API tools faq
paste
paladin316

Exes_4caebe06a29f139244f1dbabce06db7a_exe.json

paladin316
Jun 20th, 2019
2,300
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 402.74 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: ""
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Exes_4caebe06a29f139244f1dbabce06db7a.exe"
  7. [*] File Size: 1101824
  8. [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. [*] SHA256: "0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946"
  10. [*] MD5: "4caebe06a29f139244f1dbabce06db7a"
  11. [*] SHA1: "b846fe335114a011ae0603c4cf46d8294e39a62a"
  12. [*] SHA512: "e250676d0fc96264146020454deb35c8b65587156df0cd0d4dbde3a8ada4700d5e7abc48f0a237bdf5d682d7c7745b4744d8c11959811f27850246443ee9d33b"
  13. [*] CRC32: "BFFCCEFC"
  14. [*] SSDEEP: "24576:uY4Vv3W+AyA/cayWpFVG96r1/kGlVZshDhwZ:QALdFU9E19lPshwZ"
  15.  
  16. [*] Process Execution: [
  17. "Exes_4caebe06a29f139244f1dbabce06db7a.exe",
  18. "cmd.exe",
  19. "WINWORD.EXE",
  20. "ekpwaqch.exe",
  21. "services.exe",
  22. "svchost.exe",
  23. "WmiPrvSE.exe",
  24. "WmiPrvSE.exe",
  25. "svchost.exe",
  26. "WMIADAP.exe",
  27. "OSPPSVC.EXE",
  28. "svchost.exe",
  29. "taskhost.exe"
  30. ]
  31.  
  32. [*] Signatures Detected: [
  33. {
  34. "Description": "Creates RWX memory",
  35. "Details": []
  36. },
  37. {
  38. "Description": "A process attempted to delay the analysis task.",
  39. "Details": [
  40. {
  41. "Process": "WINWORD.EXE tried to sleep 291 seconds, actually delayed analysis time by 0 seconds"
  42. },
  43. {
  44. "Process": "OSPPSVC.EXE tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
  45. },
  46. {
  47. "Process": "ekpwaqch.exe tried to sleep 270 seconds, actually delayed analysis time by 0 seconds"
  48. },
  49. {
  50. "Process": "WmiPrvSE.exe tried to sleep 540 seconds, actually delayed analysis time by 0 seconds"
  51. }
  52. ]
  53. },
  54. {
  55. "Description": "Attempts to connect to a dead IP:Port (10 unique times)",
  56. "Details": [
  57. {
  58. "IP": "52.109.20.1:443"
  59. },
  60. {
  61. "IP": "52.109.20.4:443"
  62. },
  63. {
  64. "IP": "52.109.6.5:443"
  65. },
  66. {
  67. "IP": "65.52.98.231:443"
  68. },
  69. {
  70. "IP": "23.63.254.64:80"
  71. },
  72. {
  73. "IP": "23.204.188.191:443"
  74. },
  75. {
  76. "IP": "23.201.41.22:443"
  77. },
  78. {
  79. "IP": "72.21.91.29:80"
  80. },
  81. {
  82. "IP": "104.73.164.151:443"
  83. },
  84. {
  85. "IP": "104.18.25.243:80"
  86. }
  87. ]
  88. },
  89. {
  90. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  91. "Details": [
  92. {
  93. "ioc": "chevronaccent.glox"
  94. },
  95. {
  96. "ioc": "ontent.inf"
  97. },
  98. {
  99. "ioc": "rame.glox"
  100. },
  101. {
  102. "ioc": "ist.glox"
  103. },
  104. {
  105. "ioc": "adial.glox"
  106. },
  107. {
  108. "ioc": "harvardanglia2008officeonline.xsl"
  109. },
  110. {
  111. "ioc": "rc.glox"
  112. },
  113. {
  114. "ioc": "chicago.xsl"
  115. },
  116. {
  117. "ioc": "iso690nmerical.xsl"
  118. },
  119. {
  120. "ioc": "architecture.glox"
  121. },
  122. {
  123. "ioc": "gosttitle.xsl"
  124. },
  125. {
  126. "ioc": "rocess.glox"
  127. },
  128. {
  129. "ioc": "ext.glox"
  130. },
  131. {
  132. "ioc": "gostname.xsl"
  133. },
  134. {
  135. "ioc": "gb.xsl"
  136. },
  137. {
  138. "ioc": "mlaseventheditionofficeonline.xsl"
  139. },
  140. {
  141. "ioc": "sist02.xsl"
  142. },
  143. {
  144. "ioc": "ieee2006officeonline.xsl"
  145. },
  146. {
  147. "ioc": "e.gu"
  148. },
  149. {
  150. "ioc": "iso690.xsl"
  151. },
  152. {
  153. "ioc": "turabian.xsl"
  154. },
  155. {
  156. "ioc": "quations.dotx"
  157. },
  158. {
  159. "ioc": "rings.glox"
  160. },
  161. {
  162. "ioc": "pictureorgchart.glox"
  163. },
  164. {
  165. "ioc": "set.dotx"
  166. },
  167. {
  168. "ioc": "nline.xsl"
  169. },
  170. {
  171. "ioc": "rid.glox"
  172. },
  173. {
  174. "ioc": "..3b"
  175. },
  176. {
  177. "ioc": "anded.thmx"
  178. },
  179. {
  180. "ioc": "content.inf"
  181. },
  182. {
  183. "ioc": "ccent.glox"
  184. },
  185. {
  186. "ioc": "ype.thmx"
  187. },
  188. {
  189. "ioc": "etropolitan.thmx"
  190. },
  191. {
  192. "ioc": "iew.thmx"
  193. },
  194. {
  195. "ioc": "ividend.thmx"
  196. },
  197. {
  198. "ioc": "rame.thmx"
  199. },
  200. {
  201. "ioc": "eadlines.thmx"
  202. },
  203. {
  204. "ioc": "rop.thmx"
  205. },
  206. {
  207. "ioc": "arallax.thmx"
  208. },
  209. {
  210. "ioc": "adge.thmx"
  211. },
  212. {
  213. "ioc": "uotable.thmx"
  214. },
  215. {
  216. "ioc": "erlin.thmx"
  217. },
  218. {
  219. "ioc": "ircuit.thmx"
  220. },
  221. {
  222. "ioc": "g.n9"
  223. },
  224. {
  225. "ioc": "avon.thmx"
  226. },
  227. {
  228. "ioc": "roplet.thmx"
  229. },
  230. {
  231. "ioc": "late.thmx"
  232. },
  233. {
  234. "ioc": "amask.thmx"
  235. },
  236. {
  237. "ioc": "eathered.thmx"
  238. },
  239. {
  240. "ioc": "vent.thmx"
  241. },
  242. {
  243. "ioc": "esh.thmx"
  244. },
  245. {
  246. "ioc": "rail.thmx"
  247. }
  248. ]
  249. },
  250. {
  251. "Description": "Reads data out of its own binary image",
  252. "Details": [
  253. {
  254. "self_read": "process: Exes_4caebe06a29f139244f1dbabce06db7a.exe, pid: 3688, offset: 0x00000000, length: 0x0010d000"
  255. }
  256. ]
  257. },
  258. {
  259. "Description": "A process created a hidden window",
  260. "Details": [
  261. {
  262. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  263. }
  264. ]
  265. },
  266. {
  267. "Description": "Drops a binary and executes it",
  268. "Details": [
  269. {
  270. "binary": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ekpwaqch.exe"
  271. }
  272. ]
  273. },
  274. {
  275. "Description": "Performs some HTTP requests",
  276. "Details": [
  277. {
  278. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  279. },
  280. {
  281. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  282. },
  283. {
  284. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D"
  285. },
  286. {
  287. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D"
  288. }
  289. ]
  290. },
  291. {
  292. "Description": "The binary likely contains encrypted or compressed data.",
  293. "Details": [
  294. {
  295. "section": "name: .rsrc, entropy: 7.98, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00081000, virtual_size: 0x00080f18"
  296. }
  297. ]
  298. },
  299. {
  300. "Description": "Sniffs keystrokes",
  301. "Details": [
  302. {
  303. "GetAsyncKeyState": "Process: Exes_4caebe06a29f139244f1dbabce06db7a.exe(3688)"
  304. }
  305. ]
  306. },
  307. {
  308. "Description": "Attempts to restart the guest VM",
  309. "Details": []
  310. },
  311. {
  312. "Description": "Queries information on disks, possibly for anti-virtualization",
  313. "Details": []
  314. },
  315. {
  316. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  317. "Details": [
  318. {
  319. "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 13319338 times"
  320. }
  321. ]
  322. },
  323. {
  324. "Description": "A potential decoy document was displayed to the user",
  325. "Details": [
  326. {
  327. "disguised_executable": "The submitted file was an executable indicative of an attempt to get a user to run executable content disguised as a document"
  328. },
  329. {
  330. "Decoy Document": "\"c:\\program files (x86)\\microsoft office\\office15\\winword.exe\" /n \"c:\\users\\user\\appdata\\local\\temp\\dbe_certification_application.docx\" /o \"u\""
  331. }
  332. ]
  333. },
  334. {
  335. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  336. "Details": [
  337. {
  338. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x0c\\x0e_:\\xc4\\x9e\\xec{\\xe0n\\x86\\xc7\\xc5b\\xc6co\\xe0\\x13\\xf0\\x7f,\\xb1s\\xc43o\\x19\\x1dg}\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1coffice15client.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  339. },
  340. {
  341. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfb\\x99\\x82tp\\xb3+zc\\xa8[s;\\xd4\\x82yq]\\xf09\\xaer\\xec\\xe8\\xfc\\xf8\\x14o\\xdc)\\xd5\\xb2\"\\xf8oi\\xa7\\x14\\x7f\\xf7\\xb8,_ou4\\xed\\xed\\xb81\\xf9\\xdd\\xe5\\xbdbw\\xa06\\xe6\\x88[\\x86\\xaf6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xf7\\x08\\xbdk!g0\\xf4\\x89mw\\xb9\\x852r\\x7fm\\x92\\xd9\\xa6wz.\\x9b\\x9d\\x02\\xe5rzy\\xf5\\x88=c\\xc0\\xa6\\xb1\\x07\\x9b\\xc5\\xaf\\x98u\\x0fc\\xe9\\x8e4"
  342. },
  343. {
  344. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xb4i\\xfeyko\\x13\\xc4e\\xa3\\xda\\x08\\xd0\\x04\\xbe\\xb6\\x90n\\x00-\\x92\\x11\\x8fp\\xd68\\xe6\\x0en\\x84^\\x11~8\\x81\\x1e\\x9d\\xb4w23\\xd9\\xf2nb\\xa6\\xd7;v\\\\xa9\\xd3\\xf2\\xb3n6\rt,\\x15oxzqhqx\\xb6<\\xbfp\\xcd\\x99\\xca\\xb4\\xef!y\\x9c5\\x0b\\x9e%\\xf8.\\xe1t(\\xb6\\xeb\\x14\\xa0}\\x9c\\xf4\\x92\\xd7\\xb89\\xd6'y\\xb8\\xde\\x01\\\\x7fqpp\\xd7\\x8bi(\\xed;^m{9\\x18'\\xf6<f\\xdf\\x1d,\t4\\x924\\xa9\\xd0\\x11\\x11\\xd0\\x8ae\\xb2\\xbap\\x02\\x92x\\xaf\\xab\\x85\\xfc\\xe5\\x1f\\xb7\\x8fz+\\xa2\\x90\nx}\\xc9\\xb1v\\xda\\xd4\\x9d\\x89\\xafg\\xf0\\xdd\\xeaw\\x84\\x86@\\x89\\xb7\\xca\\xee\\x91o\\xbc\\x08z\\x97'\\x1f%\\xa4\\xa6/\\xc2\\x91{\\x00q\\xa9v,\\xddg\\xea\\xbbiq\\xf5\\xac\\x975\\xe1\\xbf\\xf0\\x84\\xe6.o\\\\x93\\x1dn\\xf0\\xf1c_&\\xabp\\xf6?\\xac\\xe86\\xbab&\\xbcp\\xa2\\xf9\\x87`\\xed\\x93\\x1c\\xf6\\xa1\\xf4\\xb9\\xd1\\x16"
  345. },
  346. {
  347. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x0c\\x0ea\\x98p\\xfe\\xde]x\\xa1<\"\\xf8\\xe7x\\x14\\xecv\\xea<p\\x8c\\xe1\\xc4\\xf4\\x11\\x9ef\\x1d\\xc7\\xa4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  348. },
  349. {
  350. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04o`\\\\xb1\\x93es\\x9f\\xe1\\xd9\\x8b\\x85)\\xdbi\\xc6\\xec\\xb7z@\\xc6\\x95\\xb4+\\xb1\\xf9\\x91@\\xe4tah7\\x7f\\xbe\\xab&\\xe3\\xc5\\x05\\x85\\xab\\xa7td\\xba\\xec1,p\\xd7\\xe8y\\xccw\\xeb3\\xe2\\x15\\x90\\xb1\\xc4\\xa61\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe5)\\x91fe\\xb4lvv\\xa3{\\xa6\\xf2\\xc3\\xd7\\xb2\\xac\\x1e\\xdd\\xd0\\xe4\\x02\\xa8\\xb4\\x19j0c=n\\xf1\\xc8\\xae\\xd7\\xf8\\xea\\x98v\\xce\\xaf\\xd3\\x91\\x142\\xb6\\x92y\\xed"
  351. },
  352. {
  353. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x0c\\x0eb\\x15\\x94/x\\xd2\\x962\\xa4\\xa6\\xb6\\xc2\\xa4\\xd3\\xc7a\\xeck< .\\x97;c\\xa6\\xfad\\xaeq\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  354. },
  355. {
  356. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\ncache-control: max-age = 89056\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: fri, 22 mar 2019 18:30:24 gmt\r\nif-"
  357. },
  358. {
  359. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x92\\x80\\xc0g\\xe4bk\\xda\\xe6k\\xa6b\\x14\\xc5\\xe9`\\xf3}\\x9f^f\\xbf~{v&\\x11h\\xdd\\xc6\\xbef\\x03\\xec\\x0ff\\x7fb\\x94\tb\\x1a\\xa6*\\xdb\\x10\\\\xd3\\x14&\\xad\\xf6l\\xa5fz\\x84}\\xd0*x\\xdbwo\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbd\\xed\\ 6\\xae\\xb2\t\\xbf\\xb85\\xd2\\x02\\xad\\xe3\\xf5\\x02\\xae\\x1e\\xde\r\\xde\\x05\\xceh\\x1f\\x0e\\xdf7y\\x05\\x19\\x10py\\\\xdd\\xcf\\xb2\\x84\\x1f\\xefb\\xf5\\xff\\xc3\\xd5\\xa0"
  360. },
  361. {
  362. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xb5\\x87\\x15\\xd8\\xc6w\\xc5\\x96\\x0c\\xd6\\x0cl\\xc9\\x98\\xa9ed\\x15\\x90\\xa2\\xc9\\xb9\\x0e\\xa4\\xf14?,\\x01y\\xf6\n\\xcc\\xff\\xf3\\x07&k\\xd3\\x88+\\x828\\xc1\\x83pf\"#\\x1d\\xf5^\\xac\\x03[\\xe9\\xc0\\xa8\\xf8\\x8d\\xa2d\\xcd\\xe5nq\\x07\\xb95\\x10+\n!\\xb6<\\x83o\\xda\\x8b\\xba\\xda\\xdd\\x92\\xe9\\x0b\\xe09\\x1e\\xc3\\xa1\\xef\\x7f\\x16\\xca}\\x04\\x032\\x92j\\x07\\xc7#\\x1e\\xda&z\\xf6\\xfc1\\x9b\\xdc\\xab\\x17?\\x13\t\\xc7\\xa1\\xfa2gs\\xd8\t\\xd5\\x16\\x91{l\\xef\\xd2\\x1e\\xf9\\xdbys\\xe7\\x83\\xb8\\x84\\xc6\\x81\\x92\\xd4\\xe7k\\xb5\\x8a\\x7f&\\x17\\x86\\xb9\\xcc'3q\\xef\\xbe\\x82\\xf9\\x94\\x96<\\xef\\xfb{\\xac\\xf4\\xe4\\x8etjk*\\x9e\\xbfc\\x9bqg\\x16\\xde\\x01\\x1d\\xc5\\xcauqk\\xc5\\x03\\xaa\\x8c\\xc1n>\\xd7\\xe5\\x9b'\\xf6\\xd2\\xad,\\xdfl\\x86\\xbf\\x18\\xf2\\xb7\\x1cy\\xb4\\x89\\x8fi\\x11a\\x11\\xaf\\xfep\\xcd\\xdaj\\x84\\x97\\x8a\\x91xr892\\xea\\x1fe\\xac\\x17\\xfe\\x83\\x83\\x18\\x9c2\\xb6d\\x11"
  363. },
  364. {
  365. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  366. },
  367. {
