf7\\x19\\xd4\\x03\\x9f7\\xae\\xfd\\x00d\\xd7\\xd6\\\\xf7\\xdb\\xebr\\xbd\\xb4\\x17\\xa6g\\xd8\\x15\\x90\\xff\\x9b\\xaf\\x9d\\xfb\\xd4\\xe7\\xbb\\x8a\\xc6\\xd2d\\x06\\xec#\\xc9\\x8c\\x89\\x94\\xa6\\x9e\\xd3\n\\xb9\\xf7\\xe4\\xb9\\xa1\\x82x\\x11c\\x13y\\xed\\xcd\\xdc\\xb9\\x81\\x97f\\xac\\x10*\\xf87\\xd0g\\xd3{_m\\xa1\\x84\\x9b\\xc0\\x04t\\xbd\\x855\\x93\\x8cm-\\xfe\\xf5\\xf2\\xfd\\xab\\x08\\xd5\\xdd\\xb1\n\\x9dz\\xd9z\\x05\\xd6ci\\xc8\\x04\\x8d\\x91\\xe0-\\x88{\\xe3w\\xee\\xe3\\x0cvlx\\x9c\\xe0\\x11\\x8f`\\xddm\\xd1$\\x0f\\xce\\x96\\x166y~\\xcc\\x14\\x92\\x8e\\xdf;\\xc1\\x95\\xb5mbv"
  265. },
  266. {
  267. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 u\\xd1\\xf3u\\xdd\\x0b\\x827r%\\\\xfb\\x88\\x07mg\\x81#\\xea0\\xda\\x0e8\\x83\\\\x9b5\\xe5rjr\\x17\\xfd/\\xc2\\x0b\\x13ot\\xf2\\x10\\x0c\\xb2p\\x0b\\x85\\x88\\xf19dw\\x8e\\xd2\\xeb\\x19\nl<\\xa22?\\xc1\\x8c\\x98\\x9e\\xf3\\xa9\\x01bk\\x8d\\xa9`-t\\x19\\xf1\\xf6\\x12\\x02\\x18?\\xa5\\x8e\\x90\\xb1<x\\xe6e\\x0f`?\\xc1$4\\x02\\xd7\\xc4\\xee\\x90\\xf4?w26\\xc7\\x0b\\xd3\\x95#(a\\x92go|\\x9d\\xca\\xc2p\\xbf\\x8cee\\xc99'\\x7f\\f\\x94\\x07\t\\x8d`\\xfb\\x86\\x87a6w\\xbd)\\x9b\\x13l\\xd5\\x1ep\\x8f\\xe2\\xef\\xf4bn3t\\x07\\xfd\\xb4k\\xa6\\x84l\\x1dj\\xbem\\x9a\\x06\\xb3\\x7f\\xc4r\\x90p#\\xf3(x,\\x19\\xd4d*\\x7f\\xec,&z\\x8c\\xc69l\\xe0;\\x00n\\xe2\\xb2z'\\xfb\\xe2`\\xe5\\x9d\\x8a\\xd08\\xd7d\\x82\n\\x9dsl}\\xc8is\\xaa$\\x9b\\xe8\\xc2h\\xe1\\x03\\x06\\xb0wzh\\xfd\\x0e\\x160\\xda\\xbf\\xa3u\\xb2ye;\\xb65g\\xab"
  268. },
  269. {
  270. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x01\\xafjg\\xa5\"\\xd3%\\x13u\\xc6x\\xb8\\x83\\xbe\\xc8,\\xac\\x9c\\x92\\xe2\\xcd2\\xd6s\\xa2\\xdaw\\xbb:~\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  271. },
  272. {
  273. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0fu\\xc1\\xe8\\x87]\\xafk\\x19\\xc4\\xd8\\xa2\\xebe\\xf2\\xc6\\xef\\xb6ba\\xf5\\xe6\\xa5\\xdc@/\\xd72\\xa2\\xb0\\xd62s\\x8c\\xfa\\x1c\\xcc\\xf5\\xfe\\x82f\\xe5\\x92l\\xfa\\x14\\x05\\xe9h}iw\\xb9gkui\n\\xa5`\\x01]\\xf8}\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x80a\\xacy\\\\x0e\\xc8\\x1f\\xb6\\xb0:\\xb1\\x97o\\xa4\\xf6r/i\\x18-\\x8e\\xdd\\xa7r\\xcd\\x97\\x16g\\xf4\\x1eud\\xf7+\\xe4o\\xe6\\xd2\\x1f\\xddzm\\x8f\\x06\\xa6\\xa8\\xcc"
  274. },
  275. {
  276. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01po>\\x97\t\\x00\\xb8\\xfa\\x08\\xdc-~\\xbc\\xef$\\xabu\\x14\\xea\\xd4/\\x1ay\\x84\\xff\\x12d?\\x00y\"\\xc3\\x84\\xd4\\xa5\\x0fmj\\x08+d\\x9e\\x8d\\xae4_o\\x08s\\xf8w\\xfe\\xb4~\\xb6'\\x8b\\xaa\\xa9u\\x95\\x88m\\xec\\xe7jj\\xcb\\xe6\\xe5\\xfc\\xbb\\xbc\\xcbnv\\x07\\xf1\\x15\\xc9ft!\n$\\xc8\\x11\\xf2\\xbc|\\xbet\\xb7h\\xf0\\x90n\\xd4f\\xda\\xaf\\xdc\\xf2\\xc7\\xca{\\x19\\x96\\xe1!e\\xf8\\x01\\xa7\\xee\\xdf\\xbea\\xe2i\\xfcse\\xc8\t\\xed\\x19\\x17\\xc3\\xea\\x1dj\\x0c\\xcd\\xfb\\x7f\\xab\\x0e\\xab_d\\xc6igo\n\\x9bm\\xb9\\xf4\\xc6k\\xe1vv\\xa2\\xda^\\xb8\\x87y\\x81\\xe3x\\x11\\xc2\\x00\\xb1\\x06o\\xc5\\x87<\\x92r\\x10m\\xddyae\\xa3\\x15q\\x08j\\xdc\\x82 b\\xa3yf\\xb2\\xb7i\\xfam\\xb0\\xbd`\\x8ef\\xc4\\x83\\xd7\\x90mo\\x97\\xe3%^\\xbd\\x82\\x96\\xb3}w\\x85\\xad\\x96\\x03q=maqf\\xc2\\x15\\xaf#\\x8e\\xca\\xe7\\xe6\\xa2\\xba6\\x94qg\\x80\\x00\\x1d\\xec\\x16\\x7f\\xec\\x12\\x16"
  277. },
  278. {
  279. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x01\\xafk,\\xa6+5\\x84+\\xa0\\xa8\\xab<\\x9d\\x82\\x95\\x9ak\\xe8\\xa8\\x8f\\x0e\\xe2\\x97\\xc7\\x99\\xe3\\xad\\xaby\\x81\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  280. },
  281. {
  282. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc2\\x80#\\xb9\\x93t\\xa7p\\xce\\x86\\xb8\\xad\\xa0p\\xf7\\xd4h\\xf2v\\xc5]\\xb1\\x1d\\xd7\\xb0lx\\x1avn\\xb9\\xe3\\x04\\xdf\\xaa\\xeb\\x9f\\xc5\\x9b\\xefj\\xfa\\xd3\\xd5c\\x02\\xd6b\\xc5)\\x15\\xf97\\xa6\\xd4\\xa1doua@o\\xca \\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x0b\\xdc\\xd4\\x1b\\xcfq\\xc6\\xbffp\\xb0}\\xe2\\xc6\\xe6)\\x91t\\xf4\\xe5\\x0c\t\\x9c\\xef\\x8ce\\xe2\\xa1*\\xa4^\\xce\\xdb\\xbf\\xfb\\xdfdd\\xf7\\xca\\x19[s'\\xf5\\xc5\\xfd\\x0e"
  283. },
  284. {
  285. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\x7f)%\\xf5\\x19\\xa39\\xef\\x8c\\xa6\\x8eu\\x8a\\xd8\"\\xa3\\x11l\\x08\\xea\\xeep=\\x08\\xad\\x81\\x01\\xcf.z\\xe6\\xf3\\x81\\xde\\x046\\x13zrk\\xf3\r\\xf7p\\xbd\\xb8\\xed\\x1e\\x90\\x07u\\x1fp\\x8e\\xb4\\x10\\x83\\xc3<v\\x0b\\xcei\\xdb\\xa1\\x00v|\\xc0\\x06\\x902b{\\xc6\\xb4\\xf5\\xbej\\x16\\x83\\xcfsc\\xa5\\x84\\xb2\\xd1\r\\xa9e\\xff\\x12=\\xb9\\x90\"\\xcajm\\x8e\\xb1\\xa8\\xe2\\x89\\\\xbe\\xd7\\xe3v?\\x87\\xa4e\\xd3z\\xcc\\xea\\xf6i\\xe2;]rt\\x00%b\\xe3\\xbf\\x02+\\xba\\x06\\xc8\\xb9k\\xbf\\x8co\\x92\\xae\\xa8\\xa3\\x85y\tu\\xf9h.=j1\\x95k\\xe9y\\xa9@8\\xe5\\xbb\\x1ax_n\\x80\\x95kzo\\x7f\\xcf\\xfe\\x9f\\xbf\\xa9\\xf2^\\xfd\\xef\\x80\n\\xc7\\x9f\\x1e\\xa6\\x17\\xe8h\\x93\\x93\\xfc\\xb8\\xfe\\x0el\\x15\\xb4\\xda\\x05\\x85a+\\x98\\xdd\\xefqt\\xee\\x87\\xe3\\xb9]3\\xd8l\\xd7\\x84\\xa7e\\xf3\\xe2\\xdee\\xeb_7\\xd7\\x99y\\x8bvqqz\\xc0\\xcd\\xcf\\x10$s\\xaa\\xf7\\xea\\xed5\\xea\\xb9\\xbf"
  286. },
  287. {
  288. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\xf0\\xb4e\\xe0ktc\\x8cvi%\\xb1\\xaayz+\\t.h\\xe8\\xa3\\x84\\xbb\\xa39]\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  289. },
  290. {
  291. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\xaa\\xccu[\\xc4\r9\\xd6\\xc6\\x885\\x95\\xc70\\xa6s|\\xbb\\\\x7f)\\xb9\\xf67\\x07\\xa2\\xbe\\xf7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  292. },
  293. {
  294. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\xb4\\xe4\\xddw\\xb9e\\xfb\\xfd\\x8a\\xe9q\\xa6\\x9ff\\xf0\\xc1\\xae<kci\\xc4'\\xb0\\xd6\\xfa.*\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  295. },
  296. {
  297. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaflc\\xado\\xef\\x8d\\xf2%v\\x8ez\\xa1\\xd4\\xdf\\x90/\\xb8m\\xf48\\xe0e*\\xcby\\xf0\\xfc\\xfc\\x1f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  298. },
  299. {
  300. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\xd0%\\x89\\xbdo\\x8ey\\xa4,\\xf1*\\x00\\xd9\\xba\\xf2\\x86uz,\\x82\\xd2h\\x0e\\xf3\\x8c%\\x0f\\x05\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  301. },
  302. {
  303. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl-\\xa6^d\\xda\\x16\\xc0\\xe3x\\xc6w\\x83zw\\xd1\\xb1:\\x14~\\xb8\\xcb\\x9c\\x96l\\x03+t\\x83\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  304. },
  305. {
  306. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl \\x88\\xb1u\\xc09i\\x92\\x1f\\xb4e\\x1f\\xad\\xec\\xd8\\xf3qb\\xa2\\x93\\xb7)s\\xa6eh\\xe5\\xdc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  307. },
  308. {
  309. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\xc2\\xe8\\\\x0f7l\\x00\\x8f\\xb3pe\\x99$\\xe5h\\x98-\\xb5\\xd0\\x12z\\xc4\\x06\\x05\\xb8am\\x91\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  310. },
  311. {
  312. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04:\\xc8\\xdb\\xe1pj\\xb6qo\\x05xh\\x9a\\xf4\\xb5\\x11\\xbe(\\xe7g\\xde\\x88\\xf4\\xa0\\x80(\\x9cq\\x19\\xf9\\x83\\xbd\\x1b\\x91\\xc5`\\xda&b\\x16xp\\x86\\xed8\\x81ou3\\xfb\\xc3\\x1b\\x9c\\x97\\x0e\n]\\x15v\\xae\\xd4\\xaf\\xbf\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000c\\x1a\\x16\\x8e\\xeb\\xe0\\x0c\\x9d\\xdd>\\x8a1b\\x15\\xf8m\\x11\\xderh\\xfa\\xb8\\x9f\\x85\\xbch{\\xf6\\x15k\\x98\\xab\\x87\\x1dg7a\\xb5\\x15\\x98\\xdf\\xcf\\xef\\x11w\\x15\\xa6\\xc3"
  313. },
  314. {
  315. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@d\\xf1y\\xab~n\\x94ex\\x89\\x0c\\xa6\\x9d\\xe0\\x0b\\xd4`n\\xa2b\\xc9rm~\\xd1c<\\xdf\\xb9\\xa2^u\\xc5>wu\\xe7\\x0eb\\x13^\\x9cb\\xfan6x~b\\xa6\\xeb\\xeb\\x0e\\xa4\\x0f\\xe0\\xa1\\xac\\xdfu&\\x06z\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x83\\xf5\\xe9i\\xbf\\xf1a\\xeauy\\xccwxu%`\\xcb\\xda\\x83\\x06\\xb7\\xbb!m\\x1c\\x9cl\\x01o\\xea\\xbc\\x90\\xa3\\xfc\\xe7)ft\\xdb\\xa5\\xec\\xaf\\xdb\\x80\\x1ed\\x96\\x10"
  316. },
  317. {
  318. "http_request": "winword.exe_WSASend_\\xff\\xff\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x00\\xe82q\\xf6\\xd6\\xe6\\xa4\\xfdu\\xdc#\\f \\x88\\xe1u1\\x8a\\x00\\xe0\\x97lm\\x16\\xe2\\xb8\\x97v\\xce\\x0c\\xf8i-~u\\x0e\\x80h\\x06-\\x03\\xbc\\x11\\xc8\\xcb\\x9ar\\x89\\xe0hua\\x8d\\xaf\\xd1\\xf8d&\\xe1m\\xcf\\xe1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf3+\\x11\\x1b6e^\\xe6\\xcc\\xc7\\x07z\\\\xaf\\xf8\\x00z\\xfc\\xecd\\x1ae\\x94\\xb2#\\xd5a\\xa0\\xb0us\\xc3\\xa0\\x9f\\xc7a~\\xf4\\x94\\xefy,[;\\x8c\\x0f\\xf9 "
  319. },
  320. {
  321. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd3\\xe6\\x9c\\xc7\\x9e{yah\\xc4e\\x04x\\xa1\\xdb\\xad\\xb4\\xae\\xbf8\\xde\\x1f\\xaf\\xbd\\x9a}\\xbe:\\xb3\np\\xfbza\\x9b\\xf5g\\x1bh\\x14\\xc9o\\x1e\nd\\xd7zve\\xc9\\xda-\\x8b\\xeeg\\xb6\\x9b\\xa9\\xaa\\xab\\xc8':\\xf8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1]\\x16\\x96}\\xecft\\x00\\x0e[!\\xfe\\xdd\\xbd\\xb1\\x85\\x7fo\\xce\\xa2(\\x1d\\xef\\x99*\\x15\\xc74\\x92\\x86\\xd8\\\\xcbya\\xc0\\xa2\\xe0\\xf4\\xe9w\\xb5\\xba\\xcdbj\\xc6"
  322. },
  323. {
  324. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04a|\\x1c\\x19bb\\xfe\\xe7s\\x9d\\x12\\xda?\\x81\\xa3\\xe5\\x80\\xe1\\xec\\x89\\xe0>\\x87\\x93u\\xfc\\xc8\\x8c\\b\\xf8hb\\x10\\xc4d\\xb8\\xd9\\xe6\\x8f\\x8c\\xa9l\\x08\\x1a9\\x08g8\\xeb\\x82{\\xd9y\\xdd\\xcah\\x96\\x80]y\\xdb\\xfe\\xeb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf7\\xf8\\xf3r\\x01%g/\\x85\\xd6(\\xaa\\x83\\xe6\\x94n\\x16\\x9b\\x84\\xfa\\x81\\xca*\\x18'\\x9f\\xaf{\\xc1\\x7f\\x14\\x91jw?\\xfa\\xda\\xda2\\xb6\\x9a\\xfe\\xedt\\xc6k\\xbb\\xfa"
  325. },
  326. {
  327. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xccx\\xf5\\xf5r\\x1b\\xf5\\x1a\\x17\\x99\\xe9\\xc4\\xae{r\\xd1p\\xd8\\x8d\\x90\\xa1\\xbf\\xf7\\xc7\\xcce\\xfa\\xc2t\\x0e\\xc8\\x93{\\xdb\\xact&\\xe2\\xfef\\x02\\x98{\\x9c6\\xdf\\x94\\xfa\\x8cq\\x93\\x13\\x1e>\\xdd$\\xc0\\x9e\\x82\\xfc\\xe1\\x8b8,\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcb\\xaehq\\xa9\\x00u\\xf1;\\xb7h<\\x98\\x8d8i\\xe23u\\x87=\\xc2\\xa2u\\xa68\\xa0\\xe7/\\xb5\\x0e\\xa5\\xd1s[\\x10d\\xd5~$\\xf2k\\x02\\xc9b\\x13\\xf8\\x1a"
  328. },
  329. {
  330. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\xee\\xa7&1h\\x17\\xbdo\n\\x11\\xb5\\x1d\\x97\\x8d\\x1c\\xd9@\\xae\\xd9\\xe4\\xa3\\xc4\\x05:f\\xb8z\\x05\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  331. },
  332. {
  333. "http_request": "winword.exe_WSASend_\\xba\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaflf\\xab\\xbc\\xe5\\xee\\xe0\\x13u\\xf4\\x0faha\\xe6\\xfe\\xc2\r\\x12\\x18}~?(\\xd8\\xf0\\xc8k/\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  334. },
  335. {
  336. "http_request": "winword.exe_WSASend_\\xba\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcet\\xdejbo\\x97[9\\xfc/msy\"\\x0c\\xcad\\x00\\x9fc\\xd5\\xf1&\\x1c\\x9c>\\xe4\\x14\\xa2p\\xe2\\xb8e\\xd1\\xd5\\x83\\xff\\x06qoz\\x15>9zx\\xeep.cv\\xac\\x84\\x1d5)\\xc9\\xbaeu\\xcb\\xfe\\x8b\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdd\\x17\\x0e0\\x83\\xe5u]\\xd9\\xa1\\xa28\\x16\\x14~\\x8c\\x104t\\xac\\xb6r>7\\x08\\xc6k\\x1e{r\\xa1qpsu\\x99\\xb4z\\xfc\\xb1h?\\x1bv\\x1d\\xec\\xff\\xfe"
  337. },
  338. {
  339. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04rgx\\x1b\\xc6\\x8a:z\\xd7\\xf0\\x83v&\\xdd\\xbd(?*\\xb4\n\\x0b\n\\x87\\x84\r\\xe6\\xbbc\\xc1\\x81\\xc7\\xad\\x13\\xcb;q\\xe6a\\xbf\\xc4\\xa6\\xc3\\xd3\\x8c\\x1e\\x05x7\\x15\\x04_{c?\\xf9\\x9e\\xfa\\xba\\x14\\xff\\x10\\xf0\\xe2\\xbc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000j\\xe2\\x95\\x11\\x8e\\xcb\\xe6-\\x85q\\xe3\\x95\\xa5\\xb1?\\xa5\\xd8*\\xe2\\xfd_\\x8c.{\\x05\\xfal\\xb5\t\\x12\\x0f\\xd4\\x08o_\\xf0\\xb3l\\xfbs\"$\\xdeoi)b@"
  340. },
  341. {
  342. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\x05v\\xe1.\\xebt\\xf5\\xa0\\xbds\\xa0\\xfe\\x7fd\\x05\\xaf\\xe8\\xc9\\xc8\\x87g;l\\xfenx\\x14\\x9e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  343. },
  344. {
  345. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1r2vf\\xa9\\xa6\\xa1\\x05mt'\\x19\\xf5\\xc6d\\xb4\\xdf\t\\xe8\\x08p\t\\xc2\\x8f[\\x97\\xb7\\xc2^ty\\x02i\\xf1q\\x0b\\xe1\\x92\\xd4[\\x8c\\x96\\x91\\xb3\\x08\\xee\\x147o\\xba7\\xc1h\\xedh\\xf7n:e4\\xba\\x89\\xfb\\xa5\\x99}g#\\xc2\\xc6\\x983b\\xdf9\\x8e\\x98\\xa2^v\\xac&\\xb1\\xdb\\x88\\x062\\xca\\x07bn\\xa7>'\\x1c\n7\\x81\\x9b\\x1fn<yo\\xdd\\xa3\\xaf\\xa5\\x00{s\\xd7\\xa5$\\xf6[z\\x12,d\\x96\\xbf\\x83\\x10^\\xb4\\xac\\xc6|r\\x18\\x88w\\x97*1{\\x02hp\\xe1\\xd3\\x90\\xec^\\xd8 \\x9a \\xb1\\xccr\\xfd\\x90\\x97\\xecdtxu\\x0bb\\xeb\\xc6\\x19\\x0c\\\\x0e3`k\rcr\\x01\\xba\\xa90\\x88\\x1f\\xd0\\xc0\\xea\\x0f\\xb8\\xd5_\\x97mx\\x04^3\\x9c2\\xa0j\\x94t<\\x83\\xf9\\x9d\\x1e\\xb7{\\x8f\\xdd\\x04\\xed\\xcd7@~oj>\\xa0\\x16\\x91hre\\xac\\xc7\\x9a#\\x13\\xc7\\xc5\\xf8\\x83<\r1b\\xf08a\\xe2@\\x9eaa.(\\xe7e\\x96\\xdd"
  346. },
  347. {
  348. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010riy\\xf8\\xc5\\xa69\\xf9\\xeb\\xd7\\x85\\xa8t\\x10\\xe0\\xffh4\\xfd3rq\\x92\\x9cs\\xc9\\xa2=\\x91f\"\r\\xf6\\xaf\\xe6\\xfa\\x06y\\xf3\\xf7\\xd2b\\xa9\\xe3\\x80\\x05\\xa7 \\xe9*\\xdd\\xd2f$\\xfd\\xf3\\xe1f\\xbe\\xf8\\x86\\x15\\xf1\\x87-\\x93lo\\x04\\x8b\\xb3\\xfa\\xd2\\x8d\\xc9i\\xdd\\xbc\\x15\\x95[q\\x17\r\\x8e\\x93v\\xb8z\\x95\\xc7w>\\xe5\\xd8\\xad\\xa0i\\x01mo3\\xa7\\xf95\\x99k\\x01\\x10\\xc9\\xc9b\\xd3\\x03\\xb4\\xf8\\xad\\xf2\\x80\\xddy(\\xf6\\x17o;g\\x04\\x94c,\\x06\\xde)\\xad\\x1c\\xf9\\xf0\\xd6y\\xbc\\xc3\\x8d\\xa4[\\xabw\\xd9\\x18\\xa1g\\x82\\x8da\\x1a\\xf3\\x0b\\xb0\\xd0?\\x91\\x91)\\xde\\xd6\\x86\\xd0m\\xac\\xbd\\xb9\\x9f\\x95\\xdf\\xc8\\xcd\\xdf\\xc3xvw\\xd9\\x96\\x9ezy=\\xfb\\xfa&\\xcc\\x97\\xa8\\x0c\\x9c\\x8e\\xa6\\x91i`\\x90$*\\xa9\\x9f+i?\\xeempzw]s\\x7fvmc\\x95p\\x97\\xc1\\x18t\\xc9\\xb1\\x9a\\xdf\r\\x85i>[\\xc1m\\x19c#/\\xa5\\x0c\\xe4h\\x08>@\\x91\\x97b!"
  349. },
  350. {
  351. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl]\\x84<\\xa5\\xdc\\x01\\xbb\\xb0\\xbf\\xdd\\x7f\\x9d\\xcc\\x18\\xe8o^\\xfc\\xef\\x1aw\\xad\\xa7\\xca(o\\xda\\xa8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  352. },
  353. {
  354. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb0r\\x9f\\xff\\xf7#;\\x17\\xb5\\xde\\xf1h\\xa5t\\xdd\\xd7os\\x8f\\x0el\\x1a;\\xbc\\xbch\\xf0\\xc2\\xed\\xc0\\x80\\xe6\\x13\\x17\\xb76\\x89\\xdd\\x10\\xaaw\\x823z)\\x02\\xc1\\x01\\xf9\\xd8\\xf8\\xd1%\\xb7\\x06\\xf1\\xa2\\xb1\\xbf\\xc5\\x15\\x10\\x13\\xbbb\\xac\\xa7\\x14\\xea\\x99z\\xaf\\xb3\\xf4\\xc3c\\xa7\\x1b\\xec\\xb6<\\xb0\n\\xb9b\\x84n\\xa5\\xe8\\x12\\x8d>\\xd5w\\xbe\\x81\\x8d\\xd8x1]\\x8f\\xff:\\xadj\r\\xb9<\\xac\\x9d\\x19-`\\xe4\\xa4\\xab\\x8224z\\xfa#h\\x7f\\xa2gt%\\xe8j\\xa9y\\x18\r\\x1as%\\xff4\\xe6}\\x06j\\xb9\\xee\\x14\\xabt4\n\\xf4\\x19\\x9b\\xd5|\\x13\\xf8\\xd5\\xd3{q\\x98\\xb8;k\\xd8\\xd6\\x96\\xe1\\xe8a\\xbd\t_x\\xf1\\xab\\\\xaf\\x9f\\xe9\\x9d0i\\x01\"\\x93fyk\\xfd\\x19=\\xf0\\xcb>\\x91\\xb1\\x13k\\xd0bwfk\\x1d\\x14\\x91\\x1d\\xfe\\xeb\\xf9\\xe5'\\xa9\\xeastq\\xfa\\xa3\\x01\\xc09\\x00/xp\\xa4\\xdb\\x1e\\xebm:\\xdd\\x9a\\x00\\x1e\\xd7\\x08|\\xe6\\xcf\\xa2~l\\x00hj\\x88"
  355. },
  356. {
  357. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xabl\\xc7\\x8f\\xf6\\x04\\xe4\\x08\\x9b\\xe5\\xd0\\xcf\\xfdw\\xda\\x11\\x00\\xd2\\xa00\\xb4\\xf3\\xb9)c\\x13jb@-\\xa05\\x0b\\xc8\\x88: (\\x80\\xab4\\x88v\\x85\\xf4a\\x99\\xcd:5@\\x8d\t\\x03\\xc6\\x0c\\x020\\xaf'\\x7f\\xb2\\xa0\\x1a\\xb4\\x0bh\\xe7\\x1b\\x00dd\\x9fpgt}j|\\x1e\\xf6\\x8f\\xd5\\xe8?\\x1b\\x02\\x1fd7\\x8f\\xa7\\xf2\\x1bb4\\xe2\\x89l\\xc0 o\\x94\\xc3\\xa2\\x8ca\\xe5\\x05y\\xc0\\x9d\\xe2e|\\xcb8\\xc6\\xed\\xdd\\xeb\\x01\\x86\\xe1_a, 6\\xa6k\\x0fc)\\x98q<\\x12\tw!\\xaa\\xbas;vz\\xea\\x04y\\xf8(t b^\\xa4\rz\\xb7\\xfd\\xd1:\\xe6\\xab\\xc7me\\xb0\\xfa\\xa6\\xce\\xfdsm\\xe7d\\xf4\\xdav\\xce\\x8f\\xa8\\x17\\x1c\\x84\\xc1\\x88\\xa8\\xfe\\xe0&nz'm\\xc6\\x17\\xd8\\xc29\\x1dw\\xb14\\xf9\\x96\\xcf\\xcf\\x97?{\"zw\\xe6\\xfd\\xea\\xaa\\x19'+\\xed`\\xb4\\x83\\xc8l7b\\x1f\\xbb\\x1b\\xee\\xe4<}e\\xf5\\x98\\x83}x7b\\x1cc2\\x9b<w"
  358. },
  359. {
  360. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafljrwe+e\\xed38\\x17~\\xd9y& \\xfco\\xd0\\x85o\\x9b/}\\x08v\\x00\\xaf\\xf5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  361. },
  362. {
  363. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaflq\\xcd\\xac\\xee\\xbch\\xcd\\x0b\\x88be&n\\xb3\\x019\\xf4\\x02\\xe3\\x9cg\\x87\\xfd\\x95\\xbd\\x9a\\x07\t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  364. },
  365. {
  366. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaflk\\x98m\\x91]fmx.\\x82\\xf1\\xa3\\xb0\\xf2\\xbb\\x9dqt\\xa7\\\\xf0wlqd\\xda4\\xab\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  367. },
  368. {
  369. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\x00\\x9a\\x85}y\\x92\\xca\\xa2\\xcd\\xee0\\xc0ym\\xe23\\xf8\\xfa{\\xc4\\xb4$osj\\xb1\\xbe`\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  370. },
  371. {
  372. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\x83\\x02\\x9b\\xd5\\xceuf\\x16\\x0b\\x00+\\xf0h1\\x8f5\\x98\\x81\\xd9xm$\\x83\\xac\\x8cv|\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  373. },
  374. {
  375. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\x0f\\xa0g\\x17\\xc4\\xcc4\\xf6\\xe1\\x16\\x8a\\xff\\xc9@\\xb8\\xe3\\x95p\\x8f\\x04\\xd3\\xd5\\x1c\\x98\\x02x\\xd4\\xbc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  376. },
  377. {
  378. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xaflnw\\x1f\\xf1\\xfc\\x84\\xff=\\xec\\x90\\x15\\x9f\\x14\\xaf\\xaep=/\\xab\\x02d\\xd8m\\xcew\\xe4\\xb4\\x13\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  379. },
  380. {
  381. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9c0\\xe1a\\x9c\\xe5\\xd6w\\\\xd7:\\x11jg\\x9f\\x86p\\xe8\r\\xef\\xf4\\xba\\xe2\\x0c\\xa7c\\xcb\\x9a\\xe5\\x16\\xd6\\xc3<?\\xd99_}\\xeb\\x99\\xf2\\x8d\\x0f\\x1b\\x05,wj\\xc8\\xc2\\x04\\xdd\\xad \\x15\\xdf\\xb0\\x82\\xf9\\x9a\\xe6qq&\\xfc\\xcb\\xf6\\x80\\xf5\\x96\\xd9\\xe7\\x18\\x80\\\\xa0h\\xaf\\xbdn\\xefd\\xcbjh\\xa4\\x17\\xe1\\x01\\x1f\\x87\\xc8^\\x81\\xba\\x82\\x01\\xed\\x84\\x0btjr\\xc2m-\\x9e\\x1e9\\xe2\\x99\\x16:\\x9dk\\x95\r\\xa4\\x01\\xe8q3\\\\x18\\xdc\\xc1\\xf1{&x\\x00szu\\x9fd0\\xaf\\x10\\xdb\\xf1\\xe9{y\\xdd\\x97\\xf6\\xdc\\x91\\x0bh5\\x01f\\x87u\\x9ec\\xd6\\x08g\\xaf\\xe7#aq\\xc5*\\xd4}\\xc2\\xc1\\xc5\\x02x[\\xf8j\\x8c\\xec\t\\x08\\x8a\\x1b\\x10zy\\x0f\\x97\\x12\\xfek\\x81\\xef\\xb4v\\xa1\\xab\\xb9h9\\xc5\\xb5\\x88\\xe0\\xaabz\\xbfw\\xb1$\\x93\\xd4\\xb1\\xad\"\\x88\\xb74n\\xe2\\x8e\\xdby\\x9f\\x93\\xea,\\x99x\\xa4\\x0e6\\x8a\\x91\\xca\\xd3]\\xf9f8\\xb5\\xf7p\\x1f(\\xef\\x90,\\x87"
  382. },
  383. {
  384. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd0\\x14\\xa5\t%\\xf2q\\x8ez\\xc0\\xbd4@l\\xe2\\xa9\\x08\\x86\\x06\\x9bk?\\xa29:\\x93n\\xe4j\\x86\\x8a\\x89(!\\xe6h\\xdf\\xcd\\xb9_ zm\\xf2(\\xfa\\xad(\\xbb\\xc5\\x8e\\x87\\xc2e\\xdc$\\x86\\xbd\\x0e\\xe2\\xd7\\xaf<=q\\xed'\\x01&i%\\xa6l}\\x19l\\xfako\\xd3\\xd4zq\\xb8w\\x06\\xcel\\x85\\x93`\\xa30\\x11\\xda[s\\x92%\\xa3|\\xa5\\xc1\\xcd\\xe1\\x9c\\xe3i\\xc4\\xc3\\xdf\t\\x95g\\x08-\\x94\\x13b\\x98=\\xe8wo\\xf0`\\xbf\\xe2t\\x8c\\xa5\\x1a\\xa4. \\x94?\\x13\\x19$\\x89\\xad\\xb5\\xa7+\\xbb\\xa5\\xd2\\x92\\xce\\xc6\\x06\\xbbm\\xf3\\xe5\\x95m|\\xf2c[oog-\\x0c\\x19\\x98\\x82{fu\\xff\\xdb\\xe9\\xf8bu\\x9a2,\\xa6l5\\x98hk\\x05\\xcd;\\x9b\\xe4\\x06\\xbbtp\\x9eqp%i,\\xbe]y\\xa2?-\\xaa\\xa4\\xb6\\xc9w\\x1d\\xd3\\xbb\\xa2\"\\xe8\\x86\\x82\\x8en\\xceyny5\\x9dtm(\\xdd\\xe3@b\\x84\\xe2)\\x17z8g\\xec1m\\xb9v\\xcc\\x81"
  385. },
  386. {
  387. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04)\\x83\\xa9\\x14\\x0c\\xb9o3\\x1a\\x14\\xb3*\\x0e\\x96\\xd8\\x07di\\xd5\\x14\\xdb\\x8c(z-\\xa8q\\xfez\\xcb\\xcb\\x9a4y\\xa2$v\\xad\\xb5`\\x8e\\xec\\xc5y.u\\xcex\\xa8[.\\x933\\x7ft\\xc5\\x81\\x1d\\x95\\x97\\x81<\\x18\\xb5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe7\\x8e\\x80\\xda\\xbd\\xbc\\xd2\\xee\\x14\\xc4\\xdb8o\\xfd\\xb6m\\x11+\\x12\\x16\\xe4\\xa1\\x10\\xc8\\x98pq\\x07`\\xce\\xaa\\xcb\\xe3\\x95\\xd2\\x11\\xf8\\xd9\\xfb\\x80\\xef\\xa0\\x030xw#\\x99"
  388. },
  389. {
  390. "http_request": "winword.exe_WSASend_\\xc4\\x00y\\x00\\xb0\\xbb{\\x08\\x86\row\\xd2\\x11\\xf5\\xc1u\\x9d;\\xd6%gg%\\x18\\x1a\\x12\\xd8!\\xab\\x94y\\xd4?\\x80\\xfcw\\xdcqf\\x838\\xd5\\x10\\xc2t9\\x16\\x0e\\xbc\\xe9\\x17\\x1dk\\xdb6\\xc0\\xd0m\\x8d\\xbf\\xedt\\x85\\xe2d\\x14\\xafl\"n\\xbf\\xac\\x0b\\x07\\xa5\\xact\\xfd\\x9e\\xd0\\xe7v\\xc0#\\xc1\\xdd\\xd7\\xe3\\xceb\\xb5c>i\\x93<\\xce0\\xff+\\x1398\\xe6\\x9f-\\xf2\\xa0/6\\x86\\xf5\\xb0\\x12\\xeco\\xd2\\xabd\\xd3\\xe2i\\x03?\\xb1|\\xb3\\x8e\\xaa\\xef\\xd9\\xbb\\xd2\\xf8\\x91u\\x103\\x82'3&\\xbd\\xcf\\x9byv\\xd1\\xa8-\\xe6\\x82u\\xb8\\x1d\\x9b\\xa2\\xa6j\\x1b\\xc7go\\xef\\xce\\xfc\\x98\\xd8]\\xc1\\x81/\\xc2#\\xdf\\x19\\x0c\\x12\\x08\n\\x9c\\xbc\\xf4\\xbe\\x980\t\\xaa\\xb3\\xef\\xe8\\xaf\\x11\\xfc\\xefz\\x15qu\\xac\\xd1 \\xe1\\x0b\\x8c\\x88\\xaf\\x00\\xa4\\xef\\x85\\xd2\\xb4m\\x91\\xc8\\x12\"\\x9c?c\\xe3p#\\xa2}\\x8c\\xc7\\xff\\xd1-s\\x7fex\\xf8\\xe9\\xdcue)\\xf0\\xe8@h\\xc04a\\xfe\\xb6?d\\x84\\x94\\xe0"
  391. },
  392. {
  393. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcb\\xe4w\\x10\\x15\\x05\\x95\\xe8\\x8f\\x19\\x02\\xf7\\x8a\\xc9s\\xef\\x9e\\xa2\\xde\r\\xd8\\x13\\x81\\xbf\\x862\\xabynie\\x11\"3\\xd9s\\x9b\\xd1\\xf4p5\\x99\\xb4\\xd3c\\xd3\\x9e\\xac\\xe2\\xba[\"\\xd0\\xf1d\\xc8\"]\\xeb\\x08\\x03`\\xa0\\xec\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000g\\xbb\\xc7_v{\\xebx2\\xe6\\xd1\\x04m\\xe7\\xae\\x08^\\xf6\"\\x02\\xcc6n\\xe4\\x92\\x86x\\xc8\\xec\\xacmx\\xcd\\xb6t_\\xbcd\\xff\\x8dq\\xc7\\xae\\xce\\xf5\\x02\\xacg"
  394. },
  395. {
  396. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010<\\xd9\\x9ct$~=k;\\x96fo\\xda\\x15\\x1e_\\x84$\\xd7sj\\xf8p\\x02\\x1fer\\xe8ory\\xe3\\xcbj\\x18\\xea\\x05\\xd5\\xa0\\xeb\\xff\\xb0\\xc3gv\\xb7\\xc7\\xa6#\\xef\\xa9\\xd3\\x9b&\\x9df|a\\x80\\xf9\t\\x0b\\xf1\\xd5d*gt^\\xdf\\xe9\\x0e\\xf5!\\xf1-eyi\\xe1\\x7fa\\xcf\\x87\\xba\\x15y\\xdb\\xa0\\xdc\\xf7\\xb4\\xa7\\x89\\xaa\\x91\\xd6\\x9a\\xae\\xbf\"i\\xed\\xe8\\xdf8i\\xe5\\x7f\\x06\\x8b\\xcf\\x88n\\xabn5\\x05k\\x05_\\x85\\xfc\\x80\\x99_ch(|7\\x88\\x0b\\x04v\\x80\\x8e7\\xdar\\xf1v\\x80hc\t\\x14\\x805\\x8b\\xcd\\xa3\\xc9]\\xea\\xfd}\\x0e-\\xea\\xf9v\\xf8o\\x1c\\x8ct\\xc7w\\xc9a\\xe5_\\xc2\\xb7s\\x92\\x1a_^\\x80\\x12*\\xb21t\\xc0\\xde\\x17\\xa5\\xb0\\xe9\\xe1t\\xb3\\x81\\xcd\\xb2\\x9a\\x1c\\xad{\\xae\\xce&\\xd4j\\xed\\x18r\\xfaa\\xa5\\x01\\x91\\xdc\\x05c\\xd3c\\t\\xae/\\xd0`nb\\xa2ciny&o\\x88q\\x0fm\n\\x04\\xfe\\xfcq\\xc9\\xbb\\x96\\x1a2;?"