  368. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01pv\\x8b:\\xe5\\x8b\\xfbm\\xbb\\xd7\\xfe%r\\xe4\\xcfg\r\\xfb_d\\x1ct}\\xcdcy\\xb4\\x8e\\xb1\\xcdc\\xc9<\\x8c\"\\x01z\\x9d\n4p\\xd5q\\xcb\\x1a \\x872m\\xf5#\\x162\\x1fg[\\xda\\x1f\\xee\\xc3o\\xe4\\xc9w\\xc0\\xe0o\n\\x1c(@\\xb8'v\\x89r$\\x8ez\\x1e\\x7fb\\xb0\\x06\\xb9\\x95\\xe2\\x02\\x18\\xbd\\xf6q\\xfa!i?\\xadzhp\\x18\\xbai\\x1dlt\\xb3\\xf5\\x00\\xa6\\xd5\\x8d\\xc4\\x98~\\x91>'\\x03\\xd7\\xb6\\xcf\\x83+\\x91'n7\\x94\\xbdps\\xe0\\x81\\xea\\xd2\\xbe\\xa4h\\xcc[3\\xf7~g\\x7f\\xfb\\xb6i\\xa8\\xb2f\\x92~\\xa3\\xd9\\x80\\xf0\\x90\\xdb\\xcfxjh\\xc4\r\\x1e\\xf6c\\xd1\\xa0$\\xb1o\\xb3\\xc3\\xde\\xc8\\x8c\\x82\\x95\\xce\\x93\\xd8\\xf7\\x16\\xbb\\xe1u{\\x04d7]\\xc2\\x89u\\xdd\\xe2\\xf9\\x90\\x7f\\x05\\xed7\\xc8mp,\\x1a\\xeb\\xed\\xf0z\\xb9``\\x1by\\xc2\\xcd\\xc3\\x10\\x80)o\\xd0\\xd8\\x8c\\xb3ytg\\xa55\\x88\\x13$\n0\\xb7\\xd68o\\xda#\\x8cu\"n%\\xf1"
  369. },
  370. {
  371. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xb4o\\x95bp#\\xd1h\\xfbc\\x97\\xcc\\xb5d\\x8bs\\xd1\\xa3\\x9f/\\xa9\\xa0\\xc5\\x06\\x11\\xe3\\x0b\\x83\\xb7\r\\x0f\\xad\\xce\\xd9\\xf8\\x89\\xe5e\\x1d\\xff\\x13\\xd5\\xb41\\xf1\\x0e\\xf0\\x8e\\xd8\\xd1i\\xfc\\x06\\x01\\x81d\\xf6l\\x95<\\xb5\\xce\\xa8\\x1c\\xa0p\\xd9\\xc4\\xaby\\xb9\\xc6z\\xd6q\\x83h\\xf9\\xdbtf\\xf9\\xb06\\x81\\x9b8\\x8ca\\xc6>\\x8e-\\xdd\\xe2j\\xb0\\xfb!\\xff\\xd2\\xfb\\xdba\t\\xf5\\xfc;\\x01\\xf5%\"\\xe55\\xae\\xec\\xba\\xae\\xacw\\xa1'\\xa3m\\xa6p\\x03s\\xb4\\xb3\\xb9\\xf3)_\\xdb[l\\x1e\\x0f\\xf7\\x8bg\\x91\\x93\\x97#\\xb5\\x1f1`&_\\xa2x\\xcb@\\x97\\xbe8\\xd4\\x99\\xf3h9\\xe8\\xb1]c\\x19\\xbfp\\xce\\xbed\\x11<\\x7fs\\xaa\\x00\\xd8\\x95\\xad9\\xd5r\\x81_b\\xee\\x83\\xa0k\\xcd\\xe9\\x19\\x93j\\x1bww\\xff\\x17\\xb2e\\x1c\\x1cj\\xd1x\\xb5\\x94\\x13\\xa3w=\\xcb\\_g\\xc5\\xf5\\xc2\n\\xa8\\xe4n\\xc8\\xf2e.^\\xf9\\xfb<i\\xadg\\x17'\\xfe\\x08\\xc1%\\xb3\\xdf\\xa3>\\xfa\\x01w"
  372. },
  373. {
  374. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x0c\\x0ec\\x7f\\x10\\xfc\\x05o\\xc6pt\\xc0\\xf0+\\xf9\\xe2q[\\x8cs\\xa2\\x9e\\xfes\\x1ey%zt\\x93_\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  375. },
  376. {
  377. "http_request": "winword.exe_WSASend_\\xce\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04mg\\xeb+/\\xf6tee\\x0f\\xb8\\x99\\xce<\\xc9\\xfc,9lj\\xb8vx\\x82\\x1f#\\xc5n\\x13\\xf4\\xec\tzd\\xab9\\xbd\\xc4\\xc5\\x1e\\xd3\\x0f\\x96tz\\xcek\\x89$h%\\xcb\\xca\\xe2\\xde\\xb9x\\xeef\\x8a\\xf3\\xa9he\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfa^)\\x8a\\x19p\\xda8\\x87\\xe1z/\\xb2\\xc9\\x84\\x1dh\\x0b\\xc5\\xc1>$\\xaam\\x0b\\xb8\\x9e\\x90\\xed\\xc0\\xf1\\xa1\\xab?'i\\xfd\\x81\\xe6\\xea\\xeca3\\xb2\\xc9\\xb0\\xc2f"
  378. },
  379. {
  380. "http_request": "winword.exe_WSASend_\\xc4\\x00[\\x00h5&\\x0br\\xac\\xb5\\xb8\\xd1.\\xd2\\xbd\\xcf\\x10<\\xf55\\xd4tv\\x98\\xdc\\x9c\\xe4\\xa1{\\xf4\\x10\\xf4\\xa0:\\xb5\\x98\\x9b\\x9e\\x9a\\xe7{<\\x03\\x9f\\x8c\\x14}\\x0e\\x1a\\xf9\\x9ey\\x98x[\\xb7\\xa9\\xa8\\xfd\\xf9\\xad\\x9f\\x81\\xe2\\xfc\\xca_\\xfc\\x96[\\xb0\\xe4*\\x14\\xd9<\\xf2\\xf4x\\xd5\\x81\\xcf52n\\xd9)\\xa0y\\xd0$\\xeb\\x91?\\x12\\x17\\xe1\r\\xe2\\xbd\\x1d\\xa1?~\\x84q99\\xd1 \\xcd\\x1e\\x0c\\x7f\\x12\\xd8\r\\xd8a\\x03$\\xa1\\xb52n\\xd2\\xfd\\x01\\x9c!gc\\xd9\\x06\\x99&^+\\xcd{t,\\xd4/y\\xe6\\x04\\xfa\\xb3\\xa3\\xd0\\x0fn\\xbf\\xe2\\xea\\xac1\\x11\\x11\\x8e\\xdf\\xd2\\xd5\\xb0\\x04p\\xde?\\x93\\xac\\x95\\xb0\\\\xc3\\xb6sh\\xc4\\x8c\\x85\\x08\\xaeh\\xb1z8\\xe1\tet\\xd7\\x94\\x08\\xb0a\\xbay\\xe6\\xde}\\x12!\\xf6=\\x9b7\\xaf\\xbes\\xc2=e\\x06\\x86\\xc6\\xa0\\x11u\\xf3\\xd6\\xdd\\k*u\\xf5\\xdd\\xf6\\xfa\\xb5+\\xa4\\xb3\\x92\t\\x906\\x1d}\\x87b\\x92\\xaa\\x8e\\xf6>i\\xbdxi\\xd9\\x08\\xea0"
  381. },
  382. {
  383. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\\x0c8s\\x9dmo\\xba{\\xb2\\xe2\\xa2\n\\xa7\\xa7\\x08r\t3mu\\x02f\\xd6\\xd0\\xday\\xc4\\x05\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  384. },
  385. {
  386. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed/b%\\x01\\xc0\\xe2\\xfc\\xbf0\\x92\\x1f\\x8e\\xd6t\\xbc\\x85\\x03\\xc8\\x11\\xe1\\x1e{\\x83\\xafb\\xb7\\xa2\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  387. },
  388. {
  389. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed]x\\xb4'\\x84\\xec\\xbe\\x06\\xbc\\xf9\\x18\\xd9\\xcda\\xc0b\\x18-\\x95\\xab`tp\\x07\\x92;!m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  390. },
  391. {
  392. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\\xb5\\x1c\\xb7\\xc2\\x02\\x9ezf\\xf6\\x7f\\x0f\\xd8\\x19\\xf3:o\\xaa\\xd6\\xca\\xd7\\x1c\\x1b\\x8a\\x95s\\xbd\\xedl\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  393. },
  394. {
  395. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\\xf9\\xb1\\xcd\\x1c\\xb7\\xf1\\x00c\\xf8\\xbc\n\\xcba|\\xaf\\x1b\\xb9??l\\xb9)\\xa2\\xeb\\xbe\\xc2-\\x9a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  396. },
  397. {
  398. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0edkw\\xb2\\x1ccc\\xc4\\xa5\\xda\\xbel\\x8a\\xf1\\x81\\xad\\x7f\\x89#k\\x8b\\xeb\\x82\\xa5\\x81\\xb0w\\xa4\\xc2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  399. },
  400. {
  401. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\\x88\\x1f\\x8c\\xc1s\\x9a\\x9bve8,\\xcae\\x82\\xf8\\xf12\\x8e\\x87\\xcc;\\xae+.\"\\xef,\\x19\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  402. },
  403. {
  404. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\\xd4\\xb5q8\\x8ekh:\\xe9h\\xad\\xbb\\xcc\\x973\\xb5\\x8b\\x81\\x024-\\x17z\\xa3\\xe7\\xb1\\x1b\\xa7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  405. },
  406. {
  407. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0edx\\x92\\x99\\xe0v\\x9ehye}m\\x90\\xa6p\\x03f\\x1a\\xa9*\\xe4)\\x8a\\xde8\\x1ap\\xb3[\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  408. },
  409. {
  410. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\\xc9\\xc9\\x95\\xe0\\x9e\\x80\\xeb\\xf7l\\xa2\\x9c_\\xe8$\\x8c\\xf2h\\xcc_r\\x9b\\xdep'i\\x916\\xe6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  411. },
  412. {
  413. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\\x10\\xef\r\\xa5k\\x1a\\xe0r\\xaf\\x9c\\xfc\\xdc\\x13\\xd0\\xf2\\xa7i\\xd0\\xd6\\xf4~6i8!\\x99\\xaa\\xae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  414. },
  415. {
  416. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\\xd4~\\x17\\xa7x\\xf7\\xb5\\xf8h1^\\xc6\\xd5\\x1a\\xa0\\xcf\\xbe\\xc83\\xf4\\xa6\\xb8\\xd7\\x86\\xa8\\x94=\\xc8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  417. },
  418. {
  419. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0edqm\\x1f\\x80\\xc7\\xf6\\x86q\\xf3\\xd5a\\x01\\x0b\\xd0t~\\x9e6\\xa2\\xe3\\xe9*3 \\xaaa\\xc0z\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  420. },
  421. {
  422. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\\xbb\\x1f:\\xb5s\\xca\\x1d\"\\xb1}\\x83\\x9d\\xadgi\\xa2\\xfc\\x03#\\xe9x'\\xbe\r\\x98\\xd8\\x07m\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  423. },
  424. {
  425. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\\xb8\\x93\\xba!\\xb9\\xed\\x9a@\\xb9\\xdc\\xbe\\x9c\\xe7\\x84\\x9b\\xaf\\xc9\\xdb]^\\x92\\x04:\\xc5\\xf7\\x15\\x7fx\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  426. },
  427. {
  428. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\\x8bb\\xf52\"\\x12\\xeb\\xe1\\xddz\\x0e\\xe2\t\\xc8\\xa9\\x1c\\x1d\\x06v#y\\x9b\\x16[\\xfa\\xdeb=\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  429. },
  430. {
  431. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0edn<e\\xae\\x9e\\xf5\\xfc\\xaf\\xbcm\\xd3\\x0f\\xc5\\x94\\xecs\\xdbqe\\xf4np\\x8a\\x00\\x83\\xf9_\\xce\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  432. },
  433. {
  434. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\r\\x07\\x04v\\x13^\\x99m\\xd7\\x18\\x1f_\\x0byv_i\\xefu?t\\xb0\\x15\\xea)\\xb1\\xa5c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  435. },
  436. {
  437. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0edos\\x16\\xab\\xb5\\xcc\\x0e\\xcf\\xd8\\x95\\x03\\xd8\\xcb:\\xe2\\xff\\xbd\\xfb\\xfc\\xe1\\xa1bm\\xd0\\xed\\xa3\\x8f\\xf5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  438. },
  439. {
  440. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed#\\xe2zq\\xe0\\xfc\\x19y\\x9c\\x03\\xa0\\x8b\\xffp;]\\xa1x\\xf1\\xd3\\xde\\x12r\\xe3\\xc3\\xe7\\xb6\\x1e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  441. },
  442. {
  443. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\\xac\\xa8\\xcf#uf]\\xbeb\\x88\\xa8\\xf1i\\x9cs\\xe0\\x91\\x94w\\x96c\\x0c\\x18o\\xfc\\x93\\x1a\\xa1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  444. },
  445. {
  446. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ed\\xfe\\x9au\\xab\\xde\\x0b\\x1b\\xf9\\xf3df\\xb0o\\xc0.\\xad5\\xfe\\x97mr\\xa2:nj\\x80\\xa2\\x98\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  447. },
  448. {
  449. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04=\\xf8c\\xd9\\x97\\xd1.`\\x18\\xedf\\xd0\\x14n'\\xc3<\\xde\\x1fh2\\xda\\x07\\xc8\\xaa\\xec\\xf5\\xe8\\x0b\\x1dq\\xae\\xean\\x08\\x83\\x95\\xf5\\xa6\\xf7l\\x10\\xff\n!\\x08\\xcb\\xbf2f\\x0c\\xef\\x15\\x02\\xc0\\xff6e\\xe6\\xb7\\x1bl\\xf3\\x1f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc7\\xd6\\x00\\xe4flm\\x1d\t\\x7f\\x17\\xa81\\x87\\xdce\\xfd4\\xd6\\x04\\xf4\\xe3\\xd6\\x95=\\xcfv9\\xfa\\xb0p\\xc5\\x91\\x08j\\xd1\\x8ev\\xba\\xc2\n\\xd2\\xd9~\"iyt"
  450. },
  451. {
  452. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\x9c\\xd5\\xca\\xba\\x8c\n\\xb46\\xea\\xb3\\x92%z-\\xc3\\x18v\\xe9*\\x0f\\xc8\\x93\\x83t]\\xab7\\x8b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  453. },
  454. {
  455. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xd4\\x8a\\x1d\\xc5b\\x0b\\x82\\x9dh\\xc0\\x83\\xf3\\\\xfdjbc\\x96d\\xb3sy\\xbe\\xef\\xcb\\xf6\\x11\\x8e\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  456. },
  457. {
  458. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04!pc\\xd4\\x858\\xb7\\xe2\\xbf\\x17y\\xef\\xf7\\xfbu\\x1d\\x9e\\xd8\t\\xcd\\x9c\\xd1\\xd4l4{l\\x9d\\xca\\x83g}o\\x7f\\xf9\\xd9\\x96\\x84\\xec\\x99\\xf8x\\x86\\x8fcz\\xa8\\xcb\\xa1\\xe3\\xd7\\x80|\\x9e\\xb0\\x98_\\xc8#\\x8d\\x98\\xaag\\x10\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000#\\xff+j\\xea\\xc5\\x0c\\x01a\\xf4\"\\x89x[p\\xc5\\x94e\\xe1\\xb0\\xf3\\x9c\\x1e\\xf2\\x0c=!\\xb4\\xacyub\\xaf<q&`\\x08wk\\x7f\\xf1o\\xa7l\\xaa=\\x0b"
  459. },
  460. {
  461. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x98\\xc4\\xe3\\xa0\n,]8\\xa0\\xa0\\xabo\\xe5\\xf1\\x94tb\\xca\\x10\\xeb\\x98\\xa19\\x87l\\xa7\\xf5\\x86-\\xbb8\\xeb6x\\xb6\\xcak\t\\xe4\\xb9]\\x02\\x81)\\xe6\\x8b\\xa8\\xc8\\xacp\\x8b\\xa5u\\xcdv\\x12o\\xd0\\x824\\xaa\\xff%=\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb0\\x0b/~\\x0c\\xf3\\<\\xbcu\\xceb\\x99\\x8a\\x00\\xe2 \\x93c\t\\xe0\\x12?\\x85\\x83\\x94\\xafm\\x84?\\x13\\xd0\\x8b\\xa0<\\x9e\\xd2\\x1dt\\x85\\xbb\\xeb\\xf95\\x82:\\x85\\xf7"
  462. },
  463. {
  464. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u\\x9fu\\x017\\xdbg\\x9f\\x97\\xce\\x93\\x9bf\\xeca\\xb3\\xacg`\\x08o\\xc2w\\x94\\x1f'\\xc9\\xc6\n\\xdb\\x0ft\\xa5\\x0b\\xe8\\xc8\\x05\\xafm\\x99u\\xfe\\x11\\xbc\\x06_c\\xe0e\\x14\\x96\\xca\\xff\\x81\\xbc\\x9c\\xbd\\xe9\\x1b\\xc2_\\xcd3\\x86\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaa\\xdad\\xd4}\\xfb\\xca]3ss\\xfa9o\\xcaa\\xf7\\xb4d\\xae\\xb7\\xec)\\xa2r\\x91\\xf9i\\xb8l\\x18\\x1d\\xb7\\xf6jz\\x81\\xba\\xae\\xfdu\\xf3y\\xaf\\x1fw\\x85\\xef"
  465. },
  466. {
  467. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x88\\xbb\\x96\\xb6o\\x0fx|zv*\\x00\\\\xbb\\xa9\\xb9o\\xe3\\x8b}qf\\xaa\\x10\\x8at\\x1e\\\\xbd\\x03'\\xc6h\\xfaf\\x10j\n\\xd0\\xe9\\x93\\xc4x\\x89\\x16\\xefy\\xc7\\xcd\\x0f\\x94`\\xd6g\\x04\\xdb6c\\x12u\\xe9\\x17\\xfb@\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd1j\\xf0e\r\\x06\\x97\\x16\\xbc\\x00\\xd2\\xb5\\xe1\\xb3^\\x03p\\xce\\f@*\\x85\\xe9\\xa6`\\xf2-\\x18\\x9e\\x18\\xa1\\x11\\x16\\x14\\x8d\\xc3\\x93\\xcb\\xa7p\\xe9\\x1d\\x08t\\x12\\xb0\\x16"
  468. },
  469. {
  470. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82\\x920@\\xf9\\x94,\\xf0[\\xa1\\xfc[0\n_\\xdej\\xa7\\io\\x065\\xe1?on\\xa6\\xbc\\xca,f\\xffx\\x8f$gh\\xd2\\xces1oju\\xfc\\xfe\\x0ed\\xafe\\x8egj9@\\x9c\\xb6\\xd0w\\xba\\x83'm\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfb\\xf0!\\xf0\\xde\\xf9\\xcev\\x17u9\\x8e\\x86)_\\xb1\\xfd\\xb942^\\x91z\\xc4\\xb9.\\x1d\\xa9\\x8e1\\xba:\\x05\\xd8c\\x12j\\xa1\\xf2c\\xe5t\\xf1\\xf3\\xa94\\x0f."