  397. },
  398. {
  399. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04=\\xb3\\xa5\\x8c\\x8b\\xf1\\xd5~u\\xbc=\\xb9\\x7f\\x04\\x1c\\xb0[m\\x99\\xc0\\xef\\x00\\x03nw\\x9ap\\xcf\\xb6a\\x86\\xbe.pj]\\x18\\x16\\x17.\\xecn\\x9e\\xc5>h\\xa4\\x9clc\\x00c\\x8e\\xb0\\x7fu\\xc1\\xb0e\\xa8\\x8d\\xfd6\\xf5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9b*\\xdc\\xb5\\xb0{\\x9c\\xe1y\\xac8o\\x9d\\xbbwb\\xcb\\x9d\\xa6]\\xb8\\xfa\\xe0\\xf3\\x8e\\xbdj\\xcc\\xc6\\x12x\\xb3gr\\xf3\\xb3t6`\\xdaf\\x91\\x0c\\x1f_\\x12os"
  400. },
  401. {
  402. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\x85v\\xc06\\x98n\\x8b\\x83\\xb4)v\n\\xab\\x1e\\xc2\\x02?8\\xb8\\x9dlce\\xdd\\x9d\\xf3\\x98\\xb8\\x01\\x8fivh\\h/a\\x7fd\\x06\\x03\\xd6[\\xef-\\xab\\xab\\xa0\\x06\\xa9\\xd1\\xf4\\xa5^}\\|\\x00\\x84w\\x88i>\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe7c~\\xcb>\\x01h\\xc6 \\x17\\xbbm;\\xccv\\xe4\\xdct\\xc5\\x86\\xb8\\xbca\\x19\\xd7\\x84\\xc3#\\xf1\\x86\\x0f\\xa9\\x02hu\\x90\\x94\\x87\\xe6\\xc3kc3\\xe1\\xda\\xfa\\xa6\\x85"
  403. },
  404. {
  405. "http_request": "winword.exe_WSASend_\\xa6\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf1p\\xfct\\xab\\xa97\\xe2\\xa5n\\xc1\\x1f\\xec\\xdc\\x83/\\x1b\\xbav6\\xffb\\xc0l\\xd9\\xa2)x\\x97\\xd3\\x0f!\\xfb\\xe7\\xf6v\\xbbb\\xcd\\xee\\xe0\\x93jv\\xc2\\xb4\\xe1\\xc2xlz\\xc4\\x8b\\x95\\xca\\x9a7<\\x1e\\x07\\xf7\\x7ftm\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3/g\\x17\\xc2q\\x95\\x84\\x98\\x8e\\xd8\\xbf\\x8f\\x06\\xa3\\xd2$[\\xd9\\x81\\xf7\\xc3\\x03\\x04\\x92?;f\\xfb5\\xeb\\x9d\\x00\\xc3:.\"m;cp\\xc2/\\xe9 x\\x83l"
  406. },
  407. {
  408. "http_request": "winword.exe_WSASend_\\xa6\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x17\\xf7\\x96z\\xa8z\\xd9\\xde\\xe2t\\x9f\\xf7#\\xd6\\xb9\\xdb\\x94\\x87\\xda$)*\\x04s\\x92\\xb0a\\xbf\\xe2-\\x83\\x90\\x81\\xb3%\\xea\\xd6\\xc1\\xcag\\xa0\\x1a&t\\x04\\xfcv\\xb7\\x94\\x96\\xf2\\x1e\\x19\\xa7\\xc9|bk\\x00\\xe1k`\\x1b\\x99\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xee\\xecn\\xc1a\\xc0\\xd9\\xcf\\x19\\xb3\\x1a\\xdb\\x18\\x07\\xac\\x00\\xabp\\xec\\xed\\xcd\\xbb\\xc5@i\\x18$\\xfd\\x0e\\xee\\xe5\\xa1\\x15$+l\\xb3\\xa1\\xda\\xe2h\\xbev\\xf2\\x19r\\xee\\xe3"
  409. },
  410. {
  411. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xef(\t:\\xfdm\\xc5ky\\x8br\\x0eot\\xdb\\xf4i\\xe9\\xcd\\xba[8\\xdcv\\xe0b\\x1f\\x07\\x8ez\\xb6<b9\\xc5\\xfa'\\xbea\\xcd$\\xab\\xa1i(\\x0b\\xb3'\\x92\\x9co\\x80-\\x06\\xdf\\x14r\\x8f\\xc0\\x13p\\x12\\xa2\\xe2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaco\\xa2\\xa0\\x1c+\\xf4\\xde\\x06\\xbcn\\x85r\\xcd\\xd4q}\\xa1\\x94\\xfd\\xa6\\x14\\x97\\xa0\\x98\\x91\\x81dx75\\x1a\\x1b\\x80\\xfcy{\\xa6\\x15s]\\xf7>\\x93\\x91\\xddw\\xf0"
  412. },
  413. {
  414. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x06\\x96\\x04\\xe0\\x89$\\xe12hq\\xa1\\x9d\\x97,p9\\xcf\\xc0\\xcf\\xb3 dub.b\\x04a\\xb7\\xb8\\xdc\\xfd\\xb0\\x1d\\x1f\\xf8i\\xeaun\\x7fj\\x1ap\\xd8wer\\xce\\xd9\\x88\\xee\\xbe\\x9f\\x9b\\xd0\\x7f\\x9a\\x81\\xd0\\x8f\\xda\\xe0\\xc1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\xce2\n\\xd5\\xd8v\\x0bf\\xac\\xd6m,\\xbd{\\x9f\\x18\\xd6\\xd8\\xd1m\\x17s\\xae\\x0f\\xdan\\x15y\\xc2,u#\\xccnd\\xd4\\x14\\x0fa\\x02\\xcd\\xf2\\xb9\\x85ry\\x90"
  415. },
  416. {
  417. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1d\\x956\\x86\\xcc\\x07\\xa8\\x86\\x92\\xe0\\xbb\\x08\\x01\\xc7g\\x07\\xfe\\x88b\\x8a,am\\xc8^\\x9f\r\\x9a7b\\xdd\\xe0\\xfe\\xa2h\\xe9\\xc2\\xcc\\xf0\\x9f\\xc9j\\x14\\xb6;l\\xbe\\x83|\\x1e\\xd1'\\x0bkw\\x1f\\x8as*\\xa1\\xbb\\xbd\\xf1\\x1f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfb\\xb2\\x8e>\\x02$e\\xefd\\x94u_ozw\\xca\\xc9\\xcd\\xa4\\x1dq\\xb0`om\\x0e\\x87b\\x84\\x91\\xf9\\xf9\\xa9\\xa5f_\\xd2\\xee\\xc7\\xbb\"\\x0e\\xa1\\x8cl\\xd5;t"
  418. },
  419. {
  420. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04ds{-z\\xb5\\xac\\x8f\n\\xa2\\xc66\\xa1\\xa1!\\xbd\\x10@\\x1b\\xb9\\xa3d\\x88\\x98o\\x07\\xa0r\\x8co\\x9a\\xfb3hb\\xb1\\x8b\\xb9\\x027`k\\xe04\\xdf\\x80*nd\\xa1\\xe4\\x91q\\xde\\xf4\\ch\\xa46\\xc7\\xefs(\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5\\xaf\\x91\\xb6\\xd9m\\x02\\x95\\xf7\\xd5\\x16\\xddc\\x0c\\x18\rh\"\\x81@?\\x01\\xc0t;pu\\xfb\\x93a\\x1d\\x10\\x1b\\xa6\\x91\\x8fc6xs\\x9co'\\x9c3\\x90h\\xb6"
  421. },
  422. {
  423. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\x0e\\x8a\\xfd\\x95\\xc2\\x17;\\xd8\\x9e\\xa5\\xb8\\xeae\\xb9b(1\\xf1z\\x0f\\x1a\\x03\\xc8^\\x95\\xdb\\xf9b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  424. },
  425. {
  426. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\xa7\\xc9g\\xe4\\xa7~p%\\xcf\\xd2g\\xfe|\\x1a#?\\xb3$e\\x96\\xd8\\xa7_\\xa4-\\x8c\\x0f\\x08\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  427. },
  428. {
  429. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\x12b\\xf1\\x07\\x9b\\xb0\\x82(#\\xba\\xf8&\\xf6~\\xd8~\\x1c\\xc2\\x18\\xdc\\xb6\\xe6y\\xc3\\xf2\\xa8\\xbex\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  430. },
  431. {
  432. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe9\\x13\\xdca\\x1cy\\x94\\xa4\\x10\\x1ehu\\x0fy\\x87\\x9bx\\xe3\\xb0m{\\xf4\\xd2\\xc6\\x82<b\\xfcx(d\\x9f\\x1b\\x11\ts\\xd9-\\xdfw\\xaeo\\xb6\\xc7\n]y?\\xb6x/!@\\x8d\\x06th\\x12<i\\xd3\\x8dks\\xd5\\xc2\\xb9\\xc3&\\xda\\x99kn\\xcad\\xf8\\xcat\n\\x12\\xbd\\xd3h\\xb973\\x0e\\xb7\\xbfg\\xdd\\xcfj\\xdby\\x81\\xb5\\xc0 \\x08\\xe6\\xb23q\\x0c\\xc5z\\xafr\\xe2\\x06'7nd.t_\\x1c\\x8f\\xeer\\xf2\t%,\"\\x94\\xb1\\x95t\\xe4\\xf6\\x8e0\\xdb\\xf2`\\xe1\\x819\\x86\\xa8\\x15\\xc1\\xcdx\\x19\\x9c\\xc3\\x84w\\xb3\\xff'\\xab\\x1c\\xac\\xa4\\xc9\rs\\xf0\"\\xbd{>f\\xaa\t\\x7fmj\\xec\\x1d\\x0b\\x0e\\xf2\\xeajrq\\xdb\\x14\\xa8do\\x07~\\x96\\xaf\\xf7j\\xb3!\\x16\\xed\\x84o\\xd9\\xdfx\\xd5z#\\x98\\xc5\\xa4\\x94d\\x81pr\\x9b6\\x00\\xda\\xb2\\x1f\\xe3i\\xbb]\\xa1m\\xa9\\x9a(\\x87\\x80\\xd2\\x8bl}\\xef\\x18x\\xfd\\x902yy\\x9c6o\\xdf\\x99b\\xa5'\\x05"
  433. },
  434. {
  435. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x16\\x8cy\\x91\\xed\\xfd\\x0c\\x90\\x86;{*\\xd1\\mo%\\xa7\\x1b\\xc8\\x12z\\x9a\\x89n\\x92\\xdb\\x9d,c\\x1e\\x85lnn^\\xb5_\\xb0\\x05\\x80\\xb3\\xa6\\x8az\\x83lh\\x9a\\\\xa8\\x87=\\xae\\x1b\\xc6\\xea~\\x11\\xc8\\x8c\\xee\\xd2^g\\x88\\xb08\\xd2!c\\xc6\\xce{\"_>\\x96\\xa1\\x17\\xc6\\xe0\\xaa\\x8a\\xb1\\xab\\xca\\x84\\x8f\\\\x0fn\\x90\\x92v\\x08l\\x0e\\xfdk{\\x14n\\xa9uw\\x82/l\\x11\\x04\\xd4\\xf6\\x04\\xe5\\xd1\\x10\\x84\\xa7k\\xf9>\\xeb2>o\\x06v\\x00\\xd9h\\x0c\\xad\\x19\\x86\\x86\\xd3\\x11\\xf9*\\x11\\xd2\\x9d[\\x05\\xa6\\x13\\xd0\\x14\\x92k\\x81\\xb7\\x13n\\x82\\xdc\\x90\\xd0\\xa5\\xf8\\xa1\\x07\\x95\\x04\\x87y\\x9fz\\xe0j\\xee\\xf8\\xfce\\x01\\x1c\rms\\xea\\x9e\t\\xaej\\xe9\\xf2\\xbf\\xcdr\\xd4uwn\\xac\\xe72n\\xc7\\x10}\\xa9\\xe7~\\xfd\\x82\\x0b\\xe9\\xa8\\x11q\\xc7q3r\\x85\\xe3\\xafc\\x97f\\x13\\x86x\\x8fx\\x1ay\\xec\\xc2\\x1e\\xd6'\\x1a\\xfd\\xeeb\\xcc\\x96\\xce\\x04\\x13\\x964\\xd9\\xccy\\x8d\\x9do\\xa0"
  436. },
  437. {
  438. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\xe6\\xac[c\\xc9\\x91\\xd8g\\xed\\xbag\\xb0\\xffm`\\xdc\\xdd\\xeb\\xa0o'uh\\xae\\xeff\\x93v\\xe16\\xa6\\x85hf\\xdc\\xe1r\\x00\\x8a\n\\x84\\xa0\\x01\\x1a.\\xb5?\\x8d$q\\xe65z2\\xbcc\\xf4\\xf4\\xcd\\xc75\\x02\\xdf@\\xc3s\\xb1\\x08\\xe8$\\xde\\xef$\\x84\\xf91l=\\xed\\xfcn\\x82\\x13m\\xf4\\xef\\xb7\\xe5ho`d\\xb6f\\xbd\\xe0\\xe1\\xbaw\\xf6\\xa8\\x19\\x1c\\xc71=gb@mm\\xa7\\xb0\\xb3u;@\\xde\\xf3s=m\\x8a\\xa4\\xb0v\\xf0\\xe0\\xbb\\\\xcc\\xbaa\\xf0\\xe7\\x82\\xb2\\m\\xd0\\xcdfd\\x06\\xb0h\\xb16\\x1e\\xca\\x17\\xae\\x9fx\\xc7x\\xdb\\x05\\x82\\x0c\\xde\\xb7be\\xf0f\\x8aje\\x02=\\xc4\\xaa\\xfa7\\xden\\xf0\\xc8i~i\\xcb\\x06\\xec\\x13\\xbd\\xce\\xf9\\xeai\\x06\\xa5\\xc7\\xda\\xd6\\x80\\xd0\\xf8\\x08\\x15t\\xab\\x880\\xec\\xc0p_.rc\\x85\\x8a\\xb7\\xfc\\x13\\x89\r\\xd6\\xb5\\xc8\\xb8\\x1fe`\\xba\\|\\xae\\xc4~f4e\\x89\\xe1\\xf8\\xea9.\\xd6^\\xddt\\x13\\xd2d\\xd4#"
  439. },
  440. {
  441. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010jx\\xe2\\x9a\\xffj\\x861/\\xdc\\x88'rj\\x17\\x10\\x87h\\x8foa.h\\xa4&j\\xb2\n\\x1e\\xdd\\xaf\\x9f\\x8foz\\xfe\\xd8mu\\xea\\xf6\\xd93\\x9ae\\x86\\xdc\\xb0 ~\\xa9\\xf9/\\xe7\\xe9'\\x02\\xa7sf\\x9d\\xdb\\x9c\\x19ny\\x11t\\xe6\\x07$\\xad\\xeenykt\\xd9\\x0c\\x8d\\x1d\\xcb\\xf6'c\\x00\\xfa\\xbfm\\x82\\x08\\xb1`1\\x880\\x18\\x10\\xe1\\xf4\\x9a\\xc80\\xf4c?w\\x07\\x06\\x076\\x90\\xd3]s)7\\x0f\\x8a6e\\xa8\\xcdz\\x98\\xe7xce\\xde\\x85\\xbby6`\\xf5a\\xb1b\\xe0\\x00\\x97\\xa9\\xdet\\x93\\xf9\\x92\\x8dt\\x84\\x88\\xb1\\x15tm\"!]\\x18\\xaaf{\r\\x14\\xd9\\xd6\\x84u\\x96s\\xc0i*d\\xe5\r\\x02%\\xd3\\xe5\\x03.\\xf7\\xaf\\xa6\\xff\\x17n\\x93j\\xf4\\xb0\\xf4y#\\x93$ej\\xcc@\\x18\\xb5f\\xfc,\\xa3\\xcc\\x81\\xea\\xbc~v%\\xdf3g\n\\x97\\x9f\\xa7\\xee(\\xc8\\x05\\x86\\x9f\\xc6\\xfc\\xcd\\xf1\\x00z\\\\xdfj\\xb3f\\xcd\\x08\\xf5\\x91\\xc1\\x84\\x18\\xb5:\\xa8\\xf4b"
  442. },
  443. {
  444. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafl\\x08*\\xd9i'\\xa6a\\x96\\xcc\\x0e{\\xde\\x1d\\x1d\\x9b\\xac\\xf3\\x87\\xdco\\x02;\\xe60\\xee\\xebz\\x9b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  445. },
  446. {
  447. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafli\\xd1\\xd3\\x0f\\x84s\\xaa\"\\\\xdb\\x83\\xe3\\xfam\"\\x06(\"\\xd5'\\xf9\\xd2\r\\x8b\\xb8/\\xb7\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  448. },
  449. {
  450. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\r0\\x15f\\xa1\\xd6^w\\xd9<f\\x0e\\xa8\\xcb\\x12\\xda\\xb2\\xc0\\xf2\\xd5|t\\xfb\\xbf^\\xf0\\xcbv#\\xde\\xc3\\xd4w\\xbb\\x18\\xb0\\x8b\\x18\\x9f\\xc4\\xae \\x01\\xc0\\x8e\\x17\\xd2ao\\x8f\\x99=\\xc9\\xa8\\x1c\\x98\\xee\\xa1\\x13\\x13\\xa2\\xf6rt\\x1e4f\\xd0r~\\xa4\\xa3\\xf1:>f\\xf2\\xfc\\xfc\\xa4\\xa2\\xdac\\xa58{\\xa6\\x9fck\\x02t\\x90\\x02xyk3q\\x82\\x08\\xc8\\x86\\xb2\\xf5(\\x90[k[:\\xf6\\x18\\x0c\\xb0\\xecth\\x15\\xa5\\xcdd\\xbb\\xcc'=\\xf4\\xdc\\xe7u\n\\x1f\\xb6n\\xa0\\x8a\\x92u\\xe3\\xb6\\xd1ru\\xafv\\xc5\\xb0\\xfe\\x99\\xf8\\x04:\\x92\\x90\\x19\\x94\\xacz\\xe6,,z\\xe8\\x99\\xb04\\x17_n\\x87\\xef\t\\xcd\\x84n\"\\xa2\\xdd'w\rh\\x7f4[y\\xde.d6\\xd2\\xf8\\x95$]\\x91\\xee\\xde\\x89\\x08=\\xba\\xa7\\xf9f\\xfe/\\x89\\xda\\xd3\\x9c!\\xed\\xd2.\\x1ank\\xe6r i#\\xa7b\\xbd\\x97\\xae\\xb7\\x1d\\x86\\x07.\n\\xaf\\xde\\xb0y\\xc4\\xd9\\xc0\\xa1l\\xb3\\x05\\xa4\\xf0\\xa2\\xd5q\\x10"
  451. },
  452. {