  471. },
  472. {
  473. "http_request": "winword.exe_WSASend_^\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x08\\x05\\xa1\\xb8\\x8b\\xacg\\xfa8\\x9e\\xa1gera\\xea\\xd4\\x85\\xe3\\xf3\\x9a\\xf1m\\xce\\x8a\\xec&\\x01\\xb9\\x97\\x15\\x83\\x98\\x11tv*\\xbd\\xe8-\\xfd\\x8ey\\x80\\xb6;im\\xc4\\xc2vrdp\\xd0?\\xc7\\x04>\\\\xfb\\x9a\\xdf\\xa4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\t\\x19m\\x9f\\x1at\\xc0\\xf8[\\x1a\\xf52\\x7f\\x16\\xe2\\xbfg\\xe4c\\x9bv\\x1f\\x84\\xb1\\x9a\\xfe=bs\\x84\\x1b\\xc1c\\xd9\\xe8g\\xd2\\x92\\x04\\x17)\\x7fe\\xf4\r^\\x8e'"
  474. },
  475. {
  476. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x042\\\\xc0l\\xee\\xfe\\xb2[;{\\xf2\\xd5z;\\x13kd\\xf4\\xb7vd\\xddw[\\xbc\\xaf\\xd9t\\xfd\\xeb?\\xd9t\\xaf<\\x9c|\\xe0s\\xf2{\\xb3)\\x82rbosl\\xca\\x08\"\\x18\\x17\\xfe\\xc18\\xfe\\x01r\\xdc\\xf7\\xaf\\x93\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaf\\xb2\\x17\\x7fe\\xe3\\x1e\\xddr\\xbe5\\xbb\\xa5b\\x08k\\xe6\\x0f'$\\x03#\\xd3\\xb9g\\x83n\\xc8d\\xa5\\xd7\\xa8\\xd6oj\\xfdsf\\x927\\xc54\\x1a\\x85\"\\xcd\\xa5\\xfe"
  477. },
  478. {
  479. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfc\\x10\\xb0\\x99'e\\xa8\\xad\\xca\\x04\\xf1\\xe7\\x018$\\x9b\\x94\\xb8d=\\i\\x0c\\xfd\\xdb9\\xb3}\\xa1\\xab\\x1c\\xe7_\\xa2\\x93\\xe4\\x07\\x07\\x9c\\xee\\xfc\\x13\\xa0\\xf1\\x88nz\\x03\\xcd\\x11\\xb9o\\xf5c~cq\\xa4\\xcb\\xd9c\\xff\\xfd\\x16\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x047;'\\xce\\xf9\\xe9>q\\xc5\\xb0\\x8b\\x99\\x1f`\\x9c\\xd5&\\x93<\\xf4\\x1f\\xf3w\\xcb\\xaf\\xf8\\xd4\\x8a\\xf7\\xd0\\xa8n\\xf6c\\xbb\\xa9\\x87u\\xd8x\\x8f=\\xa5\\xf6=\\x0b_"
  480. },
  481. {
  482. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8b\\x04\\xdb \\x8a\\xe1\\xaa\\x17\\xc5\\xda\\x83\\x9e]\\x0c\\xb3\\x8f\\x08\\x96*\\x03\\xf3*\\x15\\x0218\\xce\\xb5~\\xe2\\x1b\\xa4 \\x0f\\xac\\x88\\xdf9\\xd7\\x90\\x19\\xcfz[\\x02f\\x904\\x01\"?\\xe1`c+\\xc8j\\xb1\\x0ct\\xd8klx\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xde5.\\xeb\\xe6>v\\x12~\\xf7\\xf9m\\x90`\\xc07\\x17ty\\xdc\\x9b\\xe3\\xb2+\\xae2^y\\xf4p8y\\xfe\\xe8)<\\xd6\\xf4\\xf3`4>\\x12p\\x16\\xc1\\xc0/"
  483. },
  484. {
  485. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa7&\\x82\\xc9l\\x15jw\\xd82\\x8b1\\xb9\\xeba5\\xce\\xf7\\x9a\\xaf\\xca\\xa7\\x0b7\\xda\\x9a\\x82\\x05\\x9c$m\\xe6\\x0f\\xd6/\\x85\\x91\\x1b\\x006\\xcau[\\xb3\\x00v{\"o\\xda\\x1c\\x8fy\\xbc7\n\\x16\\xbe{\\xbc\\xb1m\\xb8\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000wq\\x8a\\x1d\\xb6.\\xd0\\x10\\x13\\x0c\\xda\\xc2\">9\\xb7\\xc2s?.foh\\xd9&\\xc4\\x04'xs\\xd6\\x88i\\xdc\\x06ldx\\xb1\\xdb[\\xada\\x00;\\xacyo"
  486. },
  487. {
  488. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x00{\\x99\\xeb\\xf6\\x81\\xee\\x8f\\x05h\\xe7|:o\\x16u\\xc6\\x9c\\xf8\\x91\\x11\\x10>w\\xca\\x9e<w\\xbce\\xefu\\xf7\\x83\\x83\\xf4\\xcf<\\x1a\\x12\\xc3q\n\\x9a\\xc9\\xcb\\xa0f\\x94j\\x80h\\xe6jca\\x7fs\\x96|\\x83<\\xd0\\xe9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xef\\xa3\\x8b>\\xe5]k\\x14\\x95\\xc1g\\xebz\\xae\\x9bz\\xa6\\xea\\x9e\\x1d+\\xb4\\xce\\xc3\\xa1@\\xe4\\xc238(h\\xe4\\x97\\x96o\\xb5\\x07\\x91~\\xa1\\xc1:\\x823o\\x9c\\x8c"
  489. },
  490. {
  491. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1e\\xe9\\xbcb\\xb3\\xa0\\xc7\\x85\\xc6\\xee\\xb34$](\\xa6\\x910\\xcd_\\x05\\xb5q\\xbf\\x8ba\\xe2\\xa6\\x03w\\xed]\\x90\\xe2\\x19zi\\xc06\\xab\\x18\\xc2\\xdf.\\xd0\"\\xcd7\\xc3w\\xc2\\x1c\\x03\\xb7\\xa8|\\xb4h\\xea7\\x8c\\xaa\\xb6\\x95\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcaq\\xa9\\x15\\x9c\\x96\\xd36\\x0b\\xc4\\x10\\xad\\xb7\\x81\\xdb\\xd1q\\xbe\\xa7b8\\x15\\xb1\\xd1\\xfa\\x84\\x19\\xfb\\xe6\\xf4\\x90\\xb7\\xee\\x80\\x0e\\xb0\\xf3t\\xff\\xf5\\xb1\\xab\\x82_\\xd6|$\\x93"
  492. },
  493. {
  494. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04:%\\x85n\\xc9g`\\x11\\xc3\\x0cxnb\\xe7n\\xe9\\xdd:\\xcd\\x8c\\x19o\\x16\\x19!i\\xb5\ru8-5\\xf3\\xb9\\xabd\\xc1\\xa9%\\xde\\xca~\\x80vtl\\x17\\xd6w\\x04\\xeb\\xfd\\xff\\xab8\\xba\\xe1\\x00\\xa9\\xd5\\xc5\\x8b<i\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd2\\xaf:wi\\xc5\\xf9\\x07\\x84\\x96{\\xfb\\xe1\\xb3\\xc6\\xea\\x93\\xd7z6\\xb4\\xed\\xb6*|\\x18\\x9f\"\\xf6\\x8c\\x18\\xe9j\\x144\\xaa\\xaa\\xe8oe\\x1bul\\xe4v\\x16\\xee\\x0f"
  495. },
  496. {
  497. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee6z\t\\x8el\\x92\\xd0\\xbaqp\\x83\\xe64\\x9ex\\xfb>\\xfa\\xa63>\rw\\x1agf\\x1f\\x1d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  498. },
  499. {
  500. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xad\\x96\\xa8\\x89\\xb5\\x0b\\x00z\\x93*\\xa2\\xf5\\x88\\x0e g\\x1b\\xc4\\xe3\\x0b\\x9f\\x8cs\\xc7\\xe4\\xf18\\x00\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  501. },
  502. {
  503. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xb8\\xe6n-\\xfb\\x9c\\x96\\xa8\\xd7\\xae[\\x99\\x155\\xa1g\\xa7\\xf2yj\\x13\\xb3\\x1e\\x9c\\xe5%\\x12\\x8c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  504. },
  505. {
  506. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\x13\\xb0#\\xa0\\x07\\x1a8*\\xc4\\xf5\\xa9\\x06\\xc2\\x8d\\xaa1~\\x7f\\x00f\\xc3\\xa3\\xc7\\xf8s\"\\xca\\x84\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  507. },
  508. {
  509. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\x0bt5\\x9c|\\x05\\x1d\\xbb\\xdcp\\x88kd\\xe9\\xfd\\x1d\\xe8\\xb6\\xe9\\xc8\\xb1\\x03\\x95\\xd2\\xb2\\xb8\\xa1\\x1a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  510. },
  511. {
  512. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0een\\x07\\x1e\\x1eh\\xee\\x87v\\x88\\xab\\xd7\\x7f\\x9b\\x8e\\x82\\x1e\\xab,\\x07\\xe3\\xb4o5y\\x99pg\\xbc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  513. },
  514. {
  515. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbc_\\xdah0\\x1f\\xa0\\xb2\\xad\\xdb\\x05\\x1aq\\x07`\\xcd\\xb39rg\\x06\\xbfd3/\\xf9\\xe5\\x1d\\xd7\\xb7\\x12\\x8d\\xeb;;\\xd6r\\x02\\x0c\\x92\\xad\\x86\\xf3t\\x1cu\\xf9gdc\\xebok\\xbc?\\xef\\xef\\x8f%\\x10\\x01\\xbco$\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd7\\xcfmd\t\\x93\\xc5h^q\\xbec\\x8b|\\xac\\xdb\\xaf\\xfc\\xed\\x86\\x8f\\x8c)h\\x98\\x8czt\\xae*\\xbb(\\x14-\\xddmdi\\xec\\xa7\\x86\\x87\\xf5\\x12\\x88_3c"
  516. },
  517. {
  518. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x99\\xa7a\\xd6\\xd3\\xd1\\xbb\\x14)\\x0c\\xb4c}\\x84\\xe4m\\xdf\\x98\\x1d\\xfftzp\\xa9\\xc0\\x0fu\\x95\\xe5\t\\x13\\xa1\\xb8?\\xae;\\xa4\\xaax0\\x98\\xd3~\\xf3d\\x17\n\\xd2 \\x14\\xa0\\xe1`\\xa3\\x063#\\x9c\\xd2\\xe2\\xd5\\xb8\\xfdw\n!\n\\x91hm\\xaf\\x99nk\\x0ek\\x8d\\xbc\\xe4\\xe5\\xc1\\x8c\\xeb\\xbf\\xf7q\\xf0%\\xdb\\xfe\\xb3\\xb8\\xb7\n\\x1b\\xd4q&\\xbfj$\\xc5\\x15*\\x0c\\xc0\\xf0\\x18pw_\\xc3\\xe9\\xb6\\xf9]`\\x92\\x8d\\x15\\xd8\r\\xc0\\xda\\xbe\\xfc\r\\xee\\x85\\xee\\x94\\x08\\xe8q}\\x857\\xfa\\x1c^\\xb72\\xd6\\xc4\\x8e\\x17c\\xc1\\x00rv 5\\5s7\\xb4\\xc1\\x96\\x0fz\r\\x91\"\\x96\\x0e\\x936\\x842\\xa42r\\x9e\\x93\\x89\\xd2\\x94d\\x1b\\xed\\xe4a\\xfe\\x02\\xdf\\xe2\\xe3iy\\xc7\\x0cn~\\xdf\\x85\\x1bg\\xbb\\xf9\\xa8h\\x0c\r\\xc7\\xce\\xf6\\x18\\x8a6\\xcdn(\tt\\xe3\\xa4\\x98\\xact\\xde\\xee\\xc1\\xf2\\x05\\xd9\\x14y\\x10\\xcd2\\xc9\\xdez}vj%\\x9d\\x97\\xedm\\xa9y\\xcc\\x93\\x13g\\xc1\\x13"
  519. },
  520. {
  521. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\x08\\xee\\xc7\\xd8\\x90\\xed5\\x1c\\x9f|\\x8a\\xb7<\\xa7\\xde\\xc0\\xc6\\x14\\x0fj^\\x19\\xcb\\x19\\xa1\\xd1\\xca~\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  522. },
  523. {
  524. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee]\\x8c\\x86\\xd3\\xc7\\xb7e\\x93\\x01\\xffq\\xb8\\xb5m\\xe0\\xb2\\xd9\\x81\\xf4\\x0b+;[3\\x1d\\xc7\\x9fg\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  525. },
  526. {
  527. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xb3\\xb6\\xa1\\xd7\\x97\\xd1\\x14c\\x95\\x984\\xddhho:\\xda\\xdbd\\xba\\xd4\\xb7_i\\xc1\\x95af\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  528. },
  529. {
  530. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\x98^\\xb9\\x0c\\xcb\\x9fc\\x97g\\x91:\\xd4\\x94\\x10\\xc2)\\x18\\x9b\\xb9i\\x14?\\xd63\\xd9\\x05\\xe1^\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  531. },
  532. {
  533. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04a\\xa2\\xff\\x1b\\xda\\xcc\\xf1\\xcd\\x19u\\x94\\xd0'y\\x04\\x16gx\\xf3\\x13\\xa8g\\x05\\xbc\\xc7\\xa2\\xde\\xd5b\\xb6)\\xfd\\xbf\\xc2lw\\x99\\xb8/s\\xb0@{\\xf0\\xb0'm6\\xfc\\x87\\xd8.\\xb1m!8t\\x0e\\xa7\\xf4\\x8d\\xc0\\xba`\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x11\\xfe\\xb0\\x10\\x1ax\\x9a\\x89\\x0f\\xf9\\xc1\\xc6sa<s\\xa5\\xd5\\x04\\xe3\\xa1\\xe7f\\x15d\\xbe1\\x0e)f\\x83\\xa7?\\xaf\\xbau/\\xaf\\x9a\\xc7\\xe0\\x9e\\xb9\\x88\\x19g/\\xb0"
  534. },
  535. {
  536. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd5\\x94%\\xa6`\\x1ck9\\xe8\\xb8\\xf3\\x9atq/\\xa4\\xf6\\xe71lw=\\xda\\xf8\\xcav\\x14\\x94\\x02|h\\x8d\\x98\\xca\\xad\\xc0\\xc6\\xf1v\\x87;k\\xa3\\x03\\xb74\\xc1\\xc8g)n\\xd7\\xb9\\xcb\\x11\\xfa\\xe0\\xdc\\xf2\\xcdq\\xcd\\xaf<\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc4\\x8a<u\\xe5\\xbf\\x1fz\\xf4er\\xe3a\\x82\\xe8\\xbd\\xed\\xcc.\\xa6\\xfbq\\x80\\xc8\\xe6\\xaeu\n\\x19\\xd2xn\\x16\\xa7=\\x1f\\xbf\\xf3m\\x8f\\xe4+p`k|\\xff\\xd7"
  537. },
  538. {
  539. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x82iy\\xc3\\xf2\\xd0\\xfd\r\\xd7\\xcfg\\xa5d \\x12{\\x8c\\xff\\xf2\\\\xaez\\xcfa\\xd6\\xc6/\\xf8\\xd2t\\xa0a\\xdd\\xad\\xff\\xba\\xb3\\x17\\xa4^!s\\x1ba\\xe6\\xbey\\xf8\\x810\\xdb\\xe9\\x83p\\xce\\x9dk\\xf3\\xe06wq=\\xe5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc8\\xd9\\x84\\x82\\xc9\\x82\\xa08\\xf6\\xb4si8\\x0f\\xe8{)\\x9e\\xe8\\xad\\xb2^\\xf5\\xb0nmxvv ^\\xd8\\(\\xe6d\\xd8n!\\xd5\\x06d\\xbd\"\\xean\\xe2\\xf2"
  540. },
  541. {
  542. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa7n\"\t\\xaf\\xdd7g\\xafr2h\\xab\\x9d\\x0ema)\\xed{\\x83/@b\\xe3\\x9d;\\xbd\\x98y\\xfa\\xe6\\xfb<\\xf6\\xed\\x00\\xb3\\x07s\\x9a1\\xe3@\\x1e\\xfev6/\\xfe>\\xbe\\xb2\\x91xh\\xdd\\xdaij\\x18\\xe8\\xa4\\x89\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd9+\\xdf\\xa9l$\\x16\\xe69\\xb4\\xbc@u\\xf1|\r\\xffkg\\x9f!c\\xdfg$\\xb0]c\\x119\\xb1\\x05\\xe8gps\\xd4ux\\xb6pw\\x80\\x11ld6\\xdb"
  543. },
  544. {
  545. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04i:\\xb9\\xcd\\xb6\\xd4\\xb8\\xa5\\xa9\t\\xebb^\\x0b\\xd0\\xb1\\xb3\\x82m\\xf6o(\\x0ch[]\t\\xc1\\x7f\\a\\x13[o\\xden~\\x11\\x1b\\xf3vm\\xae\\xb9\\x92\\xf4\\xcc\\x00\\xaf\\x12\\x9c\\x8e\\x00\\xbf\"2+\\xe3&\\xa5\\x06<u\\x15\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc4\\x88p\\xe9\\xad\\xdfx\\xdd\\xce\\x15\\x8e\\xdce\\xf2c\\xef\\xfd)\\xc2q\\xbb\\xa0\\xb0\\xd2\\xf9z)\\x05\\xd8\\xff\\x8d\\x82d\\x1e\\x13\n\\x02>^\\xf6g\\xd5\\xbc\\xb0\\xdbn\\xe6p"
  546. },
  547. {
  548. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#\\xef\\xd1.\\xcd\\xf9\\xdc\\xe5cg\\xbd`\\xf3\\x1b\\x86g\\xa0\\xfe\\xbe\\x9d\\xb5y\\xc3.\\x07rb\\xa1j\\x8d\\xa4\\xd3\\xe6\\xd8\\x8bv\\x8c\\xc0nu\\xa1\\xd9\\xb7\\xb3r\\x82\\x00\\x8e\\xddx\\xedl\\xeb]\\x9287\\xa1\\xd9+\\x86wl\\xcc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000-\\x90\\xe6t\\xf6\\xd9\\xc7\\xc4\\x0c\\xe9g[l)\\xdc\\xd2\\x8fh\\xe1-\\xae%w9\\xa9\\xbf2\\xf3>@\\xf6\\xa1\\xe1f\\xd5\\x06#z_\\xd7\\x8au\\xc7\\x19e\\x05\\xb27"
  549. },
  550. {
  551. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xbd_\\xbe\\x82\\xe8\\x01\\x0b\\xa7\\x99j\\xc4\\xfbm\\x98\\x08\\x16~\\x8f\\x9b\\xf8\\xe0u/\\xed:\\xf2v\\xee\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  552. },
  553. {
  554. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5\\x07\\xfd\\xa19\\xc6\\xc7\\xd1\\xf2 't\\xe5\\x88\\x7f\\xdf\\xf3\\x04\\xc1\\xe9\\x9f\\xc2\\x82\\xcao\\x92\\xcdh=8\\xa1d\\xadn\\x87\\x1ex*\\x9d%]\\xf3\\xf4\\xa7\\x0f\\x08\\x10g1\\xa7j\\xc1\\xa1\\x8a\\x13w\\xf5x1\\xf7\\x11u\\x85\\x04\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8c\\x15\\x17\\xca\\xbd>gv\\x89\\x9b\\x15\\xff\\xba&\\xcf\\xa3\\xd6\\xf4\\xde.rz\\xd3d\\x19$\\xb9\\\\xc9\\x9c4.\\x92*\\xa2c\\x8f\\xdf\\xba\\xc0\\xa3(ad\\xdb\\x16m\\xe9"
  555. },
  556. {
  557. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xa1\\xc6\\xa9\\x13\\x03\\x826z\\xa0k5\\xbf \\xe3wi$<\\xb6\\x89e\\xc0co\\xa3&\\xdb\\xeb\\x96^\\xef\\x07\\x9d\\x0e\\xc4\\xa4\\xef\\xc5\\x14dr\\x03\\xffe.\\x04n\\xd3\\xa4\\xc3\\x12j\\x96m\\xe1\\x95\\xf2\\xbe\\x9a\\xf9\\x84\\xce<#\\xbfa8?\\xdb\\xf3\\xbb~\\x82u\\xab\\xb1\\xfa\\xd6\\xdf\\x19\\xd3l\\xe8cr\\xf5&+8\n\\xcc\\xbao[\\x9d\\x804\\x96t\\xdap;\\x0c0\\xfc\\x88\\x10\\x90\\xdf\\x9e\\xa3\\x1abjk\\xaf\\xc5.\\xcf\\x98\\xad\\xa0\\xc0h\\xfb\\xe4\\xaeh9m\\xea\\xb1zzh\\xe6\\x92\\xe2\\xc3i\\xf9\\x8d\\xbe\\xb0\n\\x19\\xdco\\xa6cl\\xde\\x02g\\xad\\x11\\xe5\\x11\\xc0\\xc4\\xd5\\xc2\\xbdrc\\xbc\\x0f\\x8bv\\x8b\\x98\\xf6zq\\xde\\xc18\\xdab\r\\x8f\\xf8u\\xae\\x11>\\xd32zmv\\x1dski\\x0b\\x81\\x8a\\x9a\\x03\\xa8\\xc9a\\xe5\\x01\\xfdf\\xbaq\\xa0\\xce\\xb6-\\x0c0\\x06\\xa2\\x9bf\\x8d\\xaer5\\xc0o\\x91j\\x9by\\xed\\xc6\\x17i\\xa5o\\xf3q\t.\\x0ej\\x8ak\\x82\\x16\\xa1\\xb1t\\xdc\\x94"
  558. },
  559. {
  560. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb6\\xa9\\x97m@\\xe9\\x81yx?\\x13\\x1e\\xa5g\\xb5\\xab@hx\\xdd\\x12z\\xaf]v\\x8b\\x1a\\x1f\\x9b\\xdd|\\x1f;|ec-\\x1d\\xbb\\x13\\xbfc\\xf9@b\\xb3\\x93\\xe1z\\x95\\xf1k\\xb5\\xac\\xeft\\x9fnw*\\xd9\\xd3\\xca\r\r\\x04a\\xfd\\xd0\\x99`\\x96\\xf6\\xc1\\xff\\x81#\\xa9}i|n\\xc4\\x93\\xfe+\\x7f1\\x1b\\x87m}\\x17b\\x065\\xa1\\xa4\\xb7\\xc3f\\xf8 \\x87v;\\x9d\\xe7\\xcd~#m\\xc8[y\\xaa\\xa21\\x9a\\xc4\\xd6p9\\x15\\xf7\\xef\\xe1c\\xbc'\\xf6\\xf2\\xfbr}\\x02\\xa1s\\x82$\\xe1g\\xcd\\x1e\\xfdc\\xe4iwb\\x00\\xeb\\xe4\\x1b\\x1f\"\\xb4\\xff\t\r o.[gdqa\\xfc8z\\xfc\\x04)\\xc2\\x8e9\\x9e\\xc2\\x97\\x8d\\xfevyj\\xa3+e\\x13>y\\xa8\\x19\\xcf\\x92>\t\\x96\\xd6\\xe9\\xb1\\xa2q\\xb6\\xc1px;w\\x93\\xf6\\xb1\\xfe\\x87\\xde.^\\x0b\\xf7\\xc3p|\\x9c\\xbd7\\xb7x\\xbc\\xc5\\x1d\\x9b\\x13d\\x8f\\x83(\\xd9\\xacw\\x96\\xf0|n\\x99}\\xb6\\x1a/\\x00?!"
  561. },
  562. {
  563. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa1\t\\xba\\xb3&~\\xb1\\xa5\\x1bh\\x90]\\xa8^\\x11\\x08k\\xcc\\xd3\\x0f\\xef\\xa7\\xf8w\\xc2\\xf4q*\\xad\\x1e\\x05w\\xb2\\xe4\\xff\\xf1\\xd7\\xb4<jv\\xf8\\xa9;\\xb1/\\xc7\\xed\\xccz\\xac\\xf9x\\x18\\x18e\\x1do\\x946\\x98%\\xf8\\xee\\x80\\x1d\\x14\\xdas\\x04a\\xc6\\xed\\xcc\\x99\\x92+t\\xe2x\\xe2\\xd2<\\xd8mca\\xc8\\x11\\xf1&m\\xe0\\x1cz>\\xaf7sy\\xfa\\xa1\\x08\\xd4\\xf5~\\xf6q\\xe3\\x97\"\\xfcq\\xf6\\x9d4\r\\xcc\\x01<t\\x89\\xe9\\xa0\\xb7\\x18\\xa5\\xa4d\\xa3p\\xbbn3s \\xe5\\x1f$\\xab\\x97kp\\xed<*\\xb3\\x91e\\x87\\xf4]\\xe3\\xf3\\xd5q\\x0c\\xe7z#\\xcf\\xd0\\xf6\\xe0\"\\x8d\\xa8\\xb3\\xaf\\x1ftbm\\xc3d/\\x88\\xceq\\xdd\\xd2`\\xf8\\xe7 |\\xc6kry\\x81\\xb1mti\\x04\\x0c\rht\\x9d}\\x0bq\\x8f6)\\xcc\\xde+\\xd8s\\xf2\\xafy\\xdc\\x0c\\xfda\\xd0[;hs{\\xb1b+\\xa3\\xc27y\\xa6\\x85\\x94\\xcek;t\\xc7\\xa92\\xc1\\xe8\\xf7\\xffl\n\\xaa\\xa3\\xc5"
  564. },
  565. {
  566. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\x81\\xf0\\x13\\xaf\\x18\\xef\\xa4\\xb3\\xfa}\\xb1\\xb9\\xd6/a\\xd0,\\xef\\x02#<\\x15{\rc\\xe6\\x7f\\xaa\\xe7\\xd9\\x1a\\x1a\\xc0\\xdd}t~u\\x8e\\xed\\xd20gi\\xa9\\xa3r6\\xec}\\x8c\\xf0-\\x897\\x0b\\x99\\xc4\\x85\\x1f\\xa7\\xe6\\x87\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x04dl \\xdd\\x90* m\\x8a\\xfb/)\\xcd}~\\xc9\\x0b;]\\xed\\xee\n\\xc9mo\\xd3\\xb9b\\xc3ct\\xe0\\xfbqe\\xf1z`\\xb3\\x8f0\\xc6\\x1a\\xeeqou"
  567. },
  568. {
  569. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04ee\\x00p\\xce\\xa8\\x9d,\\x1d\\xa3\\xc5\\xa0\\x04\\xc8\\xd3\\xd4\\xc5\\xc5;\\xeb\\x0eq\\xdd&\\xf9\\xa2#ab\\x1c\\x02g\\xe9\\x07h\r\\xa6\\xbf.@\\xfd\\xed\\xfdx\\x96{\\x01\\xfbn\\xfa;+\\x1a_\\xa59t\\xedpm\\xf7\\x1dw\\xe4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfe\\xe2c\\xfa\r\\xdc<\\xb8\\x02d\\xdda\\xc0\\xf1\\x1d\\xd0\\xaa\\xb3|q\\x02\\x06\\xc1n\\xe8y\\xae(>\\x9b\\xbc~\\xeb\\xbb_e\\x98\\x90\\x8e\\x99)d\\x92\\xd4dh\\xbe<"
  570. },
  571. {
  572. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0eex\\x9d\\xc2\\x9ca\\xa5\\xb0\\xd2\\xdeo)$ei\\xe7\\xf7~w\\xc1j\\xd9\\xe8q17t\\xfa\\xb4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  573. },
  574. {
  575. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xf2\\xc1\\xb9\\x034 \\x14>\\x1a\\xcd\\xc8\\xb9'\\xe0e\\xba\\xf6\\xdb\\x11!xg\\xean\\x96\\xc7\\xfe\\xd6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  576. },
  577. {
  578. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0eed\\xee@\\xf17)+\\xe5\\x0cu\\x16\\x1azg\\xbd\\xdch/\\xa6\\x16c\\xfa\\xfa\\xa8n\\xb1\\xc14\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  579. },
  580. {
  581. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xa6\\x9d\"\\xf0\\x9aw\\x90\\x15\\xb0\\xbc\\xb0r\\xe6u6%r\\xef2`\\x16\\x9e\\xfd+\\x06\\x97\\xdd\\xde\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  582. },
  583. {
  584. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee$\\x87\\xfd?m\\xcdk\\xa9\\xf4z\"]\\xb4\\xb5\\x8d\\xe9 \\x9b[\\xa3\\x88j\\xef^2n#t\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  585. },
  586. {
  587. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0101_\\xebj\\xfb\\xf6ni\\x0c\\xb8@l\\xe5{s\\x1a>\\x8d\\x9f\\xc5\\x0f\\x9f\\xd6\\xd3\\xb8\\xcb\\xe2n}u\\xb6\\x16z\\x7f%\\xd36\\xc3\\xf7\\x99\\x18k\\xe6\\x85{\\xc3l\\x85\\xb4\\xdd2]\\x85\\xb1\\xb0\\xaev\\xa8\\xaa\\x8ak\\x110\\x02\\xd1\\xe6\\x9a_\\x17\\xf6h\\xf5\\xb2\\xb0\\xbej\\xf4\\xec\\x9c\\xc8\\x13\"\\xb2\\xcba'\\xce\\xdb\\x116\\xc0\\xa0o\\xad\\xd8\\x94ux\\xa1?\\xce\\xa9\\xe1\\xc8\\xda\\x92w\\x82\\xc8;\\xd4\\xbe\\x1a\\xa1\\x83\\xfe\\x8b\\xd2\\xf2p\\xc8\\xaf\\xe5\nm)\r\\x02q \\xc9\\xdc\\xb51\\xed\\xdft\\x99\\xff\\x08\\xe7\\x8eg\\xb7<\\x19\\xfc\\x9e\\xd2\\xdc8\\xddm\\x8a\\xdc\\x11\\xcc4q\\xeb\\xa4d\\xd6\\x15%\\x9c,\\xd6\\x81\\x86\\xe0\\x0b\\xf3\\x06\\xae\\xeb}\\xb3mp\\x97w\\x8cf\\xf8\\x90v\\xf3\\xf2c\\x02m\\x82\\xe0:j\\xfa\"s\\xa2k\\xed\\xb7tw\\x1c\\xd1\\xf9\\xdfe:g\\xfa'\\x01]\\x9d;\\xcf\\xa7\\x11\\xf8k\\xf4\\xb5o{h\\xa3\\xc9a$\\x91\\xf4\\x17\\xfb\\xdc\\x9f0<l\\xd8r\\x14r\\xd1\\xa4\\xc0\\xbd\\x93\t"
  588. },
  589. {
  590. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc9dch\\x049\\x9a\\xbf*\\xcb\\x993<\\xe5\n:{\\x7f\\xddix\\x17[\\x80\\xbd\\xb2\\x91\\xb9pc\\xc7f+\\xb4e\\xe2\\xd0\\xf0\\xab\\xe6$ai\\x0f\\xe4\\xa8ok9w\\xc2\\x87\\xf4\\x1a\\x8da\\x98\\xbb\\x03a;\\xb3\\xa2\\xccb\\x85\\xe5\\xc5\\x1c#~hy7@s\\x94\\x89p\\x18\\x9a\\x8a\\x12\\xc6\\x9fc\\x15\\x9b\\x13\\xb8\\xc6\\xb6\\xa0hm\\xd13#\\xf1\\xd9\\x99\\xe8\\xf8'}z!\\x87\\x91r\\xfe\\xe7%np0m\\xab\\xec\\xae4n\\xeb\\xd08\\xa2\\xc0\\xd5\\x14\\xc1b\\x89\\xcdx\\xec\\xc9\\x80_\\xe8l'\\xbe\\x99\\x9e\\xf4r\\xe1\\x92!y3\\xc7m\\xc5$h3\\x80d\\xfd\\xd6\\x1b\\xd5\\xad\\xa5i\\x04jmh+a\\xd7\\xdf\\xed`:b\\x93uog\\x17\\xbd\\xf8\\x84\\xa7\\xc3\\xf5\\xaf~g\\xa4pe_\\xb9\\x14\\x868\\xb5\\x90\\.\\x85\\xf9\\xf2\\xe9\\xc6'u<r]\\xb2\\xb6\\x86\\xb9p\\\\xd8,\\x10\\xbbz\\xff\\x04z\\xffa\\xf2xz\\xa4u\\x14\\xbdd\\x15q\\x144\\xe31$\\x19)x\\xb9#b"
  591. },
  592. {
  593. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf8\\x03\\x15?\\xef8yt\\x15\\xad\\x961?\\x87\\x9e]\\x89i\\xf3^*\\x1d\\xddt\\xe3\\x92\\xce\\x99\\xcc\\x99j\"%\\x14\\xac\n)\\xb6w`53\\xe7\\xef\\xf6a\\xb4\\x13\\xa9eu\\xd1\\xc4\\x8f\\x0fo\\x19k+s\\xc0;\\xee\\xfc\\xd6?#4@\\x0e\\x9a\\xc8j$\\xd5b\\xe3~0\\xaa\\xba\\x9b^yq\\xe5\\xef,\\x1c\\x99\\xe2#\\xe0\\xbb% n\\x8e\\xbc\\xc2\\x8e\\xd7\\xc1mn\\x87\\xd2\\xa6^\\xc2\\xdf\\xe5\\xc5\\xabg\\x04\\xe3\\x81hd\\xab\\x08d\\xc0\\x03\\xae\\xa5\\xf5\\x9d\\x92o\\x05v*\\xb6\\xc8q\r\\xa4\\xd6`\\x7f\\xdc\\x0f\\xc2m)\\xcar%\\x15\\xa0r\\xe9\\x17\\xb7\\xb4&6\\xd4\\x00\\xda\\xbb\\x81`|\\xe4ou\\xb2\\xe1\\xaf\\x12\\x87s\\x02\\xf0iu`p\\xec\\x8a\\xc7\\xe2\\x05\\xee\\xc8)\\x88%\\x9a\\x85\\xc0\\x1e(\\xfc2\\x98\\xca\\xfal\\xbcu\\x8d9\\x13n\\xf0\\xb4\\x87\\xb2bo\\xdb\\x9d\\x91o\\xaey\\xa8up\\xb8\\x1d\\xdf\\x0cdt\\x93\\x87\\xcf\\x8c\\x97\\xf9z\\xe2qm\\x9d\\x1d\\xb5\\x98\\xb9\\xaak~3\\xfa\\xddq"
  594. },
  595. {
  596. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8b\\xf5\\x15q*\\\\xed\\xb2\\xf2\\xed\\xde\\xdc(0k\\x07\\x9e\\xa1\\xd5+x\\x81\\xb8`(f]\\xf8d\\x05\\xc4\\x98\\x1bzyvg5(\\xa8-\\x98\\xca:\\xe5\\x8f\\xc0)\\x10!\\x19\n\\x08\\x80\\xcb\\xbc;\\x19d\\xb0\\x01\\xa4`l\\x91\\xce\\xbb\\x81\\x87\\xe2n\\xfd\\xb6\\x13\"\\xa7b+\\x07n\\xe3?|\\x90\\xc5t?\\xa8l\\xaa\\xe1\\x009\\xdd\\x1b\\xbb\\xd8\\xaa\\x1f\\x84g\\xe2x\\x1bc\\x7f\\xee\\xd8\\xda!<\\x94\\x90rz\\x83\\x7f\\xc7r\\x85\\xea\\x98\\x1d\\xde\\xd6h\\xaf\\x0b\\xb3fe\\x8a\\x1e\\x83k\\xfa\\xa5\\xfd\\xa8\\xcafor\\x9ff\\xb1\\xbf\\xa3\\xc2}\\x1b\\x90\\xdc\\xa2v\\x12\\xe3g\\xa4\\xc6\\x06\\xffwy.\n\\x92\\xb1\\xe9q\\xb2\\xdb.d\\x920\\x88\\x80\\xb8\\x13h\\xefe\\x91\\x7f\\xfa\\xca\\x82\\xee\\x83\\xdf\"\\xbdn\\xcd\\x94d\\x1fw\\xde\"\\xa1\\xa8\\x7f\\x90\\x1c2\\xcb\\xa1\\x1c\\xa7\\xd2\\xbbd\\xf5\\xb9d(\\xe5\\xd78\\xb6|\\x084y\\xb2\\xda\\xee\\xab\\xa2y\\x0f\\xc6\\xec\\xe1\\x97\\xbf-\\x9e8:\\x85_y1\\xd56\\x01q\\xd5"
  597. },
  598. {
  599. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x96\\x106g\\xe5\\xe2\\x92\\x10b\\xa5\\x14\\xef\\x00\\x89\\x16\\xf5\\xca\\xc84p\\x92\"\\x08\\xf6\\x0c\\x12\\x06\\x7fkt\\x82\\x01\\x94\\x80\\xa2\\xfb\\x98\\xf53\\x1ei\\xe4\\x90u\\xc0md{^\\xd5[uc`\\x92$$\n{\\xc2/v\\x9d\\xe5\\xa3.n\\xf4z\\x84\\x80q_\\x1c\\x9b\\xa5\\xb6\\xf3\\xb1[,\\xd0\t\\x1b7\\xef\\x92\\xc7\\xf0\\xbf\\xad\\x1d\\xa3|\\xd5\\xb3\\xaf\\x0e^\\xac\\xf5\\xd6j\\xb6|\\x86c\\xc9\\xd2\\x17\"\\xda\\x87\\xe32\\xd0h;\\xa2\\x12|\\xc2f9e\\x89\\xdb.\\x05\\x12\\xa1\\xba\\xf280\\x9e\\xa9\\xa2\\xbfi\\x03\\x88\\xc6\\x1f5\\xf8\\xc3\\x06w\\\\xf32\\x9f\\xba}\\xd2\\xb8\\x19s\\xc7}jl\\xe0-11\\xf9\\xac\\xbc\\xdf\\x19\\xa3\\x0ba\\xcey\\x93s\\x1bx\\x10guj\\x05\\x82\\xf8\\xbf\\xfbvk\\xa9\\x88^?\\x8f\\xac\\xca\\xa1\\x1a?\\x00\\xbc\\x90\\xac,m\\x07\\xde\\xc8\\x93|\\x85\\xf0\\x14k4\\xd5\\xff\\xca\\xc2\\xe1\\x1a\\xbd|\\xec{\\xe6g\\xd5i\\xbc\\x9f\\x86\\xeb\\xfe\\xb2\\xdf\\xc3^\\xc3\\xb5u\\x0c\\xdea\\xd7\\x16\\xdc\\xdd"
  600. },
  601. {
  602. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xff\\xbb\\xe1a\\xa2]\\xd6\\xb6,\\xc4\\x01\\xe8\\x89\\xfe)-\\x1f/\\x05\\xd3d\\x8c\\x7f\\xb3(\\x12c\\x9eep\\xb4\\xf0\\x92\\xd3]\\x1ad\\xc0\\x83\\xc6\\xadg\\x12\\x1e\\xbd^^xh\\x85%x\\x82\\xf5\\xa1\\x86\\xee\\xed#<\\xf2\\xd1\\xf6\\xb0\\xcd\\x9fy|\\x8f\\xaa\\x8ca+\\xb5\\x01\\xdb^\\xedi\\x82\\x19\\x83\\xa0~\\xd4\\xd1\\xc7 \\xa5\\xb9\\xeb\\xba1\\xcde\\xc0c\\xc3p\\xe4\\xae|\\x92\\xd8\\xf9\\xde\\x13\\xd9\\xd2\\x06\\xd9\\x011\\xfc8\\xefu\\x83*l\\xfa\\xc107b\\xba\\x8b\\xfd\\x8a\\x8f*\\x16w\\xf8nc\\x1d\\x83ma\\xbc\\xa4\\xa3\\xcf\\xd0tm\\xb5\\xdf:\\xdfa\\xdf|\\xae\\xdd\\x9e\\xef\\x90\\x16\\xdfp%v\\xc1n\\xe1i\no3\\x9e\\xe1p\\xda\\xf3c\\xeb\tqa\\x93z\\xa1uy\\xf1\\xe6\\x07h\\xbe\\x8behb\\x15\\x89\\xe8\\x83]\\x1a\\xd8\\xd4\\xb4\\xba\\xffqi\\x19\\xb8\\x88\\x8a\\xbdz\\xb2\\x11\\x9dj\\x1a=`\\x9a\\xa8\\x08\\xd1\\xfd`/\\xef\\x16h\\xa4\\xfd\\x07\r\\xef\\xe6\\xdfb\\x1d\\x16\\xd25|0[\\x87\\x13\\xb4\\xaar"
  603. },
  604. {
  605. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9e\\xb7\\x94\\xc7a[<>\\xafub\\xb7\\x8a\\xfa|g\\xb2\\xb6\\xa9tx\\xf0j\\x16\\xec\\x8f,\\xdc\\xce\\xf3\\x0c\\xa5\\xf3\\xa9(\\xc5\\xa9\\x9a\\xab\\xb5\\xe0w\\xaagv\\xf3\\xc0c\\xb3\\x00\\x95\\xb5j\\xd0\\xd1\\xbe\\xf1\\xfe\"c\\x8eja\\xa4\\xea4\r\\xc0\\xa7\\x88\\x93\\x15\\xc8t\\x9fh`0\\xb8\\xa4f\\xb5 \\xe9\\xe5\\xf9\\xd0\\xb8\\xe6\\x16\\x94\\xe0f\"\\xbeo\\xc1~\\xac\\xf5\\xca\\xc7\\x8e\\xba?\\xca\\xdb\\xb8\\xb9\\x00/\\x8d;\\x97\\x05p\\xed\\xa6\\xe8\\x90\\xa3|\\xcf6:w\\xdc\\xbd\\x1c\\x0e?\\x86\\x13\\xb3kh\\xfa\\xed\\xbb\\xa0\\xcc\\xa8\\xc5\\x9e]\\xf6a\\xd5 e\\x05\\xaa\\xe7\\x12\\\\xda46gn=i\\xc9\\xb0\\xbes\\xa8\\xff\\xc2\\xf3d\\x03\\xae\\xbe\\xde/\\x17xg}e\n\\xb0\\xa1(8\\xa1\\x9de\\xb5\\xef\\x12\\x07\\x92z\\x0b\\x0b\\x19\\xe3v\\xa4\\xb1\\xaat\\x17\\xc7fy=\\x0b\\x9d\n\\x17\\x9f\\xf7\t\\xfa!9+\\xd5ke\\xf91\\xa3\\xd8\\x90\\xbdhc`\\x11\\x96t\\x9d\\xee\\x9e;\\xe5o[\\x02\\x0fc\\xb6\\xe8s\\xb2\\x8d;"
  606. },
  607. {