  453. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfa\\xe4\\xae\\xda-\\xeb\\x05q\\xbc\\xf6\\x1b\\x9d\\x85\\xca\\x8f\\xc7\\xa9\\x10\\xce5\\x95d\\x1b\\xd6;\\x89\\xcf\\xc7\"\\x9fq\\x8f\\xa6\\x9b\tt\\xef\\x1f\\x8e\r}s\\xaab)\\x00\\xaeq\\x94\\x96x'\\x00s,\\x9e\\x8d\\xddu\\x90vh\\x9c\\x13m\\xf8\\x19\\x95i;[\\xb4]\\xd1\\xb9\\x84c\\x08\\xddibh\\xcc\\xe1x\t\\xfe\\xf5\\xf3,71s\\x97\\x0c\\xfd\\xe1\\xc8\\x98\\x9b\\xdcyl\r\\x12h\\x9bq\\xd1\\x03e\\xd9\\xc2|\\xa7\\x97\\xd0c\\xeana:\\x1c\\x0b\\xa4\\xe9\\xffo\\xe1\\xe6c\\xa4\\x1elf%a\\x1e\\x132g\\xbc\\x82\\xa1\t\\x19q\\x11q\\xb6\\x8d\\xe1\\x00>\\x06\\xe4\\x85\\x90<\\x07q\\xdde\\xed\\xf703\\x96efe7)\\xda.\r\\xae\\xba\\xb7\\x02:m\\xdf\\xf5\\xa7*\\xd2i\r>\\x9e\\xb9\\x00\\x91\tb\\xbe\\x98 \\xd9\\x19)\\xffb\\x81\\xc8u|a&\\xe0\\x1a\\xa2{\\xb8\\xe8\\xef)h\\x10\\x872\\x10\\x7f\\x04\\x9a\\xaa6a;\\xfan\\xae\\x8f&4\\x856\\x938\\xfahs\\xeaa7\\x13|\\xefyy"
  454. },
  455. {
  456. "http_request": "winword.exe_WSASend_\\xa6\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04m\\xd4e\\xc0[\\xe3k,f\\xe0.g\\x06\\x93\\xe2$\\xd5f\\x0c\\x1e\\xac\\x8d\\xf9n\\x88\\x02\\x93\\x0f/z~\\xd0\\xba\\x9f\n/b\\xdc\\x13\\x03\\x14\\xfbwt\\x9e\\xa9|\\xb4\\xa3\\xba\\xa8\\xe69t\\xa2\\xf0\\xe2\\xe8\\x9d\\xfa\\xe8\\xd8\n\\x89\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf8\\xc8\\xdew\\x11\\xebbc\\xd6\\xe7\\xfe\\xab\\xcd\\xa7ekoh\\x83\\x9b\\x04#\\xfc\\x9e\\x08\\xa3=\\xecq\"\\x80lgab\\xac\\xbfw\\xf4i\\xfd\\xcd\\xeam\\x03\\x0e\\xbd\\x97"
  457. },
  458. {
  459. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010q%\\xf1b\\x0b\\xc2d\\xe6\\x01\\x16\\x14\\x98xv\\x8e\\xb6\\x1c\\x8d\\x99;\\x18\\xad\\xfa\\xe4 b\\xd2\\xf0\\xd0x1>a5\\xaf\\xe9\\xed\\xcb\\xd7\\xec3\\xd7\\xef\\x04\\xed\\xbc\\x86\\xb0\\xa7\\xeb\\x06\\xb7\\x03\\xc8\\xe1f\\xad\\xf5\\x98r\\xa4l\\xae\\xdds\\x03sr\\xcd\\xbc\\xdey\\xdb\\x1a\\x8a\\xf2\\xad\\x94\\x95\\x9c\\xe7\\x17ph\\xae\\x9e\\xbb\\xcb\\x86\\xee6,\\x90\\x1af\\xcb\\xb4\\xad\\xd79\\x12\\x123\\x82\\xaa\\xb5\\xc1\\xf1\\xd5l\\xc3\\x00\\x9dk\\xbc\\x0b\\xaf1\\xa8\\x16\\xfd\\xc6\\x19|i{\\xa5\\xf9wc\\xaf\\x18yb'ib75\\xa0%\\xe8\\x83\\xc2e\\x8bn\\xd0c\\x05\\x80\\xf7\n\\xa1\\xc0d<\\xf4n\\xa74\\x98b\\xcd\\x1a?&\\xbe\\xb5m\\x1a\\x97#?b>\\xa2\\xc3,\\xecy\rua=a(\\xa2\\xfc3\\x9fg\\xd1\\xcb\\xa0\\xe3\r\\xc8)\\x1f|\\x81\\xff\\xa0\\xb1\\x98\\x17\\xfc\\xb1\\xb2x\\xcb\\xb3\\x8a\\xbc^\\x19y$u\\x97e\\x95\\x9b}z1\\x87\\xb9\\x1en\\x9au6\\xdf\\xa3\\xce\\xd9c\"\\x81x\\x0f\\xfd\\xba\\x02ya\\xbc%\\xdb"
  460. },
  461. {
  462. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010mk3\\x84\\xa8\\x14hg\\xa6\\x8d\\x17\\xf8z\\x1d\\x10\\x12\\xd5\\xf5\\x8b\\x85\\xe0\\x08cw5u\\xef\\xe8.\\xe6\\x89\\xb7\\x1a}\\x9ad\\x8d\\xcb8\\xd0\\xb9\\xb1\\xf6\\xb4\\xf5w(\\x02\\xa8i\\x9e\\xa4r\\xe2&\\xd5\\xd5\\x93x\\xad\\x9c\\xd6\\xb0\\x90\\x02\\xa9\\x1b\\xf6\\x8e\\x16\\x97t\\xe1\\x9b5\\x13i\\xde\"mp-\\x85n\\xc79\t\\x9e=\\xd1\\x08\\x96\\xade \\xa2x\\xae@\\x1d\\x8d\\x0fy\\x15d\\x0bg\\xc6hz\\xce%ltgtj\\x9b\\x0b\\xd1\\xc80\\x9e-\\xe4\\xa8\\x1c,5\\x0ep ,%\\xbd\\x91\\x976\\xe3\\xa4y\\x97yz\\xcb9\\xca\\x13\\x93q\\xd30\\x9ad\\xd2\\x01f\\x84\\xe7\\xcc\\xd8\\xbe>\\xebt\\x7f\\xb9\\x92\\xa4=\\xfc\\x1d^fw)3a\\x82\\x81\\xdbe\\xef\\xa7\\x8dpz\\x8e\\x8b\\xaf\\x9c\\x9a\\x89o\\xecf\\x1e6\\xd63l\\xca\\x14&\\x88\\xd7_a\\x1d\\xaf\\xb69\\xdd\\x1b8k\\xe1\\x12\\x99c\\x17\\x06\\x96\\x18\\x19\\xdd\\xc5\\xb4f\\xc1f\\xbd\\xdb\\xff\\x8d\\x84\\xdbs\\x86\\xfc\\x0b\\xaf\\xd9\\x8a\\x1d\\xdc\\x18;\\x8ff\\xfb"
  463. },
  464. {
  465. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x82koo\\xc3\\xbb$\\x87\\xa2\\x0f\\x0f{\\x99\\xd9#7a:\\x84\\x83\\xff\\xb02\\x14\\x7fm$\\xe2\\x19\\x11t7\\x11\\x15tp\\xa5\\xa2\\xd6\\xf3\\x19n\\x86/\\xc8\\xf7\\x7f~dq$z\\xd6u\n\t\\xb5\\xbd\\xf2n\\x8ao\\xbbc6\\x1f\\x9b\\xddwc\\xd9\\xc1`\\x00\\x1fkk\\xd6!\\xae\\x16\\xd2\\x83t~\\xa2\\x13\\x08<|:\\xee\\xc3\\x8e\\x98ay\\xbe\\xf8\\xc3r*\\x8ap9\\xb8\\xffxh!\\xc7)\"n\\xc7\\xc0\\x00\\x88\\xb1\\x9f\\xca#b\\xc5a\r\\x9b\\x8e\\x08bbg\\xdc\\xf9|\\x0c\\xc63\\xb7\\x04!\\xd1fx\\xfb\\xdd<5\\x18\\x84ua\\xd4\\x82\\xb1\\xd8j\\xc4\\xf8\\xe6j:\\x00c\\xe4j\\xd4\\xb5,\\xa5\\xf9\\x9e,9z%\\xc3\\x9fv\\xc6k\\xef\\xe3\\x9b\\xe20\\xa6<\\xdfy\\x93g\\xcf\\x8f\\xce\n\ryhnpk\\xe2%\\xbf\\xdb\\xe4z\\xe9\\x01\\x82a\\xc5\\x18\\x1ca\\xc3\\x82\\x0f\\xa8\\xce\\xd2\\xb4\\xca9\\xbe\\xf4\\xfd\\xca5\\x03\\xf2m\\xb7t\\xb0\\xadxol\\x16\\xcb\\x15,\\x03sp|\\x1d`:"
  466. },
  467. {
  468. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc7\\x82:%\\x1cwq\\xe4|\\xc7\\x0b\\xd5b\\xa5\\xd7\\xf2\\xfb\\xb9;j#\\x9aj\\x12>\\x99\\xe4;\\x08\\xed\\x99b\\x1fha^js\\x8a\\x1a\\xb2\\xdd,\\xa6\\xf4\\xb1b\\xc1\\xf2\\x1a\\xccf1\\x0b\\x8d\\x85u\\xd6\\x07\\xb8(\\x021\\xef\\xee\\xa9z\\xdf\\xda\\x80\\x87\\xd0\\xc9\\x16\\xcc!\\xb0\\xe3n\\x04\\xf2ssp\\xa1\\x0f\\xe5\\xfc\\x8f\\xee\\x93yn2i\\xab\\xcf\\xc7pr\\xb8q\\xaec\\x94u\\xf6\\x99\\xd3\\xcd\\xf8\\x91\\x81\\xe9\\xbb+\\xdb\\xce0\\xfb\\xd8j\\xef\\x8e~\\x13\\xf4\\x18\\xe2\\x08\\x8b\\x08%\\x0cw\\xd0:\\x0b-h\\xc5\\x8b\\xb9\\xf5\\x0eq\\xfdb\\xfb\\x9c=\\xf4\\xe8\\xe6\\xe7\\xb3\\x04\\xb1\\xcb\\xe5.\\xe2\\xbeh\\x96\\x80\\xb5\\xdf\\xd8\\x98\\x9cb!z\\xca\\xe7\\x98\\x95\\x1c\\x14\\xac\\xc5\\x1c\\xfe\\xd45\\x9cb\\xe9\\x06\\x1fp/\\xe3_:k\\xfc\\xb7\\xece\\xf1\\xf5 vp\\xb8\\xc65\\xb5\\x10?~\\xd60\\x06o\\x1e\\xdbt\\x1a\\x8a\\xacs\\x0f}/\\xa07\\xd8\\x97\\xad\\x00u\\xc8no\\x18\\xc0}:\\xa1\\x16\\\\xe0\\xb6a\\xd1\\xc0\\x9d\\xce"
  469. },
  470. {
  471. "http_request": "winword.exe_WSASend_\\xce\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04[\\xccz\\x14\\xcb/f\\xefmb_\\x9aqs\\xa9d\\xbc\\xe0\\x8b\\xb1\\xb5\\xd7\\xd5\\xc9\\xdf\\xd9\\xc0zp\\x8f\\xb4\\x9btj_\\x8b\\xc2|\\xae\\xb8a\\xf1,\\xe1\n\\xedb\\xc90\\xbe\\xe6\\xe8\\xc3\\x98s\\xba/|\\x19\\xfdo\\xc35h\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x18\\xe4\\xd8\\xf7\\x89\\xc0\\xab\\xbe\\xe7\\xa6\\x9a\\x8fw\\x9au\\x18\\xb9\\xea\\xf4u\\xdd\\xfbj7\\xc9\\x90u\\xce\\xe5\\x8a\\xc3\\xa0\\xa6\\xbe\\xf7\tyrh\\x9a.\\xda\\x1e,\\x0bzt\\xd4"
  472. },
  473. {
  474. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9b\\xb2\\x97o\\xa9s4\\x7f\\xab<\\xe6\\x02lk\\xc7\\x1ehh\\x98&\\x1c\\x1e\\x1e\\x89'r\\xd9b\\xd3z\\xacf\\xec8\\x8b\\xe6`p\\x0c\\xba>\\xa3\\xcb\\x88\\xe2\\xe2#\\xbc\\x81\\xbasqf<\\x1c\\x83i\\x1ai\\xea\\xf6e\\xc1e\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0004e\\xda\\x9c8\\xed\\xfc\\x9a\\xc68\\xb5\\xfd\\xc7.d\\xb5\\xa78\\xef\\xe3\\x87\\xe5\\xd4\\x1a\\xe2\\x19\\xc7\\x0c\\xecs\\x7f\\xf6\\xadn\\xdca,^\\x83\t\\xcat\\x04\\xed\\x93/\\x91\\x18"
  475. },
  476. {
  477. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04^\\xb3\\x04mkev\\xf8\\xdd\\x9d]g\\xa7\\xc9\\xb0\\x84f\\xd6\\x14;\\x07b\\xc5\\xd6\\xf4\\xf4\\xbee\\x9db\\xfb\\xec\\xd3boe\\x91\\xceo\\x88\\xe4\\x04\\xe3\\xfd\\xc8a\\x86\\xd7\\x84\\x11*\\xd04\\xd3\\x9al\\x9e\\x81\\x96l\\x8e\\x9b\\xce\\xcd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\t\\xa2(\\xb9\\xb5b_\\x8b\\x96\\xe8\\x02\tx\\xa5gb-d\\x98\\xd5\\x0b\\x9fp\\xb7r\\x7f\\xf0\\x16\t\\xd2\\xb1x\\xa9\\xee\\xa3\\x8ag8v\\x8a\\xdd\\xb4\\x8c\\x9b#\\x04\\xe3/"
  478. },
  479. {
  480. "http_request": "winword.exe_WSASend_\\xce\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x02\\x04\\x039\\xcf\\xd5b\\x9bw\\x93b\\x0c[[e\\xdd^\\x9e\\xddt\\x11\\xd0\\x16\\xf7onit\\xcf\\x95\\xf2\\xf1t6n\\xd8u\\xd9\\xb5\\x88\\x9bd\\x1a\\xed\\x15\\x87z\\x15\\xe2p\\xf5\\xbe+e\\x01\\x86t;\\xdb\\xcd<\\xb9\\xd4\\x84\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000z^\\xf8\\xa3\\xba\\x19\\xd7\\x03\\x0c2&\\x16\\xe0\\xbc\\x80a\\x80j\\xd8lq#\\xb1\\x13\\xa0\\x0b\\x11n\\xf9\\xd8+v\\xc9s\\xb5\\x0bq\\x14a\\xd1\\x91\\xc7ia\\xfe\\x84\\xed\\xb3"
  481. },
  482. {
  483. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04f\\xaf\\xe3\\xf3\\xd3{jgi#hwh\\xcf\\x83\\x06\\xe9\\xf0k\\xdan%\\x1a\\xd4\\x84\\xe7\\x8e\\x7f\\x19\\xb3\\xfc\\x012s\\xec\\x93\\xfc\\xba\\xbf\\xfe\n\\xd1*\\xbf\\xf06\\xdb\\xc0\\x19\\x18\\xa4\\xe5\\xc3\\xbf\\x9d6\\x81\\xf2\\xc2\\xcc\\xdc\\xf4\\xe0\\xd6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000nn>\\xf6\\x06\\xe0\\xe1\\x99\\xdd\\xf7j6\\x99\\x9c\\xe8ch\\xad\\x84\\xce\\xb8llkk\\x1fo\\xc4\\x9dyj\\x04\\xd8\\xb1x\\xe2i~%\\xe0%\\xfe\\xe0\\x84\\x17\\xfb\\x1c\\xd8"
  484. },
  485. {
  486. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcd\\x9fr\\xb6\\xbei\\xe6\\x118\\x90\\xab\\x83\\x03\\x8c\\x19\\xe9\\xfc\\xd9\\xc8\\x96\\x90/i\\xbekk\\xc2\\xad\\xe9\\xdb\\xb3$),g\\xe9jx\\xf3vp%\\x89\\x7fg\\x13\\x07\\x7f\\x06w\\xf9\\xfb\\x19\\xf9\\x96\\x05\\x99s\\xbf\\xad\\xc6@\\xf5]z2\\xa4\\xd0r\\x98%\\x90bc\\xd7\\x11kq\\xf3t\\x8cwh\\xbb\\xdd\\xbd\\x0e\\xe8\\x8bs\\xc4\\x9b\\xa6\\x95-\\xe6\\x02\\xd22\\xfc}\\xff\\xb9\\xb5c\\x16k<\\xfd\\x0e\\xe2o:\\xae\\xd1\\xf9\\xc0c\\x84pt\\xa8*za\\x87=\\xeb\\xf7\\xc4&\\xa2\\x8f6nkbm\\x06\\x8f\\xec\\xeb\\xeaft\\x92\\x8dw\r\\xcch\\x8f\\x13\\x06\\x11c\\xb8\\xa8\\xa4?;\\x1f\\x9fq\\x8d\\xd6\\x8er\\x8f\\xcc\\xa9\\x9f\"\\x97t\\x16\\x81ofc\\x00\\xf2\\x90\\xe5\\xf7\\x1eb\\xec\\xfa\\xedlq\\x99^\\xb7h\\xe8\\xda({\\xe0\\xf3\\x8e,\\xba\\x14\\x11c\\x96c\\x8e\\xb2\\xab^\\xab\\xe9\\x81\\x84\\x0b\\xbcg\\xa7\\x84\\x80t|\\x06\\xe9\\x082sh\\x98\\xd0&\\xf0n)f\\xbf\\x10!v\\x01i\\x19\\xfc4\\x99\\xcec"
  487. },
  488. {
  489. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa9u3(?\\xf4\\xba`c\\xfd\\xfc\\xe2(2r\\xb86|g\\xd1mv\\x10}\\xe7\\x16\\xba\\xf8\\xcf\\xad\\x0cgv\\x0co\\xd2\\xfd<\\x97g\\x1f\\xe9\\xa9peh\\x83e\\xb3$_n\\x91\\xa01\\x84j\\xe6\\xa0a\\x04\\\\xa0\\x9b\\x8c,\\xcb\\xb8\\x9b\\xe4<c\\xab\\x81\\xea\\x0f\\xa4\\x8a>\\xe3@\\xf9\\xdf\\xae\\xc4\\xc1\\x1b1g\\xa4%d\\x01\\xf0\\x869ulgh\\x07\\x8ay\\xb3\\xbe\\x07\\x19\\x92b\\x99\\x89\tpv\\x8c\\xd0\\xc8\\x1ck\\x13\\xf1\\x95.\r\\\\x00\\xe4'\\xc51\\xa1k@\\x81\\xdc\\x14l\\xfc\\xd9\\x10\\xfb\\xc3\\xcf\\xec\\xba\\xd0\\xf4\\xf4\\x85\\xae\\xe9\\x8b\\x12\\x8e7,\n\\xe2\\x0b\\xc1a\\x02\\xaf\\xee\\xbc\\x98\\xe4\\x12+\\xe0\\xe8\\xdc\\xb3\\xfc\\xb4zz\\xa7\\x9c\\xd7\\xeeg\\x159v\\xc6luf\\xb9\\xbf1i;_\\x8fw\\x80?\\xec\\xa2d\\xe3\\x11\\xc66\\xb5\\x1ak72\\xe4\\xef\\xf6\\x8c\\xa1\"!7\\x03\\x998\\x1dl\\xe7^\\x9dk\\x03\\xf5\\x10\\x8e\\xb3\\x8e\\x1e;\\xe3\\x8dnsi!#\\x05\\x88\\x085#\\xf51\\xe9"
  490. },
  491. {
  492. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010!m\\x92o0\\xbe3\\xb7\\x99 k\\xba\\xcfu\\xd0\\x0f6%\\xdf\\xae\\xc8\\xc1\\x1a\\xb0\\x7f\\x83\\x95d\\x11p\\x8a4\\x8c\\xa70\\xf3y\\x9c)y\\x98\\x89\\xa5\\xa5\\x82c\\x1f\\x00\\xa9>\\xa7\\xd0\\x8e&\\x10\\xdbu\\xcb\\xae_\\xf9a}\\xce\\xa9_`\\x08k,\\x91|kfj9\\xe9\\x1a\\x8b|\\xc3\\xdc\\xad\\xd6\\xa1\\x80\\xe9\\xb2y}\\xb5\\x8c5g\\x87\\x9b\\xf8y\\xc7gr\\xc3\\x8a\\x9e\\xff=\\xf6\\xb6\\x18\\xc7\\x1a\\xdc\\xb6\\x9f.\\x9d\\x0c\\x1fl\\xd8\\x00]5b\\xe0f\\xd1\\x98\\x0bme\\x0e\\x1b\\x8c4 \\xa3q q\\xaf\\xb4\\x05\\x1d\\xa7\\x01\\xbfk\\x9b\\xa2\\xb3>\\xc1<+\\x07\\xa2\\x8b\\x91\\xade\\xebg\\x1cs\\x97\\xeb\\xa0i\\xd9\\xb6\\x7f\\xbf\\x81\\x17\\x8a\\x16\\xea\\xed\\xb2\\xa7\\x12\\x98\\xf9h9\\xe5tb\\xd3\\xf0\\x99\\x85b3n\\x13\\xe2c\\x97\\xa39\\x1a\\xac' g\\xd8tn2\\x0b_\\x1cw\\xa5\\x17\\xdb\\xc0\\xa0l\\xaa\\xe4\\x1a\\x96.\\xda\\x127\\x96ue\\xda\\xb5k\\x83\\xccnuj\\x87\\xf1\\xf0\\x1e5t\\x9a\\x01\\xbe\\xab\\xcf"
  493. },
  494. {