  608. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x89\\xfa\\xf6\\xa4\\xa2<\\x00^\\x90>\\xa0u\\xc8gj\\x90-ci\\xf1_\\x06\\xd0\\xd1\\xac\\x0c\\xdab\\xec\\xe9$\\x11{\\xe3\\x15g72\\xab\\xc2\\x1e\\x03\\xbc\\xa0\\xe8\\xfe4\\xfa+\\x19\\xc1h\\xde\\xab7t\\xf2k/p*\\xcb\\x88z\\xca?\\x00d\\xfd\\xa9\\x1b\\x0cm6\\x08\\x0ct\\xd4b\\xcd\\xf9@\\xae\\xc6\\xb4\\xcf\\xd2\\xbbd\\x83\\xb2>\\xc3\\x175\\x9aj\\xed\\x9ax\\x84\\xbbi\\xb0\\xe9\\x870h\\xc3r\\xa2\\xc0|\\xa8)\\xec!\\xfd\\x18\\xd3\\xa4\\xbb\\xd5\\xbd@i\\xea\\x01\\x94'\\x01\\xfeb\\xc1\\xa1'\\xee\\xb5.\\x8e2\\xee\\xb9\\x845\\x89#\\xac+.qy\\xee=\\xf5a\\x08\\x01\\xda8lx<\\xab?\\xf8\\xc3\\x8c\\xb4\\x04\\xc8*e_@\\xde\\x9b\\xa90g{7\\xc4m\\x15\\xf7\\xbc\\xd9v/=\\x91\\x91\\xd2e\\x05\\xd1%\\xd3\\xd2\\x9b\\xf4\\x10\\x1a\\x0e\\xdf\\x13\\xfb\\x9cm\\xe1j\\x05= \\x12`\\x86\r\\xbb\\xa0\\xe3\\xbcv\\x1e.\\xbe\\x02\\xdb\rk\\xbc\\x01!\\xa0\\xaf\t\\x8d\\xd3q*h\\xbbb\\xab\\x15\\xe1=ec\\x1b"
  609. },
  610. {
  611. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010]\\xce\\xa44a\\x9b\\xaf\\x1cj\\xb1n\\x90\\x92\\xcfmz\\x85do\\xab\\x8f\\xbf\\x01\\x1a\\xb9\\xf9j|x\\xfdc{\\x0e^4\\xa5u \\xef\\x95\\xc7\\x07,l[tf\\x1e\\x1e\\xd3\\xef\\x1b\\xdb\\xfa\\x1f\\xde\\x9d\\x0c\\xb9\\xc5\\x03\\x03\\x1c\\xd3ksp\\xea8\\x80:\\xa6mp\\xa3\\xa7\\xf8npr\\x98\\x94np\\xc1g\\x1d\\xf8\\xeay\n3u\\xca\\x98\\x0f*\\xb8\\x1a1\\x9c\\xc6^\\x7f\\x93\\xd1\\x0e_(lg\\xa2|#\\xc7\\xf6\\xec\\x82\\xb3on\\xad4\\xd3w\\x0b\\x1b\\xdf#s\\xb7a\\x1b\\x9c\\xb8~\\xa2+`\\x07<\"'\\xfe\\x93dh\\x13d\\xc01\\xf9\\xf00\\xa9b*b\\x86\\xfdc(\\xa3b\\\\xfa]\\x08}j\\xb0f\\xc1\\x11\\xd1\\xa8\\xdc\\xd4\\x0ej\\xcd\\xb1s\\x1esx5\\xdbl5\\xe1ea\\xfc\\xc3\\xc4\\x96\\xe2\\xb0\\x88v\\x9d \\xa2\\xbby\\x0b\\x83\\xee\\xdf\\x90\\xa34\\xa6\\xd2q\\x12r\\xb6\\xb0\\x02g\\x86\\xcfd\\xda\\x96\\xf7\\x1fu \t l]\\x8f\t\\x80'h\\xbc\\x8d\\xf2'\\x05w\\xaf{\\xf4p\\x19"
  612. },
  613. {
  614. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x83;y2\\xc4\\xcb\\x7f\\x9ewh\\x0bul\\xf1\\x82q\\xd8n\\x0e\\xa4\\xb5\\x80'\\xa2@!\\xad\\x99i%v\\xf6\\xc7^_\\x05n\\xfak\\x84~\\xec\\xe1-,\\xe2\\x0b\\xaf\\x02\\xf4u'\\xc3q\\xb5\\x94\\xf0\\xb7\\x18\\xf5\\x9b\\xed\\x94x(\\xdd\\xac\\x01\\xda\t06\\xa2\\xf1\\xa1m\\x92\\xcb\\xbf\\x9e\\x00w\\xec\\x11\\xf8\\xf0\\xe2{\\x1ad\\xa9vk\\x16\\xa9\\x9e\\xd8y\\x82\\x1b\\x0f\\xef\\xe9x\\xf4d\\x94\\xe1\\x12\tp\\xdcz\\xe1qx\\xc6\\xa2\\x0e\\xd3l\\x1c\\xc7e3\\xdd,\\xac\\xf3\\xf3f\\x10\\xc4\\x13:d-\\xc9q\\x01\\x00\\xcd@x\\xa01\\x048\\x9b<\\x81sr\\xb7j\\xa1\\xbcl\\x8c\\xc2\\xea\\xac\\xa2\t/\\x87\\x9a\\xfb\\xeb|\\x1b]\\xd8l?\\x88\\xf8\\xd6\\xc0\\xf1\\xa4\\xf10\\xc6m\\xd1y\\x9b\\xd2c\\x1c\\x96/+h\\xa8:\\xdc=\\x8e\\x0br\\x1b\\xbc\\xd9\\xb3\\x1d\\x06a8\\x85\\xf8oe\\xd4\\x9a\\xec\\xc7\\xe2\\xb6\\x0e\\x9d\\xe9\\xfb\\xa4\\x92\\xd24k\\xac\\xa0\\x90\\x98\\xc6\\x18\\xfc\\xd3\\xf97\\xde\\xe5-\\x9b\\x81>\\xa2\\xace \\x1e\\xfd"
  615. },
  616. {
  617. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1\\xd5\\xd1gr(=\\xdc'\\xaal\\xb1\\xf7/u\\x11\\x1b\\xd5\\x91\\x9f\\x19{\\xc3\\xe8\\xbe\\xa5\\x8c\\x95t@\\xff\\x16u\\xd2\\x10c\\xfc\\xe3\\xf9.\\xfc\\xd8a\r.\\x94<\\xad\\xb6\r\\x850<\\xe4\\xecg\\x98t#\\xb7\\xfc\\xbc\\xc4\\x8b\\x0b{\\xf7?#\\x98\\xd9\\x0e\\x9d\\x89q\\x80\\x088\\x97\\x13y|\\xa0\\x902\\x9e\\xd4\\xc1b\\xa0j\\xa0\\x00\\xc5\\x18\\x01\\xd1\\xeb\\x9d\\xc5os\\x16z)\\x02\\xa2\\xd0\\xa1\\xb0\\xf1\\xfd,\\x91\\xf5\\xcc:s\\x9f\\x80*\\xa0\\xb4\\xb9hz#3\\xaf\"\\x88v\\xf3\\xae\\xec\\x11\\xc8\\xd5\\xca\\xd4\\xf3$sb\\xbdk\\xa5\\xa2[\\x1cja\\xb5\\xd7\\xfb1a\\x87\\xe5\\x90\\x00\\xa6p\\xa0oy=\\x9d\\xb0}t\\xe1\\xfaf\\xeb\\xc2\\xe1r\\xb49.\\x04v\\xac\\x05\\xc8\\xa2i\\x04>\\xa3\\x02\\x18\\xf90\\xb2\\xe8\\xe87\\xf3\\xfcri\\xc3\\x13\\xb2\\xa1\\xdah\\x8f\\x1f\\xf2\\x99s\\x87\\xca!\\xe0\r<\\x99\\xack\\xb7\\x84?\\x0b\\xd6\\xb3px~z\\x8e.\\xd0o\\x1f\\xe2\\x9e\\x82\\xa4!\\x0f\\xbd\\x89\\x943e\\xfb\\xcd"
  618. },
  619. {
  620. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb0\\x1b\\xc5\\xba\\xdb\\xd9\\xc6\\xaa*.\\xa0q\\xf7n\\xa9\\xe6e\\x1e\\x9a\\x1d\\f\\xe3d\\xf0\\xf4\\x98f\\xb0\\x0e\\x13\\xdb\\x19xx%\\xd9z\\x96\\xfcy\\xaa\\xca\\xa6\\x08j\\x0e\\x8a\\xc7-q\\x95\\xfe\\xa8g}\\xdd\\xa7\\x1b\\xcd\\x00ee\\xcd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x10j\\xf4\\xea\\xf1\\x9asx\\x04\\xc1\\x8b\\x16\\x17\\xc7n\\xa4)z\\x02\\xb8\\xa8x\\x98q{\\xb7\\xd4\\xe6\\x18\\xb0\\x04\\x83p\\x99c\\xf0\\xd2v.\\x14*\\x83\\xc0m+'\\xc7\\x8d"
  621. },
  622. {
  623. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8b@\\xfd\\x00\\xfa\r\\x14g&\\xd4c=\\xcab\\xb2!s\\xbd\\xb6\\x7f\\xeb\\xe0\\xe7\\x08z\\xb5\\xab\\xf3%\\xc7\r\\xbf?p\\xed\\xd2%\\xb7\\x9e\\xf4\\xf2\\x1a\\x99d\\xe8\\xbf\\xd5`\\x92\\xa0\\x8b\\xd3\\\\xe6\\xe1\\x82\\x81\\x96\\xb4\\xe2\\xc0.\\x13\\x80\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xda\\xee\\x14\\xad\\x13\\x8ck\\xe0\\xf4y6q\\xd9f^:\\x94c\\x01\\xebl#\\x7f\\xee\\\\xb1\\x19\\xd10#\\xe1\\xea\\x835\\xa1\\x04l\\xda\\xcd\\xd8p\\x98\\xab?\\xcc>\\xf9\\x8e"
  624. },
  625. {
  626. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04z\tb\\xae\\xa2\\xaf\\x1f\\xa6\\x08\\xcan;\\xdej\\xf3\\xd5\\xf0h\\x1ax/\\x17\\x8f\\x99\\x8d\\x8b\\xac\\x8c\\x0elr\\xc0\\x8d\\xc5\\xe0_\\xec\\x00\\xe9\\x88\\xbc\\xfb\\xa1\\x99\\xea\\xc6\\xe5iy\\xecw\\x89}d\\xa7\\xad\\xc0)\\xdabgje\\xa8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x13\\xc3\\xbe\\xbd\\x0cb\\xe6e\\xe8\\xc3?\\xf1'\\xee3s\\x95\\x90\\xdb\\x14\\xd8s_\\x0b>\\x053\\xe0!\\x918\\x85\\xe8\\x7f\\xb7\\xfa\\xb7\\xfbh9#z\\xa8\r\\x1c\\xf3/\\xd3"
  627. },
  628. {
  629. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9c\\xcd6\\xc2\\xa6\\x17\\x0b\\x87\\x8d\\xbb'e\\xe8\\x0c\\xdd\\xfb\\xd9\\x83<\\xd0 \\x86u\\x00\t\\xfb\\xc1c\\xbf\\xf9nb\\xd6\\xbac\\xc7<\\xd3\\x85\\xfel\\x83\\x0b\\xb5\\xea\\xd9\\xc1\\xcb\\x0f\\xb0\\xd5:\\xc1\\xc1\\x12\\x06\\x85f\\xe3=9:\\xcf*\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000>\\xbf\\xfan\\x94d\\x06\\x1b\\xd1as\\xa8\\x1e\\x80k\\x16\\x03\\xbdq}\\xe6g=\\xda\\x18\\x1b\\xd7\\xe2\\xd9\\x87]?\rta\\x99\\xc4\\x1a\\xee\\xd7o>\\xa7\\xcc\\xb6\\x1b7\\x1e"
  630. },
  631. {
  632. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfd\\x93\\x94\\xcfn\\xdc\\xeev\\xfe\\xb8y\\x1f\\x91\\xba\\x91+b\\xc2q\\x15\\xef*\\xd0w\\xff\\x14\\xd8\\xd8@\\xab(\\xea!0c$y\\xddhm\\xdf/~\\xa1ng\\x9c\\x06\\xf3\\xadh\\x88\\xd1%\\xd2w\\x1dk\\x1b$l@\\x15\"\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x15\\x0ex.\\xaax5&\\xe2;\\xc1\\xfa\\x8c\\xca183\\xd3j\\x81\\x84\\xe7v\\xc7\\x8a\\x0f\\xc1\\xe12p\\x0ex\\xe87\\x93\\xf2\\xdb\\x0b\\xac\\xa8\\x90\\x85\\xd9\\x1d\\x9e\\xd8\\xbbf"
  633. },
  634. {
  635. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\xe5\\x01\\xe7<\\xf3\t\\xae\\xf3\\x93\\xd3\\x9dn\\xc3\\x91\\x1f\\x14:\\x99\\xb9}\\xc4\\xf3\\x92j\\x03\\xdb\\x17u\\xb9\\x1dw\\xa2qr\\x17f\\xedt)\\x93y\\xff8\\xb4\\xe1\\xef2e%3\\xd6z\\xa3k!\\xc1b.p\\x0fr\\xe0\\xd2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x8f\\xa0\\xbf\\xf0\\xa7\\x89\\xfc\\x82\\xa67\\xfd\\xa66\\x0e\\x9df^s\\xa7_h\\x91\\xd7\\xd5xl\\x00\\xdbi\\xba{\\xb9\\x838\\x0c(z2\\xfb-\\x81\\xec\\x8f]a\\xbc\\xb2\\x94"
  636. },
  637. {
  638. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\x90\\x8em\\xb2\\x03k\\x94\\xa1-j\\xa7\\xba\\xdfty&-m\\x85\\xce\\xa42\\x00\\xa3ro\\x87\\xcc\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  639. },
  640. {
  641. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc8\\xc2n\\xcd\\x99a\\xcf\\xc2\\x974\\xbaog?f\\x08\\xcc\\xdd\\x19\\xfe!}\\xcd\\x81\\x16\\xab\\xb1\\x91<>\\xcc\\xf6\\x99\\xa2\\x91[\\xbbe\\xaf\\xbcdw\\xbbx\\xac.\\x1c\\xd9t\\xbcn\t\\x0c3\\xf1g\\x84\\xff\\x81j\\x9b\\x124\\x9fb\\x94%yy\\xe8\\xdfr>\\xa3\\x13a\\xd1\\xc9\\xab\\xd7sq%\\xf1\\x02\\x9cpi\\x8e\\x7f\\xadw\\xed_s\\xbd\\x05b\\xb4\\x17\\xcd\\xff\\x87\\x86n\\xae\\x0c\\xb9\\xf1\\xd0u2\\xf0\\xd20+l\\xf6\\x90*;5z\\xa2\\\\xb3.\\x80\\x9bn\\xea\\xa7\\x8b\\xd46\\xefw\\xe3t=e\\xc2f\\xa6\\xff\\xe5$\\xeb\\xe2\\xa8\\x84\\x86\\xef\\x13\\xc7\\x00\\x9c\\xb5\\x14\\x0c[\\xaf\\xe0urd\\xa1wb\\xebrotxqc\\xc9\\x83rs\ry$\\xf0\\x92\\xff4\\x01g!\\xd3\\xbb\\xe15\\xfe\\xc2bz\\x99\\xc0p\\x89v_\\x99^|\\x18\\x80\\x9fb\\xdf(,^\\x88\\xbe\\xd7o\\xdb\\xac\\x02\\xc8\\xa5i\\x16\\xb8\\x9at&\\xc1\\xf3\\xe2\\xd2jx\\x1a\\xbb\\xa2\\x84\\xd3d\\xd6\\x17\\xc3dg)\\x1d\\x99|"
  642. },
  643. {
  644. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee&\\xe6\\x0e\\xe4\\xd6\\x8e\\xb2\\x7f6\\x9e\\xdd\\x02\\xdb\\xa6\\x9el\\x80\\x93e\\xbd\\xe3\\xcb\\x94h\\xfd^\\xac\\xbb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  645. },
  646. {
  647. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xcd\\x07\\x9b\\x16\\xb6\\xbf2c\\xd8\\x7f?\\x80\\xa2\\xc0\\xf1\\x89\\xdewy\\xd7\\x8a,nt/\\xf3\\xd4\\x08\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  648. },
  649. {
  650. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x12q\\xa02\\x15\\xb5e\\xfctm\\xbca\\xe0|\\x14u\\x00i;\\xd3kz.\\x17\\x1a\\x95w@\\x8dc\\xa63\\xca\\x86z\\xa6\\x87z\\x90&\\xc5\\x07$#\\xd1\\x07o\\xd8\\xcb\\xa90\\xae)\\x9en\\xe4\\xc4q\\xc7\\xb4@\\x10\\x97\\xaep(l\\x0cy\\xa8\\x05\\x8c\\x91\\x13\\x1e\\xf2\\x13\\x966,\\xf1\\xf1m\\xe4\\x8b\\xa2\\d\\xf2\\xf8 \\xc5\\xedi\\xf8n\\x8foni\\x1d\\x17\\xb2'e\\x8b\\x91\\xda\\xb2&\\x18\\x9a\\xe2\\x17\\xd0\n[\\x9a\\xe5\\xc6wdm\\xe8\\xe7\\xb0\\x12\\x0cq\\x08\\x8c\\xbc\\x94\\xeaj\\xaa\\xd2\\xe5\\xf1\\xc4\\xd6\\x8c\\xa3\\xb7$8\\xaei\\xfc\\xb94(\\xea_\\xd6\n\\xbe\\x81to\\x91\\xacq^\\xbav\\xf3b#\\x846\\x02\\x94\\xc5\\xe2\\x91\\x0b\\xe1\\xa9\\xde\\xf6\\x02f\\xdc\\x16eq\\x8e\\xcc\\xf5\\x9b(y\\xcb\\x14\\xc8\\xb41\\xf1z )esd\\xe9i\\xc2\\xb7\\xd8a\\xd01\\x10\\xc3\\xc6b,\\xe14m\\x82j\\x19\\xa2\t\\xf1\\xb1@s\\x0e!e\\xf6\\x16kb\\xa7f0a\\xc6\\xd4\\xc2j;\\xfb\\xd1\\x02\\xe2^"
  651. },
  652. {
  653. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\\xaa\\xa6o \\x98\\xe4\\xb5\\x18\\xfd9\\xabid9\t\\xd6\\x81e\\xbd\\x8a\\xf7\\xa83\\x95?\\x13\\x05\\x06\\x03q\\x03_\\xc7\\xf0\\x14\\xa3~\r}:\\xbb8#\\xbd`\\xaas\\xf5\\x0f#\\xe7\\xf8\\x14\\xaew6\\xef\\xba\\xe2g\\xcex\\xb2\\xbfn\\x96\\x8e\\xc5\\xa5\ns\\xca\\xa7\\x91\\x97b\\xc3\\x8e\\xec|\\x84n\\x1cq\\xe9m\\xf6cgb)\\xfc\\xe4\\xbc\\xf0\\xef6\\xeft\\xbb1\\xf3\\xed\\x92\\x15{xv\\xfe\\xfc\\x07\\xc4y\\xc4\\x9d\\xf7\\xd9n\\x15\\xb8a\\x8c\\xaf\\xb2;\\xfex+\\xb2\\x9c.k`g\\x8c\\xf5\\x1c\\xbeb\\xd8\\xb8(\\x81y\\xac3\\xbd\\xe11\\x02\\x83o\\xff\\xd7ss\\x81\\xac\\x1b\\x1c/hu#\\xfa[\\xf29o\\x82@/\\x1b`\tg`\\x8f\\x02\\xda\\xe4\\x00\\x85\\xb6\\x83\\xc7\\xa3f\\xd8\\x80\\xa4\\x9c\\x86wu\\xda\\xa0*#;\\xf8{\\xf0z\\x19\\x10\\x08\\x96\\xeb\\xd6\\xd1c\\xe1\\x1d\\\\x86'\\xaf\\xeau\\xaa\\xa3\\xe5\\xb5\\x03\\xdeg\\xee<\\x91^/\\x97\\x82\\xf8\\xe0\\x00\\x84\\x98l\\x8cx\\xcc\\xa8s^\\x1e\\xe1;\\x1a"
  654. },
  655. {