  495. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010zp\\xc7\\xb2^\\xe7\\xa2\\x93\\x00h\\x8a\\xe8\\xb7\\xcf\\xfe\\x80#l\\xcf\\x17\\x91\\x14k\\xd9~\\xbcukn\\xd8\\xf6f\\x1ap\\x13\\xd5\\xdc\\x8a\\xf6w\\xd8\\x0e\\xef\\xda\r\\xac\\xd2e\\xf0]'\\x08\\xba'\\xc2\\x7f^~dl\\x82g:%\\xe6\\xaai\\xcc\\xfdu\\xea\\xab\\xc7qu\\x1e\\xaf\\xd16\\xd3\\xdb\\xaf\\x19\\xc8\\xf1p\\x152a^\\xba\\xdc\\xec\\x12\\xdcyt\\xf8\\x0c\\x7f\\x81\\xbc\\x05e\\xe1\\xd9h]\\xcb\\x0f\t\\x8av\\x17\\xf7%h\\xa3\\xc2(\\x8b\\xd1\\xe5-\\xf1c\\xd3\\x84\\xb3\\xeb\\x90\n\\x17\\xc2;l\\xf5\\xdf\\x8c\\xd8\\xa8:y\\xc0^^\\x95\\xe4j\\xe7q\\x0copi\\xb1j\\xc2u\\xf0\\x91lx\\xc2\\x9b5rm$\\xf7\\xf2\\xd2h\\xe7b\\xf12y\\xbas\\xb5m\\x8d\\xc8r\\xd13\\x91a\\xf3\\xfc!\\xd3t\\x7f\\x15?\\xb4\\xfe\\xa3\\x15p.\\xb6pt\\xa1\\xday\\xdb\\xde\\xee\\xeb\r\\xe1>\\x1b\\xb4az\\xed\\xe2\\x04\\x0c0c-zj\\x8f\\x8f0y]\\xectt\\xf08\\xa7s\\x03=i3\\xa2\\xc5\\xe6\\xbf\\xbey"
  496. },
  497. {
  498. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010+\\xa4k4<\\xe2b\\xc9'\\xad\\x8fgpa\\xac\\xb3=\\xd6\\x16\\xdajrx\r\\x13\\xf2\\x9ey\\x8bm\\xcd\\x1eq\\xa8\"naf\n\\x8c\\x11\\xd6\\x87\\xa9\\xe9\\xae\\xad\\x0e\\x8c}/g\\x02r7c\\x8b\\x8e\\xf4\\xc2\\xc2}\\xdc:\\xae\\x08o\\xe3\\xc2\\xc6k\\xb6\\xd4\\xef\\x01k\\x7f\\x81\\xbe\\x06#\\xa3\\xe1\\xb2\\xcd|g\\x8b\\xed\\x8f\\xe5\\xf3m^\\x83ih-\\xc8\\xae\\xfdr\n\\xf2\\xcb\\x01\r\\x92\\xab\\xb3-y\\xb1\\x08h\\xc2\\x8d[a?\\xf4\\xc3w\\xef\\x98x\\xd5\\xeex\\xc3m$6{(\\xa9\\xa8\\xd7\\x8f!\\xb8\t\\x9a\\x845\\x88$\\x81\\xa6\\x058#8u\\x02\\xe7'\\xee\\xf2\\xb9-\\xb3\\x19\\xb8\\xb7\\x95\\xa7xu\\xbd]\\xa2\\x8e\\x18\\x131'\\xdb\\x8f\\xe7\\x90\\xeb\\xd5\\xc5\\xea\\x06\\xf3\\x9a\\xda\\xa7\\xafw\\x8f\\xef\\xb5,\\\\x12\\x04\\xeaj%\\xbe\\xb00\\xd3u\\xfc\\xd1\\xc8(\\xf1=\\x10\\xa7$\\xbe%b\\xee\\x12\rl\t\\x90\\x151\\x18!\\x1d\\x00\\xac\\xae\\xfbq\\xc1x/\\x86\\x97\\xe8\\xaf\\xaf\\xe0\\x85\\xda\\xa4\\xcc\\x185\\xe7"
  499. },
  500. {
  501. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x81f\\xe0\\xb6a\\xe4eg\\xf3\\xcc\\xf6-\\xeb\\x81\\x90\\x9d\\x99\\x14\\x1e\\xc9e\\xf8\\xef\\xdf\\xec\\x9a\\xd2\\xad*\\xfe\\xa8\\xd7\\xfc}w\\xb8t<kw2\\xea\\xd6 c]*\\xf9\\xd1\\xa3\\xbc6\"rn\\xebn\\xb7jvo\\x9ez\\x8c\\xe4\\xcc\\xd6\\xdb'\\xf0\\x16\\x1b\r\\x00\\xce\\xd0\\x9d\\x1fe\\xfe\\xa6\\x85u\\x9d\\x05o\\xca\\xed\\xa60*\\x0e\\x18\\x82\\xfd_\\xb5\\xe1\\xf5,\\xb4a\\xa6_\\x8f\\xbf~\\x92d\\x01/\\xf4\\x072@\\xbe]\\xbf\\xb9\\xfec;ef\\xdfk\\x7f\\xc9\\xd2\\xb1o|\\xdd`h\\xb2@\\xc3\\x7f\\xb8^\\x80</\\x94\\xdc\\x89\\xd6\\xe0q\\x94\\xd4\n\\x8e-t\\x88o\\x9e\th\\xe1?\\xd5(\\x05\\xdb-)\\x96\\xa3\\x8a\\x92\\xf4\\x0e\\x85\\x8cg\\xf3f\\xb1\\xe6j\\xc7fr\\xfd3\\xc3\\x9d\\x8d\\xb83m\\xb7\\xcf\\xfb\\xca\\xb6\\xf8\\x97q\\xb6+\\xab#\\x8e5\\xe4n\\x19vhf7r\\xe5\\x15\\xd1\\x9d\\xd1\\xbc%\\xa3h\\xfai\\x07l\\x8d\\xdcli\\x86d0\\xcb\\xd6~c]\\xed\\xe4?\\xe6\\x07\\xf0\\x9b\\xf5#q"
  502. },
  503. {
  504. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x01\\xafm\\x08am\\xae`_\\xd0\\xe3)\\xdc\\xcf\\xffg\\x86k\\xe9\\x8a\\x8f\\xeb\\xdc\\x0bt7\\x9b\\x078e\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  505. },
  506. {
  507. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x95\\x00vo\\x99\\x7f\\xb9\\xcc\\xc2g\\xa7\\x1f4\\x85&\\x08y7\\xfdepl\\x19\\x83e\\x96\\xac\\xdf\\x10\\xa2<l^\\xdd1w\\xb9\\xc5\\x92\\x03`#\\x14\\xd3vfj>\\xba\\xe0\\x7f\\x19\\x17\\x14p\\xf5b\\x0es\\x1b\\xda\\xecbb\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000{\\xdd\\xe6g\\xb0\\x89\\x90,\\xc68@\\xa6\\x84\r\\x0cq\\xc5\\x14\\xc6a\\xe6\\x05\r\\xc2\\x06\\xfe\\xff\\xcdx\\xccxm\\xce\\xd2\\xc7\\xdef\\x01\"\\xd5\\xd4#hrf\\xaf\\xe0\\xb3"
  508. },
  509. {
  510. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  511. },
  512. {
  513. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc2>\\xf3\\xa4\\xc3\\x86\\xc7\\xb1\\xbf\\xeev\\xbb\\xac\\xd8q\\xc6\\xe4-\\x1f\\xa4\\xfc__\\x1e~q\\x12\\xaf\\xe9\\xc1i\\x03\\x95n\\xc7;\\xc6wd\\xd7\\x91\\x1c\\xf5\\xde)\\xd0\\xa5\\xe9r\\x1d[>\\xae\\xf8\\x8f\\x88\\xc1a2\\xac\\xa8\\xfb\\x0e\\xa5t\\x9c\\x1c{\\x9c\\xbbq\\xc0\\xc0\\xc8\\x17:\\x8b\\x8a>\\xf4\\xd1je\\xed\\x8b\\xff\\xffx\\xc3k\\xd0\\xa3!\\x87\\x9e\\xb5\\x1f\\x14\\xcf&\\xe9g\\x1c\\x16\\xaeg\\x1b\\xf1\\x9e\\xb2p}\\x06\\xf8\\x18'?\\x01\\xcb\\x8c\\x8fm\\x0e\\xb13\r\\xf1\\xe2\\xc5\\\\xb6\\x086\\xa3\\x90\\x8f\\xfc\\x1c\\x8efj\\xe7\\xbb\\xbd\\xf9j$\\xd7\\x9a\\xbe0\\xa6~\\xa0\\xfe\\xb9#\\xaa9\\xd7v\\xba\\xe6\\xd9\\xb5\\x82\\xb4\\x7f\\xa0\\xab>\\x18\\x83\\x8dd\\xcf\\x98z&\\xc8\\x1a\\xc5\\x05trr_\\x85\\xc2ck\\x97\\x18h@\\x14h\\xca,g\\xef\\x82\\xb5\\xfdh\\xb6\\x87@\\x03\\xaaid\\xc4\\xebg\\xc71\\x0e\\x80\\xd3\\xb2\\x8d\\xcf\\xc2*\\xab\\xdf]s\\xb1\\xdem\\xb6h\\x00\\x05\\xcb:\\xfczf\\xd9\\x14{m0\\xdb\\xbe\\xadi\\x8b"
  514. },
  515. {
  516. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x01\\xaft]\\x13\\x86\\x8f\\xe22\\xc7\\x08\\x1a\\x16q\\xa7\\x18\\xbb%\n:#\\xd3gb\\x8f\\xacc\\x88c\\x85\\xfb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  517. },
  518. {
  519. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00:\\x92,\\x88\\xb9\\xc4\\x8c\t<\\x16\\xfb\\xac\\xb3\t\\xf1>v=\\xc2\\xb1\\xbe`_\\x96\\xbd\\x9c\\xab\\xff\\xa0:m\\x85\\xa2\\x06p\\x16\\xb4\\x15\\x1b\\xc8p\"\\x14b\\xdf\\xf28\\xa2\\xd4\\xa1\\xef.\\x9c!\n\\xe8\\\\xfbs\n\\x1b\\xa0v\\x9cl\\x867\\xdcx^\\x90\\x12\\xcc.-\\xd0\\xe0\\xe6\\xads\\xe2h\\xa8\\xab\\x19\\xe1\\xe3\\x03zr\\xd3\\xb4\\xf5\\xec\\xd5\\xb1\\xe4\\xec(\\x89in\\xa2\\xdff{u\\xe7{\\x1b\\xce1\\x9bw\\xcb\\x15e\r\\xab\\x86\\xc7\\xd1j{f\\x7f\\xd3p\\xae \\xf7\\xedup\\x94\\x9e\\x06qv`\\x87o\\xee\\x881\\xdb\\xd8d\\xe2\\x82yn\t\\x8f(by\\xcc\\xad2n\\x0c\\xfd\\xd6\\xfa\\xd3\\xbc\\x13\n\\xc7}\\xe3\\xe1qg%\\x87e\\x05\\x9d}^\\x8f\\x94\\x9c \\x12% \\x94\\xa2%uz7\\xcb\\x04\\x88\\xcd\\xac\\xbe\\xcd\\xd1\r\\xacex\\x18v\\xd4|\\xbf\\xcac\\x01\\x9f\\x89\\x13\\x14\\xcf\\xb3sr827\\xd2\\xec\\xb8\\xdan&\\xb9\\x8e\\x04nu\\xde\\xea\\x14\\xb1\\x18\\xdd\\xb7`"
  520. },
  521. {
  522. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\xe6!\\x02\\xb1\\xee\\x1a\\xd3\\xcf\\xe0\\x7f\\xaf\\xd8b>\\xdc\\xb1;hh\\xac\\xa4\\xe8\\xd2x\\x9c \\x9cb^i|s\\x0b\\xa4\\x07cx\\xbea\\x17\\xe3|\\xb8|}`\\x05~\\xd4\\xf1\\xb5w\\x11n\\xe4\\x17\\xdb \\xca\\xa9]\\xee\\xac6\\xb4h\\x82\\x17\\x1b\n\\xec\\xdb\\xbd\\x85o\\xa6y\\xc1, py\\xc9\\xccjm7m\\xd1=\\xce\\x00\\x05\\x06\\x83\\x8c\\xa1\\xd1)\\xd9\\xa0\\x82u\\x8cl\\x1c\\xab\\x1e\\xee\\xb9\\xcb\\xd3\\x0f\\xf9|\\x8ch\\xc7q\\xf8\\xf7\\xa0\t?k+n\\xd93+<\\x83iu\\xda\\x0eo\\xf0\\xcbm\\x8c\\xc6yz|t\\x95a\\x90\\xf2\\xdca\\x80\\xad`\\xa9\\xee\\x84aww(s\\x1d\\xae\\xee/[g\\xa2\\x8dx`p\\xc7\\x0c\\xbb\\xbc\\xe3\\x02\\x15-\\xe88&\\xf1}\\xc3\n\\xf3\\x8f7\\x1a\\xcat\\xfac\\x89\\xa6\\xb1\\xbamgh\\x04\\x8f\\x04{\\xf2\\xd2q>\\xf5\\x06\\xb4\\x8e\\xc4\\x02\\x02\\x89y\\x82\\x15\\x82\\x18;\\x12p\\xa1\\x7fx\\x13\\xe2\\xcbt0~\\xa3\\x7f].qz\\x93\\xbeg>\\x1e+\\xe9r"
  523. },
  524. {
  525. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\x15x\\x83_q\\xe8\\xaf=\\x96<\\xff\\xc1y\\x8bez}6\\xb7\\x89\\xf8]>\\x9d\\xa9\\xa6q;\\xc09\\xca\\x9b\\x14#\\xb7>p\\xaa\\xd2\\xbc\\x00f\\xcb'v\\xc5wb\\xa9h\\xa06\\x10\\x10\\xce\\x924\\xaeee9\\xc1d\\xcb|\\x15\\x9c\\xf9\\x08\\xa8\\xaf\\xa5\\xf4\t\\xeb\\xfe\\x7f\\x18\\x03\\xda\\xd4q\\x07\\x89!\\xfa\\xd9r\\xdd\\xe6\\xe7\\xe0q9\\xca\\xf0'k\\xf7\\xbc\\x80j\\xc4ci\\xb4\\xc7\\xe8\\x8c\\xd2\\xee\\xfd\\x08\\xdaz\\x99\\x06\\xa9.o/\\xc1\\x0b\\xdd0?\\xa3\\x08<k\\xc4.\\xa4z\\x11\\xb1\\xc7\\x8e\\xf8`\\xc8\\xbc\\x9c\\xb10!\\xb6\\x93\n\\xaf\\x84w\\xd1 \\xb5h\\x9cxu\\x81\\x07\\x01hbw4\\x7f\\xde\\x04\\xbc\\xf6p>$\\x9b\\xac\\xa8\\x14\\x01\\xc7r\\x92\\xa5p\\xed3c\\xb46\\x05t\\x95\\xfd\\x17:\\xa4dq\\xc01\\x04]\\xcbx\\x077\\x0c\\xe4\\xd5>b\\x08\\xdb\\xd1h\\xbf$\\xf7\\x98\\x1c\\x89\\xa6l\\xa0\\x84\\x92f\\xd4\\xd1\\g\\x94x\\x18\\x95-kl\\xa10\t\\x91g\\x95+\\x7f|\\xc5\\xbcm\\xe6"
  526. },
  527. {
  528. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: wed, 22 may 2019 05:00:43 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  529. }
  530. ]
  531. },
  532. {
  533. "Description": "Creates a hidden or system file",
  534. "Details": [
  535. {
  536. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp"
  537. },
  538. {
  539. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  540. }
  541. ]
  542. },
  543. {
  544. "Description": "File has been identified by 28 Antiviruses on VirusTotal as malicious",
  545. "Details": [
  546. {
  547. "MicroWorld-eScan": "Exploit.CVE-2017-11882.Gen"
  548. },
  549. {
  550. "FireEye": "Exploit.RTF-OLE.Gen"
  551. },
  552. {
  553. "CAT-QuickHeal": "Exp.RTF.Obfus.Gen"
  554. },
  555. {
  556. "McAfee": "Exploit-CVE2017-11882.by"
  557. },
  558. {
  559. "Arcabit": "Exploit.CVE-2017-11882.Gen"
  560. },
  561. {
  562. "Symantec": "Bloodhound.RTF.12"
  563. },
  564. {
  565. "ESET-NOD32": "probably a variant of Win32/Exploit.CVE-2017-11882.C"
  566. },
  567. {
  568. "Avast": "Win32:ShellCode [Expl]"
  569. },
  570. {
  571. "Kaspersky": "HEUR:Exploit.MSOffice.Generic"
  572. },
  573. {
  574. "BitDefender": "Exploit.RTF-OLE.Gen"
  575. },
  576. {
  577. "Ad-Aware": "Exploit.CVE-2017-11882.Gen"
  578. },
  579. {
  580. "Emsisoft": "Exploit.RTF-OLE.Gen (B)"
  581. },
  582. {
  583. "F-Secure": "Exploit:W97M/CVE-2017-0199.B"
  584. },
  585. {
  586. "DrWeb": "Exploit.Rtf.CVE2012-0158"
  587. },
  588. {
  589. "TrendMicro": "HEUR_RTFMALFORM"
  590. },
  591. {
  592. "McAfee-GW-Edition": "Exploit-CVE2017-11882.by"
  593. },
  594. {
  595. "Sophos": "Troj/RtfExp-EQ"
  596. },
  597. {
  598. "Cyren": "CVE-2017-11882.E.gen!Camelot"
  599. },
  600. {
  601. "MAX": "malware (ai score=89)"
  602. },
  603. {
  604. "Microsoft": "Trojan:Script/Foretype.A!ml"
  605. },
  606. {
  607. "AhnLab-V3": "OLE/Cve-2017-11882.Gen"
  608. },
  609. {
  610. "ZoneAlarm": "HEUR:Exploit.MSOffice.Generic"
  611. },
  612. {
  613. "GData": "Exploit.CVE-2017-11882.Gen"
  614. },
  615. {
  616. "ALYac": "Exploit.CVE-2017-11882.Gen"
  617. },
  618. {
  619. "Zoner": "Probably RTFObfuscationD"
  620. },
  621. {
  622. "Ikarus": "Exploit.CVE-2017-11882"
  623. },
  624. {
  625. "AVG": "Win32:ShellCode [Expl]"
  626. },
  627. {
  628. "Qihoo-360": "virus.exp.21711882.d"
  629. }
  630. ]
  631. }
  632. ]
  633.  
  634. [*] Started Service: [
  635. "osppsvc"
  636. ]
  637.  
  638. [*] Executed Commands: []
  639.  
  640. [*] Mutexes: [
  641. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  642. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  643. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  644. "CicLoadWinStaWinSta0",
  645. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  646. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  647. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  648. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}"
  649. ]
  650.  