  656. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbd\\xf0k\\x86\\xa9o\\xf0^\\x82/\\x1a\\xc2 \\xbb\\xd0\\\\xe54\\xe3.\\xe7\"yp\\xde\\xdf\\xa4x\\x92\\x8d+\\xb3\\x99\\xa3o\\xd4\\x97n\\xf5v\\xcf,\\xd1\\xd1\\xcf@-^\\xed\\xa9@\\xc4\\xb2\\xcag\\x05u\\xdf\\xcdw\\x97\\xe6\\xec\\xecv\\xd71\\xb8\\x14\\xa1\\x9b\\x92\\xc4\\x065t\\xb7\\xf9\\x96\\x0bm\\x97o\\xfb\\xa4\\xc9`\\xa6g(\\xb75xe\\xd4b\\xd1\\xc7%\\xd74\\x85\\x08y\\x9el\\xb93\\x1d\\xf2\\x14\\xfa\\x7fr\\x871a\\x8cr\\xfcw\\xc1x\\xf1\\xa6w\\xe5\\x0f\\x13\\xd8r\\xaa8=\\x04m\\x91\\x9c{\\x91\\xe1\\x04\\xa7^?\\xba\\xa2\\xc6=\\xab\\x95\\x07\"\\xa0\\x1b<\\xb5du\\x829\\x15=\\x1a\\xa7j\\xeb\\xff_dm\\xday\\xd4\\x83\\x935\\xbd\\x95i [\\x9d8\\x1f\\x86\\x1d~m\\x17\\x0b\\xe4\\xb0\\xfe\\xafa+\\xd3\\xabd\\x05\\xeaf/\\x1b\\xe8\\x99wn\\xad\\xc5b>\\x03\\xffq^dn~\\xbap\\x9b\\x18\\xe8\\x00\\xef\\xf2\\x87\\x98\\xe2\\xe8n\\xc7\\xf8\"\\xeb\\xf6v\\xa6n\\x98\\x1a\\x87l\\x88\\xdbp\\xdb \\xba"
  657. },
  658. {
  659. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xad\\xe7\\xech\r\\x9cn84\\x8bu\\xc23;5\\xa8\\xc0n\\x0f\"87\\xc4\\xd3\\xf6k\\xd4\\x0c\\xa7y\\x816/\\xce\\xb2\\x12j\\xf7\\x8b\\xdfx\\xc7\\x8ejq\\xc9\\xb5-7>\\xb1\\x05j\\x0c\\xfe\\xb8\\x99\\xa0\\xf3\\xe9\\x83p[\\xd1\\x0f\\xaf\r#\\x1a@\\x1az\\xa7?j*c\\x87\\x89\\xe4\\x88\\xa8\\xcc\\xcf\\x81\\xf1\\xde\\x15u\\xe8\\xe6j\\x1b\\x80\\xb0\\x01\\x04\\xb5\\x9e\\xadj\\xa6c\\xf2zi\\xf0v@\\xe9\\x00\\x87\\xec\\x89n\\xb0\\xd4j\\xc6\r\\xb8\\xc5\\xa0|+\\xa1\\x18\\xf3\\x9d\\xa4\\xcfcxa:\\xfd\\x81pj\\xfc9c@\\x10\\x08y\\xb4\\xef=\\x88<2/\\xb3\\xc8[_\\x18i\\xaa\\xcd\\xbf\\x01r\\xbb\\xb9\\xb8\\xac\\x11c\\x03;\\x9f\\xeci,\\x8e\\x8e\\xf5\\xab^\\x7f\\x0b1\\x98r\\xf8;\\x98\\x06\r\\xaahp\\xd0\\xe2\\xd3\\xee\\xb2\\x7f\"\\x89\\x18(\tf\n\\xd8\\x1e[\\x7f\\xc2z\\xca\\xbfw\\x83\\xc0\\xed\\x01\\x1b\\xe2\\x15\\xce\\xf2\\xe6\\xf3[\\xb1\\x16t&\\x9a\\xa5uw\\xa7r\\xae\\xb3j4\\xd63\\x11\\xc1\\xb6\\xe7\\x122\\x1f"
  660. },
  661. {
  662. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1e\\xae!\\xb1<\\xc2;\\x95~\\x9eg\\xd7\\xe9s{\\x1d@*\\xcd\\xd7\t\\x8b\\x9d\\xc0y\\xa8\\x02<\\xb1\t\\xa9np\\xc2\\xca\\x1d\\xfb\\xb9\\xe8\\xcc\\x8a\\x8ft\\xfe\\xfa\\xeeag\\x1b\\x1f\\xf7\\xef\\xc4_\r\\x01s\\xbf\\xfd\\xd4\\x98\\xda\\x0fk\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000=d;e\\xc2\\x8a\\x96\\x07\\xcf:\\x8c[-\\x14\\x99#\\x8b\\xcb.\\xdb\\x8e ^m\\x15i\\x8f\n\\x12\\x15\\xa0\\x99\\x9f\\xc9\\x11\\x88\\xfcv\\xc37\\xeb\\x84q\\xdb\\x06\\x9b\t\\xc9"
  663. },
  664. {
  665. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x92\\xa1\\x03\\x9f\\xf3\\xb2^\\xa8?\\x96/w\\xc2\t\\xa4\\9f\\x80t\\x18\\xe7\\xabl\\xf5\\x11!\\xcca\\xfa\\xe4n\\xf9$\\xcb\\x00\\xc7\\xfc\\x88\\x18\\xd6\\x02\\xee\\xf4\\x18\\x05l0&wm9f\\xb8k\\xb5\\xe3\\xef\\xec9\\xc3c\\x16=\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa9\\xd7z!.\\xa9\\xefw\\x1b\\xb7\\xa5n\\xa9\\xcbkrb\\x89\\xecm\\x1e<\\x99\\xbc\\xc6\\x03\\xda\\xb9\\xa2y\\xbfq\\xd4\\x8b\\x1a\\x7f\\x8a$!}\\xeei\\x06\\x1a\\x0c4\\xa8\\x80"
  666. },
  667. {
  668. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04tr\\x977t\\x1e\\x0c\\xf8\\x0ba\\x950\\xad\\xd9\\xc5c9\\xa5|\\x17\\x06\\x8fm\\x04\\x99qu\\xd1\th\\xfa;d\\x0c\\x1c!f&\\xa3v\\xa1[\\x01\\x9e\\x87\\x1b\\x92}\\x96\\x93j\\x1c\\xbe\\x83\\x05\\xa0b^c\\xed/hw\\x12\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9a\\x82\\x96h\\xb3t\\xc5\\xa6\\x10\\x1c~\\x88\\x8cq.\\xaa-kg\\x84v\\xb8\\xf1g\\xa8\\xae\\xc2t`\\x10\\xc8\\xba\\xf4\\x8f\\xbdc.\\x8e7\\xcfg\\xaf\\xday\\x7f\\xf8\\xa0\\xec"
  669. },
  670. {
  671. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x041\n\\xf2d*\\x8e\\x82ug\\xf3\\xe9_\\x9c\\xcf\\xc5\\x126&\nv\\x07_*&u\\x13\\xb8ev\\xedof\\x1f\\xb76\\xcf\\xfc-&\\x89m\\xee\\x93\\x9e{oy3<\\xadmiw\\x19\\xc6\\xa5b\\x8frv\\x8b\\xc9n\\xba\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x16\\xf1\\x99\\x97b\\xf8\\xfa\\x01^d\\xa4\\xb4\\xd3\\xd3fc\\xdc\\xe1l/zp\\xc2\\xcb\\xae\\xbf\\xc9\\x16\\xd8\\xb3\\xb1\\xe9\\x80\\xa3\\x8e\\xf2\\xb5ww\\xc4\\xadk+]\\xe5\\xd3\\xbf\\xab"
  672. },
  673. {
  674. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x89q\\xb3\\x0f\\xa5\\xecst\\xce%\\xaa|\\x9f\\xff\\xa5\\x90\\x82\\xfb~\\xfdm\\x16\\xb7\\xb5aw8\\x86\\xba\\xb5\\x95\\xee[\\xd2c*\\x90\\xfb\\xa7\\xfe\\xd9\\xfa\\xad\\x0bx\\xd0\\xe97\\x89\\xf7\\xac\\xac\\xe9\r8b\\x8a\\xbcp]g\\xbf\\x03>i\\xa5\\xa9\\x98\\xfe?ri\\xa5a=\\x83\\xb4\\xed\\xd4y\\xf5\\x17\\xc9\\xd5v1g>\\x8f\\xc7h'\\xbd-n\\x82\\xd2\\xc7)\\xa3w?[d9j\\x88\\xaa~\\x826\\xd3p\\xbfxi\\xec\\x0e\\x0fpzl\\xffj~$\\xfef\\x9d\\xb0\\xc7\\xbe\\xd2_\\x01s\\xb7\\x1c\\x94\\xcc\\xa7\\xbb\\x97\\xccjw\r\\xd9!\\xf23\\x90]\\xf9\\xa4c\\x12\\xf1vg\\xc5d\\xaa.j\\xbfzo\\xd0n5\\xc5\\xbe\\x9d_\\xc3\\xf5\\xaf\\xda\\xfeq\\x1a\\xd4\\x05\\xe0\\xec4\\xd3\\x1b\\xc9\\x16!\\xaa\\xdd<\\xd90\\xe3\\x0f\\xcd\\x0fv\\xef\\xe5\\xd2a\\x93\\xb4\\xd1x\\xd5#\\x9d&j\\x1b\\xcf\\x1ab\\xb8k\\xe8\\xa6\\xaa{2\\xaa\\x98r\\x8a\\xca}]ts\\x11\\xf5\\x8f\\xb2\\xb8usqafj*9\\xf6\\x82h"
  675. },
  676. {
  677. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa0\\x14\\xa1v\\xe9!\\xe2a\\xe6\\xdc\\x155\\xca\n\\xc1\\x82fy\\x8b\\xad\\xfc\\xa9~\\xcd\\x9dq\\x88\\xd3\\xbd\\x98\\xe5\\x02\\xeb\\xe7h\\xe5\\xf7+\\xe0\\x93\\x8e,\\xc4b\\xce\\x8a\\xc7c\\xa4/\\x98ako;\\x84?m'(\\xdc\\xc6\\x8d\\xcc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe24\\x802\\xc8\"\\xd7\\x15\\xb9b\\x0en\\xe5\\xdaor\\xd7\\x85\\x9f\\x1b\\xd8\\x81\\xc9\\xc7%_e\n\\x00\\x9e\\xb0_@'\\xaev\\xb6\\xf8\nvc\\xb9\"#t\\xb9\nh"
  678. },
  679. {
  680. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa1\\x16\\x89\\xd5]\\x03~8\\xa1\\x03m\\xb1\\xd6d\\xc3\\xe5n\\xb2b\\xbc3!q\\xf7\\xa6ct\\xf9\\x89\\x95\\xc8\\x8d2g\\xdek7\\xe1\\xc8\\x16\\xe2\\x00\\xa9d\\x89n\\x8b\\x8e\\xaf\\xb29\\xe0\\xa6(\\x83\\xeb\\x80\\x91\\xe1\\xa6\\xa0`\\xec\\xf2\\xb4\\x82\\xaa\\x16hcu\r\\xb0\\xbb\\x19\\xc4\\x07\\xe6\\x81\\xa4\\x12sr-\\x9c.l\\x03\\xdf.\\xeb5\\x84p\\x89z\\xaa\\x88\\xc8\\x16'\\xa2\\x7f\\xbc\\x08k:\\xf1c\\x1a\\x05\\xc8\\xe40e\\x00\\x024r\\x80\\x85q_\\xc7\\xb8\\xeae\\x96z\\xaa\\x8a\\xfd\\x91c\\xc4\\xfd\\xfe'\\xcf\\x82(\\xdb\\x0c\\xdd#b\\x18\\x97\\x8d\\xf2\\xbebx\\x87pw\\xa4,\\xe2\\x8f\\xfe\\x11\\xea\\x9d+\\xed>lv\\xee\\x1b#&\\x13\"8&a\\xc7i\\x11!\\xeb\\xe2\\xa6\\xc4pmre\\xed01\\xf4,\\xff[\\xd0v#\\xaf\\xb3\\xd7#e\\x1e\\xb4\\xc4\\x8d@\\xe7\\x94\\x02\\xe5\\x80\\x93\\xf2%\\x9b\\x03\\xe07^5\\xf6\\xda\\x84\\xbc\\xe1\\x1d\\xe8\\xc7\\x94\\xf9{z\\x19\"\\xb1\\xdd[d\\xfd@\\x04\\xf1,\\x8e\\q\\xd1"
  681. },
  682. {
  683. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcd\\xced\\x0f{\\x96\\x00\\xe5\\xac\\x1e\\xc6\\xafb\\xeb\\xbf\\xc3{\\xfdv\\xe6\\x03l\\xa5\\x8a\\xf9\\x05\\xbc\\xafl\\x8aem\\x97\\xb0\\x82,y\\xe4\\xaf\\xc0ka\\x8e\\xbd\\x97\n\n\\xef\\xff\\x836x\\xca\\x08\\x81\\xabs6x\\xd6t\\x85\\xa7\\xd1\\xbak\\x81\\xa0)/\\xf0\\x1ag\\xb2ots\\p\\x96\\xc2\\x8c37\\x12\\x94a\\x7fp,v\\x94\\x82!}e\\xe1\\x0f\\xa7\\x976\\xe8)u\\xb2\\xe1\\xf4iw\\xe9\\x1f\\xeb\\x1e\\x08a\\xc5\\xa9\\x85z\\x14\\x96\\xfeh\\xcb/\\x05\\xa3,\\x1b\\xc0\\xf6fz,h\r\\xbf'\\xf9<h\\xfb$6\\x84\\x03\\xf7'u\\x15\\xfd|\\xdct\\x16\\x9be\\xc3\\xa8`\\x87~.\\x80\\xa9\\x80o\\xb07\\x991\\x1a%\".\\xb8\\xaf\\xca75\\xf1+\\\\x07h4j\\x8ffa~\\x03\\x83bn\\xbf6\\xf2i\\xee8\\xff\\xa5\\x1a27\\x9e\\x1a\t\\x01\\xf3\\xa5\\xd0\\x07]c\\xd1.hpbyp\\x9a\\x03u\\xf2\\xa0\\x1b0\\xd7\\x8e\\x88cr\\x89\\xaf/n[x\\x99#.\\xdf\\x8fbb\\xc7u\\xd1"
  684. },
  685. {
  686. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0eeiz\\x0f\\xf9[ \\xf3\\xc9f\\xf8\\xb7sp\\xf0\\xcf\\x00\\x0b\\xf4\\x04v\\x9d\\xad\\xb3\\x9c\\x08\\x7fb\\x02\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  687. },
  688. {
  689. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xf4\\xc6o\\xa4\\xb7\\x1e1a\n\\x07\\x9ca\\xe1\\xdf\\xba#d\\xb0\\xc0\\xdae\\xfb\\xf7x\\xed\\x16^\\x80\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  690. },
  691. {
  692. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xe3[\\x904^\\xa4\\xa9\\xa2\\x97\\x92\\xaff\\xf3\\x02*\\x0bgdtc\\x9a\\xdbh\\xe8\\x93\\x8e\\x7f\\x85\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  693. },
  694. {
  695. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xeat\\xb9\\xfd+\\xa1\\xfa1up)\\xcc\\xe1\\x93\\x1fm\\xc1~g\\xdf`\\xddl\\x07\\x89\\xea}\\x15\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  696. },
  697. {
  698. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xc3\\x0cz\\x98j\\xd6f\\xd3\\x0c\\xcb\\x82\\xc1\\xc2\t\\xc6\\x7f<w\\x1f\\xb4\\xec\\x16\\xcd\\x19\\xf4\\x99 [\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  699. },
  700. {
  701. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xad\\x86]o\\xcea\\x1ccnqb\\xf2,\\xcb>\\xad<\\xe7i\\xb8\\xdc\\xffn\\xaa\\xe5\\xec\\x84h\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  702. },
  703. {
  704. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0eel\\xd1nek&w\\xce\\x85\\xe9\\x02z\\xb0#/\\x9c\\xe7\\xe0\\x891\"<2$=\\x82pt\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  705. },
  706. {
  707. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\x94\\x1f\\x11\\xeb\\xc5\\xf24tc<&\\x18,j4\\x0b\\x9d\\x95\\x06\\xf8\\xc9lq\\x12\\xef`\\xbe\\xa5\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  708. },
  709. {
  710. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0eek\\xe6\\xef\\x18z\\xcf1\\xe5\\xe0#\\xfc\\xc6\\xc2\\x03%-rk\\x19\\xc0y\\xbf\\xad#\\x91ju\\xe7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  711. },
  712. {
  713. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0een\\xd4\\xac\\x03\\x82+\\x87\\x0e\\xc8p\\xc9\\xf9\\xa9)<\\x90\\xa3l\\x1a\r\\xef\\xc0\\xb5\\x88\\xc7\\xa2v:\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  714. },
  715. {
  716. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xb9\\xc9\\xc6\\x03!\\x17q\\x06\\xbdk\\xc2\\xe2\\xf1\\xb2f\\x85\\x8b\\xc9\\x0e\\x18\\x08\\x10p\\xbf\n\\xb4\\xa3|\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  717. },
  718. {