  651. [*] Modified Files: [
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\Purchase.doc",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\~$rchase.doc",
  654. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{D36C0E0E-A442-4EDF-98F1-7B20DF73710E}.tmp",
  655. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  656. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  657. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  658. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\CabEE4B.tmp",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\TarEE4C.tmp",
  661. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{398D7707-FE55-490F-BFAC-D515EB687BA9}.tmp",
  662. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Purchase.asd",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF86F.tmp",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF870.tmp",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF871.tmp",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF882.tmp",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF883.tmp",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF884.tmp",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF885.tmp",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF895.tmp",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8B6.tmp",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8E5.tmp",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8E7.tmp",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8E6.tmp",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8F8.tmp",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8F9.tmp",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8FA.tmp",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF91A.tmp",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF92B.tmp",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF92E.tmp",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF92C.tmp",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF92D.tmp",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF93F.tmp",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF940.tmp",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF950.tmp",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF961.tmp",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFA0F.tmp",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFA0E.tmp",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFA3F.tmp",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFA4F.tmp",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFA7F.tmp",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFACE.tmp",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFAFE.tmp",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFB2E.tmp",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFB5E.tmp",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFB7E.tmp",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFCB8.tmp",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFDC2.tmp",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFE02.tmp",
  700. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  701. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFEDD.tmp",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFEDE.tmp",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFF0E.tmp",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFF3E.tmp",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFF8D.tmp",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4A.tmp",
  708. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5A.tmp",
  710. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B6.tmp",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B7.tmp",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD175.tmp\\APASixthEditionOfficeOnline.xsl",
  714. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD195.tmp\\mlaseventheditionofficeonline.xsl",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A6.tmp\\content.inf",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1F9.tmp",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD175.tmp\\Content.inf",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD195.tmp\\Content.inf",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1FA.tmp\\content.inf",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C9.tmp",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C9.tmp\\content.inf",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD21A.tmp\\harvardanglia2008officeonline.xsl",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A6.tmp\\Parallax.thmx",
  725. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B8.tmp\\VaryingWidthList.glox",
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1FA.tmp\\Metropolitan.thmx",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C9.tmp\\Frame.thmx",
  728. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD21A.tmp\\Content.inf",
  729. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B8.tmp\\Content.inf",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B8.tmp\\Element design set.dotx",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD329.tmp\\gostname.xsl",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD308.tmp\\turabian.xsl",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B8.tmp\\Content.inf",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD398.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  735. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD349.tmp\\content.inf",
  736. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  737. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD329.tmp\\Content.inf",
  738. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  739. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23A.tmp\\ConvergingText.glox",
  740. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23A.tmp\\Content.inf",
  741. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD349.tmp\\View.thmx",
  742. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD456.tmp\\ieee2006officeonline.xsl",
  743. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AA.tmp\\iso690.xsl",
  744. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD399.tmp\\Equations.dotx",
  745. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD398.tmp\\Content.inf",
  746. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD496.tmp\\HexagonRadial.glox",
  747. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD505.tmp\\content.inf",
  748. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD308.tmp\\Content.inf",
  749. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD505.tmp\\Quotable.thmx",
  750. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4C6.tmp\\CircleProcess.glox",
  751. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD496.tmp\\Content.inf",
  752. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5C5.tmp",
  753. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD399.tmp\\Content.inf",
  754. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4C6.tmp\\Content.inf",
  755. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD456.tmp\\Content.inf",
  756. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B3.tmp\\content.inf",
  757. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B4.tmp\\content.inf",
  758. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD625.tmp\\gosttitle.xsl",
  759. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B3.tmp\\Savon.thmx",
  760. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AA.tmp\\Content.inf",
  761. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD635.tmp\\Badge.thmx",
  762. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B4.tmp\\Wood_Type.thmx",
  763. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F5.tmp\\InterconnectedBlockProcess.glox",
  764. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B2.tmp\\Headlines.thmx",
  765. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD625.tmp\\Content.inf",
  766. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD750.tmp\\BracketList.glox",
  767. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F5.tmp\\Content.inf",
  768. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E2.tmp\\chevronaccent.glox",
  769. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
  770. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD750.tmp\\Content.inf",
  771. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7CE.tmp\\architecture.glox",
  772. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  773. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E9.tmp",
  774. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
  775. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E2.tmp\\Content.inf",
  776. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7CE.tmp\\Content.inf",
  777. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD635.tmp\\Content.inf",
  778. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  779. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  780. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
  781. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  782. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox",
  783. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox",
  784. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
  785. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA70.tmp\\RadialPictureList.glox",
  786. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B2.tmp\\Content.inf",
  787. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA70.tmp\\Content.inf",
  788. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  789. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA91.tmp\\Basis.thmx",
  790. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAFF.tmp\\content.inf",
  791. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox",
  792. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB8D.tmp\\Circuit.thmx",
  793. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAFF.tmp\\Dividend.thmx",
  794. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
  795. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC2A.tmp",
  796. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  797. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  798. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  799. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox",
  800. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB7.tmp",
  801. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
  802. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
  803. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
  804. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
  805. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
  806. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA91.tmp\\content.inf",
  808. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD3.tmp",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCF7.tmp\\Crop.thmx",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE31.tmp",
  812. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE61.tmp",
  814. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB8D.tmp\\content.inf",
  816. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  817. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  818. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457444[[fn=Basis]].thmx",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCF7.tmp\\Content.inf",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF3D.tmp\\Berlin.thmx",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\cab101A.tmp",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1009.tmp",
  823. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD104A.tmp\\Insight design set.dotx",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1200.tmp\\content.inf",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1200.tmp\\Damask.thmx",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1220.tmp\\content.inf",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1251.tmp\\content.inf",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1241.tmp\\content.inf",
  830. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1220.tmp\\Main_Event.thmx",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1241.tmp\\Droplet.thmx",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1251.tmp\\Mesh.thmx",
  834. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD104A.tmp\\Content.inf",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF3D.tmp\\content.inf",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD13AA.tmp\\Feathered.thmx",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1428.tmp\\content.inf",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1428.tmp\\Vapor_Trail.thmx",
  840. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
  841. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
  842. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
  843. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD13AA.tmp\\Content.inf",
  845. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
  846. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
  847. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD160D.tmp\\content.inf",
  849. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD160D.tmp\\Slate.thmx",
  851. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD19D7.tmp\\ThemePictureAccent.glox",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD19D7.tmp\\Content.inf",
  854. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A46.tmp\\sist02.xsl",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A46.tmp\\Content.inf",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A56.tmp\\rings.glox",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A56.tmp\\Content.inf",
  859. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AA5.tmp\\PictureFrame.glox",
  861. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox",
  862. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B14.tmp\\chicago.xsl",
  863. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B15.tmp\\ThemePictureAlternatingAccent.glox",
  864. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B16.tmp\\TabList.glox",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AA5.tmp\\Content.inf",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B26.tmp\\iso690nmerical.xsl",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B14.tmp\\Content.inf",
  868. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B37.tmp\\Banded.thmx",
  869. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B16.tmp\\Content.inf",
  870. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B15.tmp\\Content.inf",
  871. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B26.tmp\\Content.inf",
  872. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  873. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B37.tmp\\content.inf",
  874. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B57.tmp\\pictureorgchart.glox",
  875. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
  876. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
  877. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B57.tmp\\Content.inf",
  878. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  879. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
  880. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D0E.tmp\\ThemePictureGrid.glox",
  881. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  882. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D0E.tmp\\Content.inf",
  883. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  884. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D7C.tmp\\TabbedArc.glox",
  885. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D7C.tmp\\Content.inf",
  886. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFB2C6F5FFD86EB0C7.TMP",
  888. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox",
  889. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2136.tmp\\gb.xsl",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2136.tmp\\Content.inf",
  892. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
  893. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  894. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRD0002.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{D16BAB3A-DFE4-4EB2-8874-46E3D8307E38}.tmp",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp"
  898. ]
  899.  
  900. [*] Deleted Files: [
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\CabEE4B.tmp",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\TarEE4C.tmp",
  903. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  904. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD175.tmp",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD195.tmp",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A6.tmp",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4A.tmp",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B8.tmp",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1FA.tmp",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5A.tmp",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C9.tmp",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD21A.tmp",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B8.tmp",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23A.tmp",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD308.tmp",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD329.tmp",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD349.tmp",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD398.tmp",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD399.tmp",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AA.tmp",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD175.tmp\\APASixthEditionOfficeOnline.xsl",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD195.tmp\\mlaseventheditionofficeonline.xsl",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD496.tmp",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF870.tmp",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD456.tmp",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8F8.tmp",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4C6.tmp",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD505.tmp",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B3.tmp",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B4.tmp",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F5.tmp",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B2.tmp",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD625.tmp",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD635.tmp",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E2.tmp",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD750.tmp",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7CE.tmp",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2B8.tmp\\Element design set.dotx",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFB7E.tmp",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD329.tmp\\gostname.xsl",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8F9.tmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD21A.tmp\\harvardanglia2008officeonline.xsl",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFACE.tmp",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD399.tmp\\Equations.dotx",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD308.tmp\\turabian.xsl",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD349.tmp\\View.thmx",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD3AA.tmp\\iso690.xsl",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF871.tmp",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFA7F.tmp",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFCB8.tmp",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA70.tmp",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF885.tmp",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA91.tmp",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B8.tmp\\VaryingWidthList.glox",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF961.tmp",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD496.tmp\\HexagonRadial.glox",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFA0E.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A6.tmp\\Parallax.thmx",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAFF.tmp",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD23A.tmp\\ConvergingText.glox",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB8D.tmp",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD4C6.tmp\\CircleProcess.glox",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8FA.tmp",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8E5.tmp",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD456.tmp\\ieee2006officeonline.xsl",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF883.tmp",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD625.tmp\\gosttitle.xsl",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD750.tmp\\BracketList.glox",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD635.tmp\\Badge.thmx",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7CE.tmp\\architecture.glox",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF86F.tmp",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8E6.tmp",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFF0E.tmp",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1C9.tmp\\Frame.thmx",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8B6.tmp",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD505.tmp\\Quotable.thmx",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1FA.tmp\\Metropolitan.thmx",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B4.tmp\\Wood_Type.thmx",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFB2E.tmp",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCF7.tmp",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B3.tmp\\Savon.thmx",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFE02.tmp",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFEDE.tmp",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B6.tmp",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFB5E.tmp",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA70.tmp\\RadialPictureList.glox",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD398.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF92E.tmp",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF895.tmp",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5F5.tmp\\InterconnectedBlockProcess.glox",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6E2.tmp\\chevronaccent.glox",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFF8D.tmp",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD5B2.tmp\\Headlines.thmx",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF3D.tmp",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA91.tmp\\Basis.thmx",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFEDD.tmp",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1F9.tmp",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDB8D.tmp\\Circuit.thmx",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD104A.tmp",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\cab2C9.tmp",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1200.tmp",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1220.tmp",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1251.tmp",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1241.tmp",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDCF7.tmp\\Crop.thmx",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1B7.tmp",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDAFF.tmp\\Dividend.thmx",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFF3E.tmp",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD13AA.tmp",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1428.tmp",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1200.tmp\\Damask.thmx",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD104A.tmp\\Insight design set.dotx",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1251.tmp\\Mesh.thmx",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE61.tmp",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8E9.tmp",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\cabC2A.tmp",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1241.tmp\\Droplet.thmx",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1220.tmp\\Main_Event.thmx",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD160D.tmp",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\cabDD3.tmp",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD13AA.tmp\\Feathered.thmx",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDF3D.tmp\\Berlin.thmx",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1428.tmp\\Vapor_Trail.thmx",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\cabCB7.tmp",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\cabE31.tmp",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5C5.tmp",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\cab1009.tmp",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD160D.tmp\\Slate.thmx",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\cab101A.tmp",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD19D7.tmp",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD19D7.tmp\\ThemePictureAccent.glox",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF92C.tmp",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A46.tmp",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A56.tmp",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A46.tmp\\sist02.xsl",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AA5.tmp",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B16.tmp",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B15.tmp",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B14.tmp",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1A56.tmp\\rings.glox",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF8E7.tmp",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B26.tmp",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B37.tmp",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B57.tmp",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B14.tmp\\chicago.xsl",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF940.tmp",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1AA5.tmp\\PictureFrame.glox",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B16.tmp\\TabList.glox",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF884.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFA3F.tmp",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF91A.tmp",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D0E.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B26.tmp\\iso690nmerical.xsl",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B37.tmp\\Banded.thmx",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF92D.tmp",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B15.tmp\\ThemePictureAlternatingAccent.glox",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1B57.tmp\\pictureorgchart.glox",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFAFE.tmp",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D7C.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF93F.tmp",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\cabFA4F.tmp",
  1063. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\AutoRecovery save of Purchase.asd",
  1064. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRD0000.tmp",
  1065. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\~WRL0001.tmp",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D0E.tmp\\ThemePictureGrid.glox",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF950.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD1D7C.tmp\\TabbedArc.glox",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF92B.tmp",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2136.tmp",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD2136.tmp\\gb.xsl",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\cabF882.tmp",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\~WRL0003.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{398D7707-FE55-490F-BFAC-D515EB687BA9}.tmp",
  1075. "C:\\Users\\user\\AppData\\Local\\Temp\\~$rchase.doc"
  1076. ]
  1077.  
  1078. [*] Modified Registry Keys: [
  1079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\abe",
  1080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\4060A7",
  1090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\4060A7\\4060A7",
  1091. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1333. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\4060A7\\621078",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1400. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1401. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1402. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Toolbars\\Settings\\Microsoft Word",
  1404. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109E60090400000000000F01FEC\\Usage\\ProductNonBootFilesIntl_1033",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\File Path",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Datetime",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Reading Locations\\Document 0\\Position",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTF",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTA",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Feedback\\AppUsageData_1",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1703. ]
  1704.  
  1705. [*] Deleted Registry Keys: [
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\abe",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\0vc",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\4060A7\\621078",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\4060A7\\4060A7",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT"
  1715. ]
  1716.  
  1717. [*] DNS Communications: [
  1718. {
  1719. "type": "A",
  1720. "request": "sripipat.com",
  1721. "answers": [
  1722. {
  1723. "data": "68.65.120.144",
  1724. "type": "A"
  1725. }
  1726. ]
  1727. }
  1728. ]
  1729.  
  1730. [*] Domains: [
  1731. {
  1732. "ip": "68.65.120.144",
  1733. "domain": "sripipat.com"
  1734. }
  1735. ]
  1736.  
  1737. [*] Network Communication - ICMP: []
  1738.  
  1739. [*] Network Communication - HTTP: [
  1740. {
  1741. "count": 1,
  1742. "body": "",
  1743. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1744. "user-agent": "Microsoft-CryptoAPI/6.1",
  1745. "method": "GET",
  1746. "host": "ocsp.digicert.com",
  1747. "version": "1.1",
  1748. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1749. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1750. "port": 80
  1751. },
  1752. {
  1753. "count": 1,
  1754. "body": "",
  1755. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1756. "user-agent": "Microsoft-CryptoAPI/6.1",
  1757. "method": "GET",
  1758. "host": "ocsp.msocsp.com",
  1759. "version": "1.1",
  1760. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1761. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1762. "port": 80
  1763. },
  1764. {
  1765. "count": 1,
  1766. "body": "",
  1767. "uri": "http://sripipat.com/precious/PurchaseOrder.exe",
  1768. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1769. "method": "GET",
  1770. "host": "sripipat.com",
  1771. "version": "1.1",
  1772. "path": "/precious/PurchaseOrder.exe",
  1773. "data": "GET /precious/PurchaseOrder.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: sripipat.com\r\nConnection: Keep-Alive\r\n\r\n",
  1774. "port": 80
  1775. },
  1776. {
  1777. "count": 9,
  1778. "body": "",
  1779. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1780. "user-agent": "Microsoft-CryptoAPI/6.1",
  1781. "method": "GET",
  1782. "host": "crl.microsoft.com",
  1783. "version": "1.1",
  1784. "path": "/pki/crl/products/microsoftrootcert.crl",
  1785. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1786. "port": 80
  1787. },
  1788. {
  1789. "count": 3,
  1790. "body": "",
  1791. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1792. "user-agent": "Microsoft-CryptoAPI/6.1",
  1793. "method": "GET",
  1794. "host": "crl.microsoft.com",
  1795. "version": "1.1",
  1796. "path": "/pki/crl/products/microsoftrootcert.crl",
  1797. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1798. "port": 80
  1799. },
  1800. {
  1801. "count": 1,
  1802. "body": "",
  1803. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1804. "user-agent": "Microsoft-CryptoAPI/6.1",
  1805. "method": "GET",
  1806. "host": "crl.microsoft.com",
  1807. "version": "1.1",
  1808. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1809. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1810. "port": 80
  1811. },
  1812. {
  1813. "count": 2,
  1814. "body": "",
  1815. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1816. "user-agent": "Microsoft-CryptoAPI/6.1",
  1817. "method": "GET",
  1818. "host": "crl.microsoft.com",
  1819. "version": "1.1",
  1820. "path": "/pki/crl/products/microsoftrootcert.crl",
  1821. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Wed, 22 May 2019 05:00:43 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1822. "port": 80
  1823. },
  1824. {
  1825. "count": 1,
  1826. "body": "",
  1827. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  1828. "user-agent": "Microsoft-CryptoAPI/6.1",
  1829. "method": "GET",
  1830. "host": "ocsp.digicert.com",
  1831. "version": "1.1",
  1832. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  1833. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 150849\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 10:50:30 GMT\r\nIf-None-Match: \"5ced1276-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1834. "port": 80
  1835. },
  1836. {
  1837. "count": 1,
  1838. "body": "",
  1839. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  1840. "user-agent": "Microsoft-CryptoAPI/6.1",
  1841. "method": "GET",
  1842. "host": "ocsp.digicert.com",
  1843. "version": "1.1",
  1844. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  1845. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nCache-Control: max-age = 135176\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 05:30:18 GMT\r\nIf-None-Match: \"5cecc76a-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1846. "port": 80
  1847. },
  1848. {
  1849. "count": 1,
  1850. "body": "",
  1851. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  1852. "user-agent": "Microsoft-CryptoAPI/6.1",
  1853. "method": "GET",
  1854. "host": "ocsp.digicert.com",
  1855. "version": "1.1",
  1856. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D",
  1857. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAaJg2QslT5G973OQUPxM8E%3D HTTP/1.1\r\nCache-Control: max-age = 168744\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Tue, 28 May 2019 15:00:08 GMT\r\nIf-None-Match: \"5ced4cf8-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1858. "port": 80
  1859. },
  1860. {
  1861. "count": 1,
  1862. "body": "",
  1863. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  1864. "user-agent": "Microsoft-CryptoAPI/6.1",
  1865. "method": "GET",
  1866. "host": "ocsp.digicert.com",
  1867. "version": "1.1",
  1868. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D",
  1869. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAwVvkoVuwkDyQGx1sJlMC8%3D HTTP/1.1\r\nCache-Control: max-age = 108232\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 23:50:01 GMT\r\nIf-None-Match: \"5c9574a9-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1870. "port": 80
  1871. }
  1872. ]
  1873.  
  1874. [*] Network Communication - SMTP: []
  1875.  
  1876. [*] Network Communication - Hosts: []
  1877.  
  1878. [*] Network Communication - IRC: []
  1879.  
  1880. [*] Static Analysis: {}
  1881.  
  1882. [*] Resolved APIs: [
  1883. "mso.dll.#1443",
  1884. "mso.dll.#9214",
  1885. "mso.dll.#199",
  1886. "mso.dll.#1073",
  1887. "mso.dll.#4255",
  1888. "mso.dll.#7762",
  1889. "mso.dll.#3459",
  1890. "mso.dll.#1262",
  1891. "mso.dll.#5709",
  1892. "mso.dll.#7353",
  1893. "mso.dll.#5228",
  1894. "mso.dll.#2155",
  1895. "mso.dll.#1725",
  1896. "user32.dll.RegisterWindowMessageW",
  1897. "mso.dll.#4314",
  1898. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  1899. "mso.dll.#6484",
  1900. "mso.dll.#8499",
  1901. "mso.dll.#9871",
  1902. "mso.dll.#4743",
  1903. "mso.dll.#5452",
  1904. "mso.dll.#2088",
  1905. "mso.dll.#5274",
  1906. "mso.dll.#3195",
  1907. "mso.dll.#8165",
  1908. "mso.dll.#9175",
  1909. "mso.dll.#5315",
  1910. "mso.dll.#8140",
  1911. "user32.dll.IsWindowEnabled",
  1912. "ole32.dll.CoGetCallState",
  1913. "ole32.dll.CoGetActivationState",
  1914. "advapi32.dll.RegisterWaitChainCOMCallback",
  1915. "bcryptprimitives.dll.GetHashInterface",
  1916. "cryptnet.dll.CertDllVerifyRevocation",
  1917. "sechost.dll.ConvertSidToStringSidW",
  1918. "profapi.dll.#104",
  1919. "sensapi.dll.IsNetworkAlive",
  1920. "rpcrt4.dll.RpcBindingFromStringBindingW",
  1921. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  1922. "rpcrt4.dll.NdrClientCall2",
  1923. "winhttp.dll.WinHttpOpen",
  1924. "winhttp.dll.WinHttpSetTimeouts",
  1925. "winhttp.dll.WinHttpSetOption",
  1926. "winhttp.dll.WinHttpCrackUrl",
  1927. "winhttp.dll.WinHttpConnect",
  1928. "winhttp.dll.WinHttpOpenRequest",
  1929. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  1930. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  1931. "winhttp.dll.WinHttpSendRequest",
  1932. "winhttp.dll.WinHttpReceiveResponse",
  1933. "winhttp.dll.WinHttpQueryHeaders",
  1934. "shlwapi.dll.StrStrIW",
  1935. "winhttp.dll.WinHttpQueryDataAvailable",
  1936. "winhttp.dll.WinHttpReadData",
  1937. "winhttp.dll.WinHttpCloseHandle",
  1938. "winhttp.dll.WinHttpTimeFromSystemTime",
  1939. "cryptnet.dll.I_CryptNetGetConnectivity",
  1940. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  1941. "setupapi.dll.SetupIterateCabinetW",
  1942. "kernel32.dll.RegOpenKeyExW",
  1943. "kernel32.dll.RegCloseKey",
  1944. "cabinet.dll.#20",
  1945. "cabinet.dll.#22",
  1946. "devrtl.dll.DevRtlGetThreadLogToken",
  1947. "cryptsp.dll.CryptSetHashParam",
  1948. "sechost.dll.OpenSCManagerW",
  1949. "sechost.dll.OpenServiceW",
  1950. "sechost.dll.QueryServiceConfigA",
  1951. "sechost.dll.QueryServiceStatus",
  1952. "sechost.dll.CloseServiceHandle",
  1953. "rpcrt4.dll.RpcStringBindingComposeA",
  1954. "rpcrt4.dll.RpcBindingFromStringBindingA",
  1955. "rpcrt4.dll.RpcEpResolveBinding",
  1956. "sechost.dll.LookupAccountSidLocalW",
  1957. "rpcrt4.dll.RpcStringFreeA",
  1958. "rpcrt4.dll.RpcBindingFree",
  1959. "webservices.dll.WsResetHeap",
  1960. "webservices.dll.WsCloseServiceProxy",
  1961. "ws2_32.dll.#3",
  1962. "ncrypt.dll.SslDecrementProviderReferenceCount",
  1963. "webservices.dll.WsFreeServiceProxy",
  1964. "ncrypt.dll.SslFreeObject",
  1965. "mso.dll.#25",
  1966. "mso.dll.#1056",
  1967. "mso.dll.#8136",
  1968. "mso.dll.#8931",
  1969. "shell32.dll.SHGetFileInfoW",
  1970. "mso.dll.#5362",
  1971. "mso.dll.#6044",
  1972. "mso.dll.#6516",
  1973. "mso.dll.#6221",
  1974. "mso.dll.#5780",
  1975. "mso.dll.#4870",
  1976. "mso.dll.#6046",
  1977. "mso.dll.#1241",
  1978. "mso.dll.#2821",
  1979. "mso.dll.#2340",
  1980. "mso.dll.#7287",
  1981. "mso.dll.#5290",
  1982. "mso.dll.#1508",
  1983. "user32.dll.IsZoomed",
  1984. "user32.dll.GetWindowPlacement",
  1985. "user32.dll.GetWindowRect",
  1986. "mso.dll.#821",
  1987. "user32.dll.GetSystemMetrics",
  1988. "user32.dll.MonitorFromWindow",
  1989. "user32.dll.MonitorFromRect",
  1990. "user32.dll.MonitorFromPoint",
  1991. "user32.dll.EnumDisplayMonitors",
  1992. "user32.dll.GetMonitorInfoA",
  1993. "user32.dll.EnumDisplayDevicesA",
  1994. "mso.dll.#2378",
  1995. "user32.dll.SetWindowPos",
  1996. "user32.dll.AdjustWindowRect",
  1997. "mso.dll.#5912",
  1998. "mso.dll.#9719",
  1999. "mso.dll.#8824",
  2000. "mso.dll.#6117",
  2001. "mso.dll.#3307",
  2002. "user32.dll.SendMessageW",
  2003. "user32.dll.DestroyIcon",
  2004. "mso.dll.#3813",
  2005. "mso.dll.#1815",
  2006. "user32.dll.PtInRect",
  2007. "mso.dll.#1613",
  2008. "user32.dll.SetWindowTextW",
  2009. "user32.dll.GetClassLongW",
  2010. "mso.dll.#8572",
  2011. "gdi32.dll.CreateDIBSection",
  2012. "gdi32.dll.CreateCompatibleDC",
  2013. "gdi32.dll.GetViewportOrgEx",
  2014. "gdi32.dll.SetViewportOrgEx",
  2015. "gdi32.dll.SetBkColor",
  2016. "gdi32.dll.ExtTextOutA",
  2017. "mso.dll.#1573",
  2018. "gdi32.dll.DeleteDC",
  2019. "mso.dll.#8612",
  2020. "user32.dll.SetScrollRange",
  2021. "mso.dll.#2509",
  2022. "user32.dll.BeginDeferWindowPos",
  2023. "user32.dll.DeferWindowPos",
  2024. "user32.dll.EndDeferWindowPos",
  2025. "user32.dll.OffsetRect",
  2026. "user32.dll.EnumChildWindows",
  2027. "user32.dll.GetScrollInfo",
  2028. "user32.dll.MapWindowPoints",
  2029. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  2030. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  2031. "mso.dll.#6126",
  2032. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  2033. "gdi32.dll.GetFontRealizationInfo",
  2034. "gdi32.dll.GetFontFileInfo",
  2035. "gdi32.dll.GetFontFileData",
  2036. "mso.dll.#7261",
  2037. "mso.dll.#9540",
  2038. "usp10.dll.ScriptGetFontScriptTags",
  2039. "usp10.dll.ScriptGetFontLanguageTags",
  2040. "usp10.dll.ScriptGetFontFeatureTags",
  2041. "mso.dll.#6330",
  2042. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  2043. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  2044. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  2045. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  2046. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  2047. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  2048. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  2049. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  2050. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  2051. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  2052. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  2053. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  2054. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  2055. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  2056. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  2057. "user32.dll.SetRectEmpty",
  2058. "user32.dll.InflateRect",
  2059. "mso.dll.#1100",
  2060. "mso.dll.#7047",
  2061. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  2062. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  2063. "user32.dll.GetCursor",
  2064. "user32.dll.GetClientRect",
  2065. "user32.dll.SetScrollInfo",
  2066. "user32.dll.SetScrollPos",
  2067. "mso.dll.#3747",
  2068. "mso.dll.#8218",
  2069. "mso.dll.#5394",
  2070. "mso.dll.#331",
  2071. "mso.dll.#6829",
  2072. "mso.dll.#539",
  2073. "mso.dll.#4959",
  2074. "mso.dll.#6463",
  2075. "mso.dll.#4987",
  2076. "user32.dll.GetWindow",
  2077. "mso.dll.#7195",
  2078. "mso.dll.#7573",
  2079. "mso.dll.#445",
  2080. "user32.dll.GetCaretBlinkTime",
  2081. "user32.dll.CreateCaret",
  2082. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2083. "user32.dll.IntersectRect",
  2084. "user32.dll.DestroyCaret",
  2085. "user32.dll.GetCaretPos",
  2086. "user32.dll.SetCaretPos",
  2087. "mso.dll.#5932",
  2088. "mso.dll.#2071",
  2089. "mso.dll.#1024",
  2090. "mso.dll.#6245",
  2091. "mso.dll.#9041",
  2092. "mso.dll.#1767",
  2093. "mso.dll.#9369",
  2094. "mso.dll.#4617",
  2095. "user32.dll.FillRect",
  2096. "mso.dll.#343",
  2097. "mso.dll.#9636",
  2098. "mso.dll.#2022",
  2099. "mso.dll.#4750",
  2100. "mso.dll.#4577",
  2101. "mso.dll.#850",
  2102. "shell32.dll.SHAddToRecentDocs",
  2103. "mso.dll.#1776",
  2104. "mso.dll.#9026",
  2105. "mso.dll.#4497",
  2106. "mso.dll.#4647",
  2107. "mso.dll.#8926",
  2108. "mso.dll.#7212",
  2109. "mso.dll.#5407",
  2110. "mso.dll.#5152",
  2111. "mso.dll.#3327",
  2112. "mso.dll.#6333",
  2113. "mso.dll.#420",
  2114. "mso.dll.#1335",
  2115. "mso.dll.#2041",
  2116. "mso.dll.#7834",
  2117. "mso.dll.#239",
  2118. "mso.dll.#6357",
  2119. "mso.dll.#7026",
  2120. "mso.dll.#1671",
  2121. "oleaut32.dll.#7",
  2122. "mso.dll.#8263",
  2123. "mso.dll.#9307",
  2124. "mso.dll.#1441",
  2125. "ole32.dll.PropVariantClear",
  2126. "oleaut32.dll.#9",
  2127. "mso.dll.#9223",
  2128. "mso.dll.#6453",
  2129. "mso.dll.#8044",
  2130. "mso.dll.#3698",
  2131. "mso.dll.#8565",
  2132. "mso.dll.#8373",
  2133. "mso.dll.#9741",
  2134. "mso.dll.#478",
  2135. "mso.dll.#479",
  2136. "mso.dll.#340",
  2137. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  2138. "bcrypt.dll.BCryptGetProperty",
  2139. "bcrypt.dll.BCryptCreateHash",
  2140. "bcrypt.dll.BCryptHashData",
  2141. "bcrypt.dll.BCryptFinishHash",
  2142. "bcrypt.dll.BCryptDestroyHash",
  2143. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  2144. "mso.dll.#8633",
  2145. "mso.dll.#5213",
  2146. "mso.dll.#6163",
  2147. "mso.dll.#552",
  2148. "mso.dll.#5630",
  2149. "mso.dll.#2513",
  2150. "mso.dll.#1607",
  2151. "mso.dll.#791",
  2152. "mso.dll.#1848",
  2153. "mso.dll.#8735",
  2154. "mso.dll.#9374",
  2155. "mso.dll.#5286",
  2156. "mso.dll.#6368",
  2157. "mso.dll.#4262",
  2158. "mso.dll.#1010",
  2159. "mso.dll.#7979",
  2160. "mso.dll.#8549",
  2161. "mso.dll.#8970",
  2162. "mso.dll.#9198",
  2163. "mso.dll.#4795",
  2164. "mso.dll.#1865",
  2165. "mso.dll.#9688",
  2166. "mso.dll.#320",
  2167. "advapi32.dll.RegDeleteKeyA",
  2168. "user32.dll.DestroyCursor",
  2169. "mso.dll.#7173",
  2170. "mso.dll.#8511",
  2171. "mso.dll.#3299",
  2172. "mso.dll.#7001",
  2173. "mso.dll.#3913",
  2174. "user32.dll.PeekMessageA",
  2175. "mso.dll.#1380",
  2176. "mso.dll.#9500",
  2177. "user32.dll.TranslateMessage",
  2178. "user32.dll.IsWindowUnicode",
  2179. "user32.dll.DispatchMessageA",
  2180. "user32.dll.DispatchMessageW",
  2181. "user32.dll.UpdateWindow",
  2182. "mso.dll.#999",
  2183. "mso.dll.#287",
  2184. "dwmapi.dll.DwmIsCompositionEnabled",
  2185. "mso.dll.#1575",
  2186. "mso.dll.#5034",
  2187. "mso.dll.#1517",
  2188. "mso.dll.#718",
  2189. "mso.dll.#4708",
  2190. "mso.dll.#8046",
  2191. "mso.dll.#4175",
  2192. "mso.dll.#8672",
  2193. "mso.dll.#1990",
  2194. "mso.dll.#3051",
  2195. "mso.dll.#1819",
  2196. "mso.dll.#1419",
  2197. "oleaut32.dll.#147",
  2198. "kernel32.dll.WerRegisterMemoryBlock",
  2199. "dwrite.dll.DWriteCreateFactory",
  2200. "advapi32.dll.RegQueryValueW",
  2201. "gdi32.dll.GetCurrentObject",
  2202. "gdi32.dll.BitBlt",
  2203. "gdi32.dll.GetClipBox",
  2204. "gdi32.dll.StretchDIBits",
  2205. "apphelp.dll.ApphelpCheckShellObject",
  2206. "riched20.dll.REExtendedRegisterClass",
  2207. "user32.dll.GetWindowLongW",
  2208. "user32.dll.GetSysColor",
  2209. "user32.dll.SetWindowLongW",
  2210. "user32.dll.RegisterWindowMessageA",
  2211. "user32.dll.RegisterClipboardFormatW",
  2212. "user32.dll.GetDoubleClickTime",
  2213. "user32.dll.SetCaretBlinkTime",
  2214. "user32.dll.SystemParametersInfoW",
  2215. "user32.dll.GetKeyboardLayoutList",
  2216. "mso.dll._MsoGetFidUspDll@0",
  2217. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  2218. "usp10.dll.ScriptGetProperties",
  2219. "usp10.dll.ScriptItemize",
  2220. "user32.dll.LoadCursorW",
  2221. "user32.dll.IsWindowVisible",
  2222. "user32.dll.GetKeyboardLayout",
  2223. "user32.dll.PostMessageW",
  2224. "user32.dll.DefWindowProcW",
  2225. "uxtheme.dll.IsThemeActive",
  2226. "uxtheme.dll.IsAppThemed",
  2227. "uxtheme.dll.OpenThemeData",
  2228. "user32.dll.GetDC",
  2229. "user32.dll.ReleaseDC",
  2230. "user32.dll.IsIconic",
  2231. "user32.dll.GetParent",
  2232. "usp10.dll.ScriptGetCMap",
  2233. "user32.dll.InvalidateRect",
  2234. "user32.dll.HideCaret",
  2235. "user32.dll.ShowCaret",
  2236. "user32.dll.NotifyWinEvent",
  2237. "user32.dll.GetWindowTextLengthW",
  2238. "user32.dll.EnableWindow",
  2239. "msctf.dll.SetInputScope",
  2240. "user32.dll.GetWindowRgn",
  2241. "gdi32.dll.CreateCompatibleBitmap",
  2242. "gdi32.dll.SaveDC",
  2243. "gdi32.dll.SetPixel",
  2244. "gdi32.dll.GetPixel",
  2245. "gdi32.dll.RestoreDC",
  2246. "ole32.dll.CoRevokeInitializeSpy",
  2247. "comctl32.dll.#388",
  2248. "imm32.dll.ImmAssociateContext",
  2249. "mso.dll.#806",
  2250. "mso.dll.#4908",
  2251. "user32.dll.SetRect",
  2252. "mso.dll.#8439",
  2253. "mso.dll.#2736",
  2254. "gdi32.dll.GetTextAlign",
  2255. "gdi32.dll.ExtTextOutW",
  2256. "mso.dll.#8122",
  2257. "mso.dll.#2114",
  2258. "mso.dll.#6558",
  2259. "gdi32.dll.GetFontData",
  2260. "usp10.dll.ScriptItemizeOpenType",
  2261. "usp10.dll.ScriptShapeOpenType",
  2262. "usp10.dll.ScriptPlaceOpenType",
  2263. "mso.dll.#8395",
  2264. "mso.dll.#379",
  2265. "mso.dll.#6338",
  2266. "mso.dll.#7964",
  2267. "mso.dll.#1437",
  2268. "mso.dll.#1427",
  2269. "mso.dll.#6137",
  2270. "winmm.dll.timeGetTime",
  2271. "advapi32.dll.RegDeleteTreeW",
  2272. "mso.dll.#5940",
  2273. "usp10.dll.ScriptPlace",
  2274. "usp10.dll.ScriptShape",
  2275. "usp10.dll.ScriptJustify",
  2276. "usp10.dll.ScriptTextOut",
  2277. "usp10.dll.ScriptCPtoX",
  2278. "usp10.dll.ScriptXtoCP",
  2279. "usp10.dll.ScriptFreeCache",
  2280. "usp10.dll.ScriptCacheGetHeight",
  2281. "usp10.dll.ScriptLayout",
  2282. "usp10.dll.ScriptBreak",
  2283. "usp10.dll.ScriptIsComplex",
  2284. "usp10.dll.ScriptGetLogicalWidths",
  2285. "usp10.dll.ScriptApplyLogicalWidth",
  2286. "usp10.dll.ScriptGetGlyphABCWidth",
  2287. "usp10.dll.ScriptGetFontProperties",
  2288. "usp10.dll.ScriptApplyDigitSubstitution",
  2289. "usp10.dll.ScriptRecordDigitSubstitution",
  2290. "usp10.dll.ScriptGetFontAlternateGlyphs",
  2291. "mso.dll.#7578",
  2292. "mso.dll.#8483",
  2293. "xmllite.dll.CreateXmlReader",
  2294. "mso.dll.#2613",
  2295. "gdi32.dll.GdiIsMetaPrintDC",
  2296. "mso.dll.#7848",
  2297. "user32.dll.GetForegroundWindow",
  2298. "user32.dll.GetFocus",
  2299. "user32.dll.GetClassNameA",
  2300. "user32.dll.IsWindowRedirectedForPrint",
  2301. "gdi32.dll.CreateRectRgnIndirect",
  2302. "user32.dll.GetUpdateRgn",
  2303. "gdi32.dll.GetRgnBox",
  2304. "user32.dll.ValidateRect",
  2305. "user32.dll.GetUpdateRect",
  2306. "user32.dll.BeginPaint",
  2307. "user32.dll.EndPaint",
  2308. "mso.dll.#3624",
  2309. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  2310. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  2311. "gdi32.dll.TranslateCharsetInfo",
  2312. "mso.dll.#3300",
  2313. "mso.dll.#7465",
  2314. "mso.dll.#6247",
  2315. "gdi32.dll.SetWindowOrgEx",
  2316. "mso.dll.#732",
  2317. "mso.dll.#5804",