  719. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x06\\x12j\\xf3\\x08\\xe8\\x98u\\x0b\\xa1\\x1f\\xa4=\\xc6\\x9e~\\x0c\\xca\t1\\xee\\x8bk\\x84\\xb2\\xd0\\x03\\xc3\\x9c9\\xb3\\xb2\\x16\\xb1\\x0e\\x0e\\x08\\xd5*\\xd4 \\x8b\\x9c\\xc2#k3\\x1b\\x14\\xdf@akk\\xac\\x94\\x9bf\\x80x\\xf6\\x02\\xce\\xde0ic\\xcf\\xddc\\xd5\\xed\\xce_~8\\x10\\xea\\xd6\\x85ie0r\\xcb\\x9a\\xc3i\\xa9q\\xc2%\\x05\\xa6\\xc8\\xdf\\xb8\\x8c\\x10\\xde|emy\\xd5,\\x8fb\\x89\\xefs\\xc1\\xd5\\xf0\\xde\\x05\\\\x89\\xa6\\x8f\\xa8\\xf6\\xe0x>\\xdd\\x9a\\xb0\\xd8\\xa1^w@\\xdel\\x01:\r;\\x14\\xc4\\xa8\\xd6\\xb2c\\xfdu\\x92o\\xb9\\xd9\\xa0\\x96\\x1c\\xe7o\\xaca\\x94\\xd6\\xf1\\xc0\\xf6o\\x06\\xa6l\\xd7\\x0f\\xf1\\xd2\\xe5\\x87o\\xc3c#\\x1cm\\xa3\\xc8\\xbe<\\x81\\xebolz\\xf1q\\x96\\xb9\\xf2\\xd9\\xd1z\\xb0\\x99\\x96?\\xdd\\x05\\x10\\x89\\x18a%\\xa5i\r\\xcd\\x1f\\xd4\\x99\\xbf\\xe6\\xael\\xa9\\xa9!\\x9d\\x88\\x0b\\x86\\x82e\\xe4q\\xa2u^|\\xcbq\\x0f!s\\xbd\\xc3^>na0\\x8c+\\xf1\\xff\\xf1\\xd8"
  720. },
  721. {
  722. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04tr\\xe6y\\x1b\\xf43lex^\\x8a\\x8dd\\xfd\\xe5\\xf1\\xb1\\xb5>b\\\\xa7\\x01\\xab\\x1e\\x04z\\xd5\\xe7\\xd1\\x92\\xbf\\xbf\\xd6\\xca\\xbd\\x1d\\xca\\x08\\x81\\xbd\\xc4/\\x8f\\xd4\\xa82\\xbb\\x91\\x11\\xce\\xc6\\xed3\\x19\\xc7\\xcf\\xb7\\xca\\x8d\\xdc\\xcfa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5n\\xe9vo8\\x15\\x0cl@\\x1b\\xee!\\xb2\\x05\\x83o34\\xafn\\xe2\\xbd\\xe9\\x8d\\xcf\\xc5\\xb8q\\xf5\\xf7\\x10\\x02\\xcb\\xda\\xbev\\xce :t\\xb4\\x8d\\xc8]`\\xa9x"
  723. },
  724. {
  725. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04qa\\x1e\\x95\\xe9re\\x85h\\xd3\\\\xe6zje\\xf0\\xee\\xb7\\xbaq\\x85a\\x08\\xc4b\\xdb\"1*\\x04zd[o\\xc8.\\xff\\x0e|\\xe4:fn\\xba\\xe2\\x0cg\\x0e6\\xb8upyp\\x9b\\xd7\\x0c0+\\x01\\x8f/\\x11y\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k*\\xe7\\xd3\\x17;\\xe4\\xcb\\x81\\xf9\\xf9\\xfe\\xcd\\xdab\\xc8$\\x85jw\\xa9\\x9e\\xe0\\xff\\xd7\\xabkrj|\\xea\\x02\\x9a\\x1ad\\x93i\\xe3\\x03\\x99\\xe6\\x15\\xdfbi\\x10\\xbe\\xbc"
  726. },
  727. {
  728. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9e\\xb8\\xcf\\x18\\xc8\\x105\\xb2\\x19x%\\x05'z\\x9f\\x98\\xd4\\xafuy\\xf1\\xb7\\x05b(\\xa8\\xa4\\xcc\\x0fm\\x91t\\x16w\\x8f\\x7fy\\xa9\\x07\\xeb\\xc6\\x0c\\x80\\x15\\x0b\\xf8\\xc3\\x1a\\x82t\\xa6\\xe38\\x05\\xee\\x9c\\xa3\\xba\\xc4\\xf6:\\x04\\x97\\x83\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfa\\x11\\xba2\\xb0<\\xa77ws\\x89\\x12\\x9e\\x89\\xbd\\x8a\\xca\\x9b\\xb6e\\xad0\\x85\\xcb;\\xb7\\x9f}\\xa7\\xce\\x12\\xe23\\xdf\\xbc\t\\xf1\\xf7\\xaag\\x82\\xbd\\x9df\\xd0$\\x90e"
  729. },
  730. {
  731. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa8n\\x9f\\xbf\\x80\\xb3h)g\\xa76\\xdale\\x81+k\\x8e\\x89\\xc4\\x96\\xe4r)\\x90\\xdax\\xb5\\xa6\\xe7vl\\x9ey\\x9b\\xb62\\xc5\\x1a\\xf1\\xc9\\xd9\\x8d1\\x84q\n\\x99\\x90\\x02\\x93\\x92\\xed\\xa7\\x82,x\\x93+w\\x85,v\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xcc,\\xc31(\\x96\\xba\\xfc\\x93\\xb2\\x17\\x80\\xc6f\\x12\\xc4\\xfb\\xd7\\xa2\\xcfz\\x83\\xf1\\xbd'\\xa8\\x8a\\x8a\\xbe*>\\xc3br\\x04\\x06py\\xc4.\\x88g\\xcc\\xab\\xe8\\xa0\\x02\\xa1"
  732. },
  733. {
  734. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\xc0\\xb7\\xa9\\xdf\\xc44\\xb8e3\\xebv\\xd7\\xec\\x07\\xc5\\xff]/\\xce\\xf4\\x8f\\x80h\\xbaa\\xb3\\x96&\\x8f\\xbd\\xdfb\\xbc\\x8656\\x19w\\xde\\xc7s\\xd0'\\xe5@\\x9a\\xed\\x0e\\xc4v\\xdev\\x90\\xc4@\\x1e\\xfb\\xd6\\xd3\\xf0\\x92j\\xa6\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000[9\\xe4,\\x03b\\xe8\\xac\\xce}w\\xfd%\\x8e9n\\xfd\\x93\r\\xd4\t6.\\xca\\xca\\xaf\\x80\\xbfz\\xf6\\xfbo\\xda\\xd1h\\x8d\\xd36\\xa3\\xb2\\xe2h(\\xedr\\x04\\xa3\\xa9"
  735. },
  736. {
  737. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0c\\x0ee\\xa2\\x93\\x1e\\x1a+\\xe7\\xa4\\xa4\\xcb\\xd5d\\xf82q05\\xc8\\x1a{d\\xb5\\x18f\\x114n\\x92h\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  738. },
  739. {
  740. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe6\\xb8\\x8d.\\xd9sg\\x92\\x8f\\xc4q\\xb8\\xcf\\x00(\\xce,\\x19\\xcd\\x977\\x9df\n\r\\x9b\"\\x8c0\\x03\\x89}:\\xc0(\\xba\\x8a?\\xc8\\xc2!j\\xa9\\jk/$mmx\\xe2+.>\\xa1\\x114\\xf5xw\\xfb\\xaa\\xdbau\\xea\\xdf\\x12\\x8e\\xf0\\x99\\x91\\xfe\\x0c=\\x06\\xd9\\x91\\x00\\xa8\\xa7\\xbb\\x1b\\xec\\xaa\\x1c6@\\xb2\\xe2\\xcb\\xc0~\\xd9\\xc2\\xd1\\xc7:q\\xfc\\xbas(\\xfa\\xd2'\\xbd\\x15^>\\x85pa\\x1b\\xabx\\xf5\\xc5j\\x0f\\x13\\x9e*\\x90\\x9a\\xc9\\x0c\\xd4\\x08\\x87\\x86p\\x85\\x99>\\xff\\xcd\\x85\\xcd\\x85>\\x1f\\x02\\xef\\xf5\\xf9\\x94]qyb\\xd9\\xc4s8\\xe3o\\xe5\\xe5:\\x1b\\xe2\\xed\\x8c\\x94n\\xdc\\xbbl\\x00\\x00x\\xb4\\x97\\x03\n\\x8ar\\xd5\\xad\\xb7\\xd8e\\xcdr#\\xac\\x0b\\x9a\\xe8\\x18$\\xf9c\\x8d\\xadep\\xc2\\xebt\\xe4n\\x19f\\x1ey\\xf0\\xbbd\\xb5\\x80\\x93\\z\\xa6hw\\xe4\\x1f\\x80x\\x8d\\xf5\\x08\\x10h\\x05wi\\x93\\xb8\\x03\\x88\\x13\\xfc>\\xf8'\\xfb\\xf4x\\x9668\\x1a=\\x90\\xe2\\xe9"
  741. },
  742. {
  743. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x10\\x10t\\xb2=p\\x13\\x9f\\xbbhxso\\x82\\x0eg._\\xe1\\xc2\\xed\t\\xa2\\x88h=\\xf3\\xd9do\\xd5\\xb5\\xdd\\xe0]rv\\x82\\xbe\\x913\\xe2mtd\\xdd|\\x0b\\x89,\\x04\\x8d\rq\\x1c\\xd15w'\\xc9fp\\x14w\\x809\\xdfm\\x15\\x9c+,\\xab\\x12dj\\xdezs\\xbc5t\\xc1\\xe3\\xeb\\xf7\\xfb\\x88)\\x97\\xa3\\xd6\\x17+\\x85\\xc9puu\\xec(^\\xa5^\\x98{_\\x17\\h\\xc3\\x06\\x9cy\\xf9\\x1c\t\\xf4\\xfa\\xc0i\\xd4\\xb9\\xf7\r>\\x06gy~\\xee\\x19\\xcf\t\\x05+\\xcb\\xc6\\xb3\\x07\\xeaf\\xc7\\x00\\x8e\\xaeh\\xa2c\\xf3}\\x11pr\\xb8+9\\xb2\\xf3g\\x95\\zz\\xee\\xa2\\xeb\\xc6\\xa4\\xbc\\xc6\\xc3q\\x81\\xf9\\x89\\x7f\\xd8\\x9d/\"\\x19m\\xe0\\x96\\xa3\\x15>\\xa0<i\\xe1\\x02\\xa6\\xe8\\xad\\xb8\\x03o\\xc1\\xf6\\xb0\\x11\\x0fc%\\xe4\\x1b\\x19\\xadou%8\\x87\\xcf\\xae\\xb1\\x9e\\xadu\\xd5\\xf9y\\xd2\\xd1s8)\\x9c\\xec'\\x1bp)\\x81\\x93\\xfc\\xb6\\xfdqp&\\x18t\n\\x1aj\\xf8f\\x98"
  744. },
  745. {
  746. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9b\\x94\"\\x1c\\xc4\\x81\\x80\\xf8\\xd5\\xd3\\x9af\\xbf\\xd0\\xd8\\xaed\\x18\\xbc\\xa6p~3\\xcf\\x03>v\\xe6\\xf8/0`\r\\xa6\\x8d\\x08\\x92\\x12+\\x96\\xbcs\\xa9\\xcf%w\\x9dmnu\\x02.\\xb2\\x1b\\xc9-\\xf13vu\\xf4\\x00(c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000>\\xe9n\\x97\\xfa\\x8em\\xe6\\x97\\x95\\xc5\\xdf\\xb7\\xfcj\\xf8\\xf5\\xa1\\xe1\\xce\\xe0\\x03\t\\xb6\\x8dh\\xbb\\x0c9wf\\xf54\\x0bqz\\xc6f7\\xd74\\xde[\\xdc-f\\xb5\\xc5"
  747. },
  748. {
  749. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\x8ab\\xed\\x9a\\xe6\\xf8v\\x99t\\xe3\\xb9\\x8d\\xb1\\xd3\\x17\\xff\\x9e\\xb2\\xc9\\xe2l\\xe92\\x17\\xb3\\x8a6\\x9a\\xffj`\\x8e\\x81jq\\xffm95\\xd8%\\xb38b\\x89*\\x13\\x0ef\\xf2\\xddd#\\xf2u\\xd8\\xf4ws\\xa5`\\xf9\\x8c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000t~\\xc3v\\x02\t\\xd4h\\xfe\\x81\\xae\\xa6\\xcc\\xde\\xfb\\xa0\\xcb\\xc2\\xc2ob?\\x1b|\\x8b\\xbah\\x04\\xf6?\\xc6\\xbeq\\x00v7\\xedt\\xc1\\xdamo5\\xbc\\xefi\\x181"
  750. },
  751. {
  752. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x07{b\\x0b\\xef\\xbf\\x02\\xfb\\xac\\xa0~\\xae\\x85\\x94`\\xfaa]3i\\xe6|fm\\xc3|\\x0fk)\\xc8m\\xa3x\\x94\\x7fu\\xe2\\x8b~\\xcfp#s\\xb8\\xd7\\x90\\x0c\\x95[\\x9c\\x95\\xae\\xc2\\xd4\\x85}\\xf2\\xd9u\\xb4\\xe6\\xd1w\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc2fk6\\xbe>\\xfa\\xa1\\xa5\\xec\\x90(\\xc5x\\xe0\\xc2laf\\xd4\\xab\\x90<b\\xce[\\xef~\\x05\\xc7\\xc7\\x90{z'\\x9a\\x9e\\xe8\\x83\\xa7\n\\xc3\\x16\\x0428\\xac="
  753. },
  754. {
  755. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5p\\xc2\nk,\\xbf\"\\xa6^\\xc9r\\xd2\\xf3\\xabv\\xef~\\xba\\xde\\x87m(\\x8d\\xd7\\xf4\r\\xe6\\xdb\\xea\\xcb\\xcc\\x01\\x91\\xe8_}\\x17\\xde\\xd5\\xcf\\xee]u\\xe5\\xb11\\x88\\xa5\\x8a\\x87\\xa6\\xa4\\x86\\xbc\\x07\\xc6y\\xd9\\xeb}\\x85\\xfd\\x8a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc9\\xa9db\\x19\\xbf\\x99|b\\xf4\\xa4k&\\x0frx\\x89jn\\xbc8x\\x1d\\xc8\\xf0\\xea\\x00\\x86f\\x81\\xdd\\xad\\x93yf?wb\\xed\\xf92\\xf0\\x98\\xae\\xd3}\\x91\\xe5"
  756. },
  757. {
  758. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x988\\x97\\xa4\\x8f\\x9e\\xa9\\xb3k\\xd4b\\x125\\xa2\\x9f>z\\x9c\\x8e\\xd0\\xb2\\x86o\\xfd\\xb4\\xb6\\x10\\x1e\\xa7\\xff\\xab\\xbdh\\xa8\\xa2h\\xb8\\xe48\\xb2\\x9c\\x92k\\x8d\\x8db\\xf1bd\\x04\\xef\"\\xf4\\xfd\\xe4'\\x8b\\xf1\\xc2\\x91\\xc6\\x98\\x0f\\xa2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1838\\xeam}\\x95\\xa8v\\xd2z\\x85\\x9d\\xab2\\xd0\\xef7\\x9c=\\xf2\\xbb\r\\x85\\x00\\x1fy\\xff\\xf5\\x82\\xc7f\\xd4\\xb6\\xd0\\x90\\x82\\x03\\xa5;\\xdc\\xfb{\\xd9\\x01,y\\x82"
  759. },
  760. {
  761. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xeb*\\xd4\\xa8\\x99\\xc7\\x15\\xeeq\\x98_q\\x91\\x8d\\xa0\\x99k\\xc5\\xfa\\x14?6y\\x18\\x17\\xf1\\x01\\xf6\\x16ik\\xa6\\x11\\xa7\\xe1\\xe7\\xe7\\xcd$c\\x1an\t\\xd4(\\xd8 \\xc3\\x8d\\xef\\xe7\\xb4\\xf8z\\xbf\\xcd\\x1e\\x83\\x14\\x98z\\x84\\xb3\\xd2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1e\\xc9s\\xb6b2[\\xb3#\\xc6h\\xaa\\xca\\x9c\\x97\\x8ba\\x18\\x10\t\\x0c\\xdc\\x88\\xf13\\xb7\\xb0\\x16(4\\xe8\\x04\\xec\\xcf\\xc8\\xb1\\xc9\\x84\\x06\\xe7r}\\xd9\\x0c\\xff^?*"
  762. },
  763. {
  764. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04g\\xec\\x13]w\\xce\\x01$\\xfcu\\xce} [\\xb7\\xfb\\xedzh;\\xa1\\xee\\x8a\\x1d\\x1e\\x87_\\x8e\\xd4\\xbb\\xda3\\xc9\\x89a\\x1a,\\x1a\\x82\\x8d\\x94\\xfc\\x0b\\x85\\xee\\xce*\\x06l\\xaa\\xa6\\xf2\\xb6\\x85\\x16%s\\xf6\\xdfw\\x7f\\x7f\\xe5\\x99\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb9\\x05\\x8fx(\\xef\\x8d\\xa1fns\\xdc\\xd9\\xb9/h\\x9b\\xa9\\xe0\\xf9\\xa0\\xbb\\x8f\\xc1\r\\xe9\\x93\\x7f\\xf1\\xe3|\\x84\\x9ez8\\x1f\\xb5\\xa2\\xeb^\\xe2\\xee\\xda\\xf9|\\x98d3"
  765. },
  766. {
  767. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x95[\\xb8\\x8e\\xdd\\xd3bl}\\x08\\\\xd9m\\xa7\\x00s\\xec\\xe1\\xe5\\xbc\\xfb\\x92\\x90\\xa9\\xf9uu\\xcd>\\x85or\\xff\\x97!\\xfd)=\\xd6ufy~l|\\xf740f\\x0b\\x9b<`\\xed\r\\xe7\\xe5\\xbe\\x18\\x88:\\xe0{*\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x06\\xf1\\x02\\xed p\\xa5tf\\xc8\\xd4i\\xedn\\x82\\xdb\\xd1o\\xff\\xdf<4^t\\x10f %#\\x9c\\x00\\x82@\\xe1\\xf5\\xea\\xc6\\x8f\\xd1t.\\xdd1t4\\x1f\\xe0f"
  768. },
  769. {
  770. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04v<xl\\x93a0\\x8e4gpm\\xe5\\xbct\\xf1\\xa8\rf\\xca\\x92/\\xb3\\xe8p\\x13~~o\\xaf\\x05n\\xf1\\xf1\\xb3\\xf3\\x9b\\x94\\xb0\r@\\x8c\\xea\\xed\\x85\\xac\\xe5i\\xa3\\xe1jbx#\\xd0\\x07l6\\x82\\xbd>\\xdf\\xe2\\xd9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xce\\xbbs\\xfb\\xff\\xdc!\\x83\\xa7\\x97\\xc9\\xe9\\xddxc\\xc3c\\xeb\\xd6\\xbd\\x12l7.\\x9b\\xc4\\xe3[\\xd5kc\\xe0w\\xd4\\x8b__\\x83\\x82\\x88<j\\xf2\\x9e\\xec\\x869^"
  771. },
  772. {