  2318. "ole32.dll.CoCreateInstance",
  2319. "user32.dll.GetWindowDC",
  2320. "gdi32.dll.SetLayout",
  2321. "gdi32.dll.RectVisible",
  2322. "gdi32.dll.GetClipRgn",
  2323. "gdi32.dll.ExcludeClipRect",
  2324. "gdi32.dll.SelectClipRgn",
  2325. "mso.dll.#434",
  2326. "user32.dll.GetMessageExtraInfo",
  2327. "user32.dll.GetCursorInfo",
  2328. "user32.dll.GetCapture",
  2329. "user32.dll.TrackMouseEvent",
  2330. "user32.dll.GetMessagePos",
  2331. "user32.dll.ScreenToClient",
  2332. "user32.dll.WindowFromPoint",
  2333. "user32.dll.SetFocus",
  2334. "user32.dll.GetDesktopWindow",
  2335. "user32.dll.FindWindowExW",
  2336. "mso.dll.#4746",
  2337. "msptls.dll.?LsPointUV2FromPointUV1@Ptls6@@YGJKPBUtagLSPOINTUV@1@0KPAU21@@Z",
  2338. "msptls.dll.?LsQueryLinePointPcp@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINTUV@1@JPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2339. "mso.dll.#9528",
  2340. "mso.dll.#5341",
  2341. "user32.dll.GetInputState",
  2342. "mso.dll.#8461",
  2343. "user32.dll.GetClipboardOwner",
  2344. "user32.dll.GetActiveWindow",
  2345. "user32.dll.GetAncestor",
  2346. "mso.dll.#3544",
  2347. "mso.dll.#900",
  2348. "mso.dll.#1422",
  2349. "user32.dll.MsgWaitForMultipleObjectsEx",
  2350. "advapi32.dll.NotifyServiceStatusChangeW",
  2351. "mso.dll.#9465",
  2352. "mso.dll.#8202",
  2353. "mso.dll.#5360",
  2354. "mso.dll.#8574",
  2355. "msi.dll.#39",
  2356. "mso.dll.#8318",
  2357. "mso.dll.#1283",
  2358. "mso.dll.#8705",
  2359. "mso.dll.#9685",
  2360. "mso.dll.#3579",
  2361. "mso.dll.#8747",
  2362. "mso.dll.#2880",
  2363. "mso.dll.#7615",
  2364. "mso.dll.#4219",
  2365. "mso.dll.#3244",
  2366. "mso.dll.#408",
  2367. "mso.dll.#2714",
  2368. "mso.dll.#8622",
  2369. "mso.dll.#3380",
  2370. "mso.dll.#2566",
  2371. "mso.dll.#1429",
  2372. "mso.dll.#6502",
  2373. "mso.dll.#2968",
  2374. "mso.dll.#709",
  2375. "mso.dll.#5913",
  2376. "mso.dll.#8051",
  2377. "mso.dll.#6505",
  2378. "mso.dll.#3901",
  2379. "user32.dll.IsHungAppWindow",
  2380. "msi.dll.#111",
  2381. "kernel32.dll.FlsAlloc",
  2382. "kernel32.dll.FlsGetValue",
  2383. "kernel32.dll.FlsSetValue",
  2384. "kernel32.dll.FlsFree",
  2385. "ieawsdc.dll.HrExtractTemplateToPath",
  2386. "advapi32.dll.CryptAcquireContextA",
  2387. "cryptsp.dll.CryptAcquireContextA",
  2388. "advapi32.dll.CryptGenKey",
  2389. "cryptsp.dll.CryptGenKey",
  2390. "advapi32.dll.CryptImportKey",
  2391. "cryptsp.dll.CryptImportKey",
  2392. "advapi32.dll.CryptExportKey",
  2393. "cryptsp.dll.CryptExportKey",
  2394. "advapi32.dll.CryptDestroyKey",
  2395. "cryptsp.dll.CryptDestroyKey",
  2396. "crypt32.dll.CryptQueryObject",
  2397. "wintrust.dll.CryptSIPPutSignedDataMsg",
  2398. "wintrust.dll.CryptSIPGetSignedDataMsg",
  2399. "cryptsp.dll.CryptGetDefaultProviderW",
  2400. "cryptsp.dll.CryptAcquireContextW",
  2401. "crypt32.dll.CertEnumCertificatesInStore",
  2402. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  2403. "cryptsp.dll.CryptReleaseContext",
  2404. "wintrust.dll.WinVerifyTrust",
  2405. "wintrust.dll.WintrustCertificateTrust",
  2406. "wintrust.dll.SoftpubAuthenticode",
  2407. "wintrust.dll.SoftpubInitialize",
  2408. "wintrust.dll.SoftpubLoadMessage",
  2409. "wintrust.dll.SoftpubLoadSignature",
  2410. "wintrust.dll.SoftpubCheckCert",
  2411. "wintrust.dll.SoftpubCleanup",
  2412. "wintrust.dll.CryptSIPVerifyIndirectData",
  2413. "cryptsp.dll.CryptCreateHash",
  2414. "cryptsp.dll.CryptHashData",
  2415. "cryptsp.dll.CryptGetHashParam",
  2416. "cryptsp.dll.CryptDestroyHash",
  2417. "advapi32.dll.CryptCreateHash",
  2418. "advapi32.dll.CryptSetHashParam",
  2419. "advapi32.dll.CryptHashData",
  2420. "advapi32.dll.CryptGetHashParam",
  2421. "advapi32.dll.CryptDestroyHash",
  2422. "user32.dll.RegisterPowerSettingNotification",
  2423. "powrprof.dll.PowerSettingRegisterNotification",
  2424. "user32.dll.GetWindowThreadProcessId",
  2425. "user32.dll.GetWindowTextW",
  2426. "advapi32.dll.SaferiSearchMatchingHashRules",
  2427. "msi.dll.#90",
  2428. "wintrust.dll.WTHelperProvDataFromStateData",
  2429. "wintrust.dll.WTHelperGetProvSignerFromChain",
  2430. "crypt32.dll.CertVerifyCertificateChainPolicy",
  2431. "crypt32.dll.CertCloseStore",
  2432. "advapi32.dll.ConvertSidToStringSidW",
  2433. "msi.dll.DllGetVersion",
  2434. "user32.dll.IsClipboardFormatAvailable",
  2435. "uiautomationcore.dll.UiaClientsAreListening",
  2436. "mso.dll.#8662",
  2437. "mso.dll.#8837",
  2438. "cabinet.dll.#23",
  2439. "mso.dll.#7009",
  2440. "mso.dll.#6429",
  2441. "mso.dll.#5667",
  2442. "mso.dll.#86",
  2443. "mso.dll.#2052",
  2444. "mso.dll.#424",
  2445. "mso.dll.#7778",
  2446. "mso.dll.#5127",
  2447. "mso.dll.#7590",
  2448. "mso.dll.#2687",
  2449. "user32.dll.SendNotifyMessageW",
  2450. "mso.dll.#5070",
  2451. "mso.dll.#8060",
  2452. "mso.dll.#5925",
  2453. "mso.dll.#3638",
  2454. "mso.dll.#1885",
  2455. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  2456. "mso.dll.#832",
  2457. "mso.dll.#1455",
  2458. "user32.dll.LoadImageW",
  2459. "user32.dll.CreateWindowExW",
  2460. "comctl32.dll.HIMAGELIST_QueryInterface",
  2461. "comctl32.dll.DrawShadowText",
  2462. "comctl32.dll.DrawSizeBox",
  2463. "comctl32.dll.DrawScrollBar",
  2464. "comctl32.dll.SizeBoxHwnd",
  2465. "comctl32.dll.ScrollBar_MouseMove",
  2466. "comctl32.dll.ScrollBar_Menu",
  2467. "comctl32.dll.HandleScrollCmd",
  2468. "comctl32.dll.DetachScrollBars",
  2469. "comctl32.dll.AttachScrollBars",
  2470. "comctl32.dll.CCSetScrollInfo",
  2471. "comctl32.dll.CCGetScrollInfo",
  2472. "comctl32.dll.CCEnableScrollBar",
  2473. "comctl32.dll.QuerySystemGestureStatus",
  2474. "uxtheme.dll.#49",
  2475. "uxtheme.dll.CloseThemeData",
  2476. "user32.dll.EnableScrollBar",
  2477. "user32.dll.ShowScrollBar",
  2478. "user32.dll.ShowWindow",
  2479. "user32.dll.SetParent",
  2480. "user32.dll.KillTimer",
  2481. "user32.dll.ClientToScreen",
  2482. "user32.dll.MoveWindow",
  2483. "user32.dll.DestroyWindow",
  2484. "gdi32.dll.GetViewportExtEx",
  2485. "gdi32.dll.GetWindowExtEx",
  2486. "gdi32.dll.GetTextCharset",
  2487. "gdi32.dll.GetMapMode",
  2488. "gdi32.dll.GetLayout",
  2489. "oleaut32.dll.SysAllocString",
  2490. "oleaut32.dll.SysStringLen",
  2491. "oleaut32.dll.SysAllocStringLen",
  2492. "oleaut32.dll.SysFreeString",
  2493. "uxtheme.dll.GetThemePartSize",
  2494. "user32.dll.GetMessageW",
  2495. "gdi32.dll.IntersectClipRect",
  2496. "gdi32.dll.SetTextColor",
  2497. "gdi32.dll.SetBkMode",
  2498. "gdi32.dll.GetTextColor",
  2499. "user32.dll.WaitMessage",
  2500. "wininet.dll.InternetGetConnectedState",
  2501. "rasapi32.dll.RasConnectionNotificationW",
  2502. "sechost.dll.NotifyServiceStatusChangeA",
  2503. "gdi32.dll.GdiFlush",
  2504. "osppcext.dll.SLActivateProduct",
  2505. "osppcext.dll.SLGetTokenActivationGrants",
  2506. "osppcext.dll.SLGetTokenActivationCertificates",
  2507. "osppcext.dll.SLGenerateTokenActivationChallenge",
  2508. "osppcext.dll.SLSignTokenActivationChallenge",
  2509. "osppcext.dll.SLDepositTokenActivationResponse",
  2510. "osppcext.dll.SLFreeTokenActivationGrants",
  2511. "osppcext.dll.SLFreeTokenActivationCertificates",
  2512. "advapi32.dll.CryptReleaseContext",
  2513. "user32.dll.GetClassNameW",
  2514. "mso.dll.#3258",
  2515. "mso.dll.#7974",
  2516. "mso.dll.#2609",
  2517. "mso.dll.#3500",
  2518. "mso.dll.#3347",
  2519. "mso.dll.#1905",
  2520. "mso.dll.#2812",
  2521. "mso.dll.#4416",
  2522. "mso.dll.#4008",
  2523. "mso.dll.#7366",
  2524. "mso.dll.#7546",
  2525. "mso.dll.#1406",
  2526. "mso.dll.#4926",
  2527. "user32.dll.GetScrollPos",
  2528. "mso.dll.#629",
  2529. "mso.dll.#676",
  2530. "mso.dll.#8644",
  2531. "mso.dll.#3141",
  2532. "mso.dll.#8472",
  2533. "mso.dll.#2281",
  2534. "mso.dll.#2628",
  2535. "mso.dll.#3425",
  2536. "mso.dll.#5291",
  2537. "mso.dll.#1718",
  2538. "mso.dll.#3702",
  2539. "mso.dll.#3484",
  2540. "mso.dll.#1966",
  2541. "mso.dll.#6960",
  2542. "mso.dll.#7892",
  2543. "mso.dll.#7931",
  2544. "mso.dll.#3837",
  2545. "mso.dll.#8398",
  2546. "mso.dll.#2477",
  2547. "msproof7.dll.DllGetClassObject",
  2548. "msproof7.dll.DllCanUnloadNow",
  2549. "mso.dll.#4172",
  2550. "mso.dll.#1439",
  2551. "mso.dll.#9566",
  2552. "mso.dll.#111",
  2553. "mso.dll.#4191",
  2554. "mso.dll.#3802",
  2555. "mso.dll.#6982",
  2556. "mso.dll.#8800",
  2557. "mso.dll.#3572",
  2558. "mso.dll.#167",
  2559. "mso.dll.#5737",
  2560. "mso.dll.#590",
  2561. "mso.dll.#3758",
  2562. "msgr3en.dll.CheckVersion",
  2563. "msgr3en.dll.#29",
  2564. "msgr3en.dll.#30",
  2565. "msgr3en.dll.#31",
  2566. "msgr3en.dll.#32",
  2567. "msgr3en.dll.#33",
  2568. "msgr3en.dll.#34",
  2569. "msgr3en.dll.#35",
  2570. "msgr3en.dll.#45",
  2571. "msgr3en.dll.#46",
  2572. "msgr3en.dll.#47",
  2573. "msgr3en.dll.#48",
  2574. "msgr3en.dll.#51",
  2575. "msgr3en.dll.#50",
  2576. "msgr3en.dll.#49",
  2577. "msgr3en.dll.#43",
  2578. "msgr3en.dll.#41",
  2579. "msgr3en.dll.#42",
  2580. "msgr3en.dll.#44",
  2581. "msgr3en.dll.#39",
  2582. "msgr3en.dll.#40",
  2583. "msgr3en.dll.#36",
  2584. "msgr3en.dll.#38",
  2585. "msgr3en.dll.#37",
  2586. "msgr3en.dll.#56",
  2587. "msgr3en.dll.#52",
  2588. "msgr3en.dll.#53",
  2589. "msgr3en.dll.#57",
  2590. "msgr3en.dll.#58",
  2591. "msgr3en.dll.#59",
  2592. "user32.dll.LoadStringA",
  2593. "mso.dll.#2561",
  2594. "mso.dll.#9080",
  2595. "mso.dll.#5154",
  2596. "mso.dll.#2907",
  2597. "msspell7.dll.SpellerVersion",
  2598. "msspell7.dll.SpellerInit",
  2599. "msspell7.dll.SpellerSetOptions",
  2600. "msspell7.dll.SpellerGetOptions",
  2601. "msspell7.dll.SpellerTerminate",
  2602. "msspell7.dll.SpellerOpenLex",
  2603. "msspell7.dll.SpellerCloseLex",
  2604. "msspell7.dll.SpellerCheck",
  2605. "msspell7.dll.SpellerAddUdr",
  2606. "msspell7.dll.SpellerAddChangeUdr",
  2607. "msspell7.dll.SpellerDelUdr",
  2608. "msspell7.dll.SpellerClearUdr",
  2609. "msspell7.dll.SpellerGetSizeUdr",
  2610. "msspell7.dll.SpellerGetListUdr",
  2611. "msspell7.dll.SpellerBuiltinUdr",
  2612. "mscss7en.dll.FreeGlobalObjects",
  2613. "mscss7en.dll.GetContextSpellingSession",
  2614. "shell32.dll.SHGetFolderPathW",
  2615. "css7data0009.dll.NlsLangDataCall",
  2616. "shell32.dll.SHGetFolderPathAndSubDirW",
  2617. "user32.dll.LoadStringW",
  2618. "mso.dll.#1911",
  2619. "mso.dll.#8802",
  2620. "user32.dll.VkKeyScanW",
  2621. "gdi32.dll.CombineRgn",
  2622. "user32.dll.CopyRect",
  2623. "gdi32.dll.SetStretchBltMode",
  2624. "user32.dll.UpdateLayeredWindow",
  2625. "mso.dll.#4702",
  2626. "user32.dll.RemovePropW",
  2627. "mso.dll.#7531",
  2628. "mso.dll.#6420",
  2629. "user32.dll.SetCursor",
  2630. "mso.dll.#7673",
  2631. "user32.dll.IsWindow",
  2632. "user32.dll.RedrawWindow",
  2633. "comctl32.dll.SetWindowSubclass",
  2634. "comctl32.dll.DefSubclassProc",
  2635. "mso.dll.#8693",
  2636. "mso.dll.#8656",
  2637. "mso.dll.#8071",
  2638. "user32.dll.UnhookWindowsHookEx",
  2639. "mso.dll.#4355",
  2640. "oleaut32.dll.#10",
  2641. "mso.dll.#1414",
  2642. "mso.dll.#7651",
  2643. "mso.dll.#5071",
  2644. "mso.dll.#2802",
  2645. "advapi32.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  2646. "mso.dll.#4111",
  2647. "mso.dll.#2386",
  2648. "advapi32.dll.RegisterEventSourceW",
  2649. "advapi32.dll.ReportEventW",
  2650. "advapi32.dll.DeregisterEventSource",
  2651. "mso.dll.#816",
  2652. "mso.dll.#511",
  2653. "mso.dll.#2620",
  2654. "shell32.dll.SHGetKnownFolderPath",
  2655. "mso.dll.#9748",
  2656. "mso.dll.#3496",
  2657. "mso.dll.#2901",
  2658. "mso.dll.#7830",
  2659. "mso.dll.#5396",
  2660. "mso.dll.#6895",
  2661. "mso.dll.#8986",
  2662. "mso.dll.#7945",
  2663. "mso.dll.#1442",
  2664. "mso.dll.#4388",
  2665. "comctl32.dll.RemoveWindowSubclass",
  2666. "mso.dll.#988",
  2667. "mso.dll.#5177",
  2668. "mso.dll.#3334",
  2669. "mso.dll.#7320",
  2670. "mso.dll.#9639",
  2671. "mso.dll.#9436",
  2672. "mso.dll.#5541",
  2673. "advapi32.dll.GetFileSecurityW",
  2674. "advapi32.dll.SetFileSecurityW",
  2675. "advapi32.dll.GetSecurityInfo",
  2676. "advapi32.dll.SetSecurityInfo",
  2677. "advapi32.dll.GetSecurityDescriptorControl",
  2678. "mso.dll.#2955",
  2679. "mso.dll.#1914",
  2680. "mso.dll.#1401",
  2681. "mso.dll.#5919",
  2682. "mso.dll.#4597",
  2683. "mso.dll.#7189",
  2684. "mso.dll.#2738",
  2685. "mso.dll.#8691",
  2686. "mso.dll.#6079",
  2687. "mso.dll.#7167",
  2688. "mso.dll.#7163",
  2689. "mso.dll.#333",
  2690. "mso.dll.#1785",
  2691. "mso.dll.#5973",
  2692. "mso.dll.#2014",
  2693. "mso.dll.#9668",
  2694. "mso.dll.#2294",
  2695. "advapi32.dll.RegDeleteKeyW",
  2696. "mso.dll.#235",
  2697. "mso.dll.#9398",
  2698. "mso.dll.#8022",
  2699. "mso.dll.#6889",
  2700. "mso.dll.#3633",
  2701. "gdi32.dll.GetTextExtentPointA",
  2702. "user32.dll.MessageBeep",
  2703. "user32.dll.DialogBoxIndirectParamW",
  2704. "comctl32.dll.RegisterClassNameW",
  2705. "uxtheme.dll.EnableThemeDialogTexture",
  2706. "uxtheme.dll.GetThemeBool",
  2707. "user32.dll.GetDlgItem",
  2708. "mso.dll.#6900",
  2709. "user32.dll.CallNextHookEx",
  2710. "uxtheme.dll.BufferedPaintInit",
  2711. "uxtheme.dll.BufferedPaintRenderAnimation",
  2712. "uxtheme.dll.GetThemeTransitionDuration",
  2713. "uxtheme.dll.BeginBufferedAnimation",
  2714. "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
  2715. "uxtheme.dll.DrawThemeParentBackground",
  2716. "uxtheme.dll.DrawThemeBackground",
  2717. "uxtheme.dll.GetThemeBackgroundContentRect",
  2718. "uxtheme.dll.DrawThemeText",
  2719. "uxtheme.dll.EndBufferedAnimation",
  2720. "user32.dll.GetDlgCtrlID",
  2721. "user32.dll.IsDlgButtonChecked",
  2722. "user32.dll.EndDialog",
  2723. "uxtheme.dll.BufferedPaintStopAllAnimations",
  2724. "uxtheme.dll.BufferedPaintUnInit",
  2725. "user32.dll.SetActiveWindow",
  2726. "mso.dll.#3144",
  2727. "mso.dll.#1213",
  2728. "mso.dll.#4220",
  2729. "mso.dll.#3214",
  2730. "mso.dll.#6521",
  2731. "mso.dll.#6489",
  2732. "mso.dll.#613",
  2733. "mso.dll.#1541",
  2734. "mso.dll.#6344",
  2735. "mso.dll.#9099",
  2736. "mso.dll.#8320",
  2737. "mso.dll.#7770",
  2738. "mso.dll.#6216",
  2739. "user32.dll.EnumThreadWindows",
  2740. "user32.dll.EnumWindows",
  2741. "user32.dll.GetLastInputInfo",
  2742. "ws2_32.dll.#116",
  2743. "mso.dll.#1266",
  2744. "gdi32.dll.GetStockObject",
  2745. "mso.dll.#6501",
  2746. "riched20.dll.REMSOHInst",
  2747. "mso.dll.#8118",
  2748. "gdi32.dll.GetGlyphIndicesW",
  2749. "mso.dll.#844",
  2750. "mso.dll.#1003",
  2751. "mso.dll.#8172",
  2752. "mso.dll.#9693",
  2753. "mso.dll.#1923",
  2754. "mso.dll.#3784",
  2755. "mso.dll.#4317",
  2756. "advapi32.dll.RegDeleteValueW"
  2757. ]
  2758.  
  2759. [*] Static Analysis: {}
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!