  773. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb6\\xc3\\x82\\xad\\x9e\\x91\\x8b\\xee%^#\\xe8\\xad\\xaf\\xd0]:=;h\\xfa\\x9ag\\x16\\xa7\\xe7\\xad\\xfdb\\x82&\\xd3\\xf1\\x18qs\\xf3\\xe2\\x7f\\xd6^\\xf1\\xd5\\xfc\\x91e\\x0fhuib\\xc4\\xb3r\\xb3\\xd2\\xee>\\xad\\xa5\\xf2]\\xe6\\x06\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000(hs\\xee8\\x90\\xe2\n\\xb0]\\x9f6\\xc9\\xb7\\x87\\xb8\\x01h\\x0fh\\xbd\\xba\\x11\\xdb\\xd2?$\\xc5\\xf3\\x03\\x8c\\x03\\xbd\\xbc\\xd1c\\xa3\\xdc(\\xcd\\x94'\\xc3c\\x98\\xd8kv"
  774. },
  775. {
  776. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xa3j`\\xe0\\xef\\xb4eir\\xb2\\xb2t\\x96c\\xfe\\xa0\"*\\xec\\x89q/\\xcb\\xed:\\x03|\\xee\\xcdl\\xd4a\\xa8y\\x1b\\xba\\x11#y\\xb2\\xfb\\xeb\\xa4\\xcc\\x82u\\xa32\\xf9av\\x13\\xfeg\\x19\\xdd\\xb9\\xbd\\x16i\\xec\\x8f\"q\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\n\\xb8\\xe5>x\\x10\\xed\\xc4d.\\xefrb\\x1b$\\xf0\\xc8\\x17\\xdc\\xd9\\x17cbw\t \\xb5\\xba\\x13\\xfefe\\xf6\\xf4\\x7f\\xe3rc3\\xaf\\x196\\x1fr\\x1a\\xfa\\xa9r"
  777. },
  778. {
  779. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf5\\xd5/\\xdb\\\\xb9\\xa6\\xa7\\x8fh\\x82\\xed\\xddc\\xc6\\xf6\\xf0\\xa6\\xbf\\xd3o\\xde\\x04\\xf2\\x13\\x0b\\xd9`\\xa5\\x8c\\xb3\\xd4\"d\\x02g|\\x7f\\x8a\\x90p\\x1a\\x0f\\xe3\\xd1\\xe0\\xff5d|\\x9e\\xf5\\xc0\\xdc]a9<\\xbbp9v\\xd9\\x8c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x11\\x82kf\\x99/\\xe2/\\xfe\\x7f\\xf3.\\x12r\\x13>q\\x9a\\xfd\\x00\\xc7\\x88\\xa7\\xb9.\\xe0\\x07\\x00\\x9bo)\\xf0\r1\\x959\\x1d\\xdb=o9\\x99\\xef\\x17\\xe7~\\x81n"
  780. },
  781. {
  782. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x80\\xf3\\xa1u\\x9a\\xd4\\xfa\\x92\\x91\r@m\\xf3\\x8d\\x93\\xc6z\\xc51\\xe5|\\xd2\\xf2\\xbc\\x8a\\x10\\xb3\\x19x\\x05\\xfa\\xd4\\x0c\\x01\\xf8\\xf5\t\t\\x8d\\x95\\xd7t\\x195\\xc9\\xa6r\\xdd=e4\\xe9\\xb1\\xe0p\\xc4\\x18ha\\xd7\\xc6/\\xe9\\xda\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*\\xedey\\x85o\\xf1>t|\\x88\\xc8p\\xa4\\x90\\xac\\xac\\x80\\xecr\\x04#\\xb7\\x04z\\xb5\\xee\\x14[\\x066?\\x1dc\\xd2\\xc5\\xfd\\xff\\xb0\\x83\\xda\\x1f\\x1c\\x9be\\xe3\\xd7c"
  783. },
  784. {
  785. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04r\\xd4\\xcb\\xd2@\\x08\\x1f_\\xe2\\xfe\\xcftu\\x05\\x14\"\\xe3\\x01\\x94\t#\\xbf=\\xb2\\xfc\\x88\\xfe`\\xaboi\\xa9\\x1f\\x89k\n\\x90\\xc9\\xa5\\xb8 ,f\\xd0r4.7\\x1fm\\xab\\xbe\\xdd\\x06\\x16\\x04:b\\xaa\\xa7\\xb4\\xbc\\xe3\\xfc\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000v8\\xd7wp\\x17\\x9bc\\xd0\\xcb\\x82a\\xd3\\xffd/fw\\xef\\x95\\xe6c\\xb77\\x99x\\x0c\\xa2\\x87[\\xec\\x8e\\xf9o\\xab\\x86f\\x02\"\\xcf\\xcb\\x1a\\xa99\\x1c]2\\xdd"
  786. },
  787. {
  788. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb6\\x84\\xc0\\xa3\\xdem\\xcav\\xf2r\\x13d\\x90\\x85\\xdbl\\x83\\x98s\\x1e\\xe7-z\\xbf\\xb6a}+\\x9acrkhd\\x1a+1\\xe3\\xf3\\xdbu\\x05l\\xccb\\xa3iuo\\xdbkw\\xcf\\x820\\xcc+\\xc8\\xc7k]\\xa5q\\xa5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfa(\\x18j\\xb0\\xd7\\x8d\\x82\\xcd\\xd3\\xd1\\xe8\\x1e)\\x83\\x02t(\\x13\\x9c\\xc5z\\xadr\\xdd\\xed=\\x89\\xe6\\x9a\\x14\\x0c]\\xb4\\x86\\xb7o;\\xefu\\xde)\\xe8\\xae1\\xccme"
  789. },
  790. {
  791. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  792. },
  793. {
  794. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdf\\x02\\x96\\xa2\\xb0=\\xc0\\xd0#g\\xfc\\x14\\xd7v\\xc4p\\xc7\\xa8\\x83\\xa3\\xdfb=\\xed!\\x9d\\x9b\\x96j\\x15\\xddv\\xba\\x8c\\x0bx\\x8c\\xf8a\\x97\\xd8\\xa0\\x98\\xb0\\x11a\\x90m\\x06z\\x05\\x00\\xab*\\xae\\xfe\\x18u\\x9a\\xf4h\\xac\\xc1\\xde\\xee7(\\x8f\\x87'\\xea\\xc8y\\xba+t\\x9f\\x15\\xac\\xfb\\xce@\\xb0bc\\xcf\\xb9\\x97\\xed\\xaen\\xcao\\x07\\xe3\\xd3;\\xfd\\x9a\\xb1\\xd4e@\\xb4\\xcd\\x81\\xd1/y\\xaev\\xeb\\xba\\x0e2\\x85\\xf6\\x16\\xebza\\x15\\xdc\\xc5\\xecm\\x11\\xbfx:\\xd1\\xad@\\xed\\xaao\\xf11\\xa2\\xb4\\xa8\\x82_\\x02\\xb3\\xd0\\x9fqp\\xb5\\xa5\\xe4\\x89\\x17a\\x83\\x90&\\xfcj\\xfa\\xc1\\x19\\xdf\\xab\\xa1\\xce\\xd3h\\x97\\x03s\\xcc5\\xce\\xde^\\xd7\\x1d\\xdbz\\xea\\xaev\t\\x1es\\xd9\\x0c\\x93nb\\xcf\\xb8\\x7f\\xa8\\x01^\\x86\\x0c\\xbb\\x0b\\x1f\\x16\\xc47\\x06\\xe2\\xf8a|\\x9e\\xaa\\xcdwy\\x00\\x8d\\x84*b\\xed\\xd9\\xcd\\x02rdss\\x8c3}r,yzu*\\x95u\\xb0\\xf5\\x17s=\\xdf\\x87a\\x8a\\xca\\xd3"
  795. },
  796. {
  797. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xdc\\x8e\\xcatt)\\xbfs\\xb3i\"v\\xdbp&\\xaflp\t5\\xac\\xb8y\\xf6\\xa2\\x88\\xe4p;\\x92\\xbe\r\\x9a\\x18\\xd3\\x8f\\x92g\\xc0\\xae\\xd2`\\xcc-e\\x7f#te\"\\xb3\\x9a\\x88w\\xc4\\x87\\x93\\xb5\\xcc\\x80[\\x84\\xa3\\xbc\\x1fno\\x1f\\x12\\xe9o\\xca\\x9e\\xaa\\xd6\\xe6d+v\\xe6\\xa2($\\xcb\\xfb\\x914f\\x87\\x9b\\xd5/u\\xfbq\\x91<\\x95\\xabvn\\xc6^\\xb2\\xffh\\xcbq\\xd7,\\x83\\x99\\xa3wgm\\xc3x\\xdf|\\x9ew\\xc0qn\\xb4\\x98\\xbf\\xa20\\x1e\\xa4g\\x08\\x00;\\xbbi\\xc3\\xec\\xfa\\x04\\xaa%)\\x82\\xdb\\xc0\\xb7i5\\xaf\\xab\n\\x9c\\x8b\\xdcaq\\xc4j\\x99\\xe8\\x14\\xb5\\xfd\\xab\\x8f%\\xde#\\xe2l\\x95#\\xa6\\xe8v,^fj\\xbej\\xa2\\xb8\\xad\\x02f\\x9d\\x19\\x0b\\xe8!\\xaa\\x9a\\xb4ww\\x0c}z\\x93s\\xd1ue9y\\xe60\\xe4f\\xb2\\xcf\\xf0\\xf7d.6g\\x91\"\\x8f\\x99\\xb8\\x16\\xe7\\x0fn\\xb8w\\xf2\\x11\\xa6\\xb2\"0\\xf5\\xb3\\x0e=c\\xe8c\\x954\\xc4\\x96\\xd4\\x86"
  798. },
  799. {
  800. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xda\\x0b\\xdc\\x8fg\\xb2\\xb9\\x1d\\xfa\\xb9\\xee\\xe0r\\xa9\\xa7\\xddob\\x8f\\x83\\xaaw\\xad\\xdb\\xe3\\xa5\\xf2)\\xba\\xafx\\x14\\xe0\\xc4\\x84r\\xefcvv\\xb0\\x8d\\xfa\\xc4\\xd5\\x01a\\xe9(\\xe8\\xd0\\x14\\x8e\\xdc\\xd1\\xb9\\xb9\\x02\\x7f\n\\x874x\\xdc\\x9c\\xa8\\xbc\\x93<\\xf8\\xf8i\\xcb\\x141\\xed\\xda\\x0f\\xcc\\x14bmm'\\xea{xo)y\\x98\\x08/\\xb49\\x1b*@\\xa0^pl\\x86*\\x98\\xaa\\x8d\\xb9%g\\xe1r\\xb1\\x12\\xc6\\xc2\\xa1}n\\xb9\\xccl\\xb9\\x17\\xf5jy\\x10{\\x0e 8em(\\xab\\x02=p\\xe2w\\xfac\\xa1}\\xaf\\x1b3,\\xcb\\xe2\\xadwkq4:\\xc5s\\xe9\\xceb\\xc2~,\\xe9\\x1b\\xde\\xa6t\\x03\\xd0\\xba\\x9b\\xa6a\\x9df\\xd0\\xae\\x87t\\xcc\\xdfha\\x12\\x03a\\x07\\xe64\\xde6\\x8bb\\x1e\\x81\\xa3\\xd9\\x99\\xe5\\x89)\\xa2g\\xb9o\\xd1\\x19\\xf0n\\xa4[\\xf2\\xe6\\xd5(\\xa69\\x93\\x19\\xd8\\xe9\\x8f*\\x15\\x9f\\xe5\\xe5)%g\\x01\\\\x0b\\x98m\\xf3\\xfe\\x9bs\\xa0\\xe7\ni\\xd6\\x0emc*"
  801. },
  802. {
  803. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xc0\\xbd\\x8b\\xd2\\xa2rc\\xcd)\\xf2n\\x88\\xcf\\x12t\\xc6\\x87\\xa1\\x0f\\x86\\x91\\xb8\\xfb\\xaal \\xaa\\xa4\\x8c\\x1d\\x08\\xa3\\x83\\xb5\\x15\\x9d\\xadq9\\xc5\\x95\\x92m\\xeb1\\xa9d&az\\xfee\\xd7\\x1c\\xa8\\xc9d\\x91\\xc4\\x82\\xab\\xac\\xf0\\xack!\\xb4\\xae\\xd8w\\xcb\\x01\\xce\\xf9\\xed\\xe7\\xf4\\x9b\\x07\\xe1b\\x99\\xa0\\xf7\\xa9\\xd6ob`\\xaa\\xe4a=\\xc4\\xe9\\xdc\\x91\n\\xdf\\x07\\x15\\x86y~\\xf1d$k\\xaa\\xae\\x86?a\\x10\\xfbh\\xdc\\xb9\\x19'\\x8a\\xe8\\x99\tum q\\xc6\r\\xebg\\xb4\\xeeh\\xfb}\\xdaodp\\x06z\\xe5\\x0fg\\xa7\\xa5\\-\\xb2\\xccau\\xb1\\x9c\\xd9\\x98\\xc8w@q\\xa6\\x1f\\xeb/\\x13\\xd6\\xd1\\xda?\\xc5j1\\xea\\x9c\\x16o\\xb7b\\x7ff\\xea\\x93\\xa8m\\xd7\\x80\\xef_\\xc6k\\xbf\\x0b\\x03\\x8fd\\xfe\\xbb\\x02b\\x03\\xe9a\\x18~e\\x1e\\x8d\\xfb\\x86\\xc6\\xf0hvc\\x7frs\\xa2\\x03\\xaati?\n\\xe2\\xeb\\xdf\\xa2au\\xb1y\\xefnp<\\xdf\\xa4\\xf1\\x14\\xf8\\xa1a\\xb1\\x87\\xf9~7\\xcc"
  804. },
  805. {
  806. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xda\\xa6\\x81^fa\\xe2\\x07\\x0f!\\xbc\\x98\\xf3nr\\x7f\\xaa\\xf5\\xb0&\\x89f\\x93\\xbfa\\x06\\x80\\xc8\\x1d\\x18\\xcd\\xa6\\xa8\\x81wq\\xb0\\x81m\\xe0@\\xbb}x\\xdb\\xba\\xc8\\xa8n\\x87d~^\\x94\nk\\xa4\\xc3\\xbe\\xbb\\xef\\xa7\\x10_\\xd8\\xef{\\xc0\\x8d\\x80\\x1b-\\xd5}\\xb2gs\"\\xe6\\x92\\xc8\\x82\\x89y\\x19\\xcf\\xf4\\x82\\xfa\\xbf\\xf0\\xbb\\xe7.xg\\x08%\\xe0hmk\\xac\\xd3\\x8d8\\xd8\\x02\\xab\\s\\x00\\xe9\\xf6*0\\xab\\xb9\\xf0x\\xb6\\xf1\\xb5e\\xc5\\xbf\\xb4\\xb0u\\xef\\xfexd\\xac\\xaaw\\x82\\xc0\\xbf\\xc2\\xee\\xa4\\xf9\\xf93\\xb0s\\x10\\xdd\\x81\\xe27\\xd2q\\x0e\\xb2\\x9f\\xe3\\xe9\\xdel\\xc3l\\xae\\xe1\\xa9\\x86f\\xf7^d\\x99;v\\xa0\\x08\\x13\\xf3\\x0b\\x8a\\xf8oxs\\xc2\"\\xdbo\\xad']\\xf7\\xe1\\xfb\\xdcg\\xbaz\\x1d1!b\\x86b\rh\\x00\\x10c\\xfc\\xf4\\x08\\xc4n\\xfa\\xee\\xd5\\xe0\\x1d\\xe8\\xde\\xbf\\xd5erzuw\\xbd\\x16\\x951p\\xcfi\\x99\\xf6\\x04f\\xba\\x9d\\xeep\\x9c\\xff\\xe7\\xa5\\xd3\\x8d\\x8cs"
  807. },
  808. {
  809. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010^\\xe6\\x13\\xcb \\x00\\xf1\\xfb\\xd4\\xd1\\xcf+>a\\xe7\\xa5\\x1b-\\xd8\\xfd'qe\\xc9\\xf4\\xe2\\x92\\x07\\xfcu#\\x1f\\xed\\xa4m+\\x970\\x83r\\xe1\\xb4\\xa1f\\x08k\\x8e\\xfa\\xdd\\xffs\\x06\\x82!q\\xe4\\xd8\\x17\\xf8(\\xf4k\\xb5\\x96\\x81\\x08\\x94\\x831\\xc2\\xc4a\\xa0\\x86e\\xb6\\xc6\\xfcc\\xff7\\xc8\\xbb\\xa929'w\\xefg\\xb5a\\xdc\\xbb:ai\\\\xf4\\x1cb\\x83x\\xb5\\xef\\x8d\\x15rkwm\\x97\\xc6\\xc8\\xc63>\\xd4\\xbb\\xe7#\\xbf\\x851\\x97\\x11\\x9c\\xdbc}+\\xe8\\x8eixa\\xf7\\xa4y\\xf3\\x19q\\x1b\\xbe\\x87+\\xff\\x99\\xd3\tc\\xdc\\xc7yl\\[\\xc4\\xc1\\x9f\\xed\\xb2%\\xa8\\xbd\\xd6\\xcb\\xbd\\x16\\xeaf\\xec\\x97\\x8b\\x91\\xda\\xc7\\xc4\\x0e\\xa8e\\xba\\xe7(\\xff\\x16@\\xa65\\x87\\x7f|\\xd2\\x05\\x19\\x85\\xd8\\xe7e\\x0fdkgj\\xf87\\x85\\xe2\\xbfzv\\x80(k@\\x88\\x97l\\xd9\\xfe\\x07]^\\x1fb5g\\xf4\\x85g~|$\\x03\\x87qv\\xb6\\xaf\\x8b\\xb0\\xb6o-\\xb5\\xc0q\\x17hk\\x8e"
  810. },
  811. {
  812. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb8}\\xb3\\x9a\\xe1\\xcf3w\\x0c\\xa2e^y\\x85\\x13\\x08\\x179\\xf6\\x9a\\xe7n\\xc2\\x0f\\x16\\xee\\x15\\x08_\\xb0\\x0f\\x04\\xc1c\\x1f\\x93m\\x1d?h\\xf0n\\x80h\\xc9\\xd2\\xd0\\xf6_3\\xf1\n\\xf3\\x14\\x0e\\xd5\\x1f\\x81t\\xe4o\\xba\\xbb\\xc4\\xa5)\\x15\\x84\\x98%'\\x91\\xd8e\\xcep\\xc6\\xdc\\x0c=]y\\x82\\x1dw1\\x9a\\xd17\\xffg\\xf6\\xdc\\xa4\\xd5\\x1d\\xa0/\\x05\\xc4\\xf7\\xa5b\\x00\\x8bb\\xf9\\x88\\x92\\xc2\\x8a zm\\x0c\\x00i\\x82\\x1d\\xf6\\xe7\\xb4\\xda\\xb1\\xd8e\\xfdf\\xcf\\x90\\xf29\\xf8'\\x81\\xbb\\xf3\\x1eq\\x83j\\xd4\\xb4\\xff\\xf3v\\xdebx\\xf1\\xe7\\xd1\\x0b\\xf6\\xdb\\xbd{qc\\x8c\\xa0\\x0e>d\\x05<\\xf8\\xeb\\x19/_7\\x94%/\\x11\\xca%ok\\xcb\\x1f\\xd3kr\\xb4\\x91\\x8e\\x10\\xf1t\\x898\\x84\\xb9@\\xf5n\\x92bc\\xd3\\xc2\\x9e7\\xbf\\xdd\\xdb.\\x9f\\xcf}yfr\\x7f\\xfa\\xe7\\xfb\\x98\\xa6}\"\\xb2\\xa4\\x9b\\xb3ew\re!n\\xa2\\xaat\\xac\\xe3\\x82$\\xc4\\xb9\\xb7{\\xde5\\x04i\\xb9c\\x0e"
  813. },
  814. {
  815. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe8\\x16\\xd9\\xcf\\xe1\\x97\\xb0\\xe1\\xea'\\x90\\x94f\\x9c\\xe4\\xa1j\\x7f\\xe5\\xef\\x9f\\xc8=\\x12d\\x04\\xdd\\xd2\\xf7\\x95\\x1dx\\xf1sk\\x08(\\xc2\\xfb\\xee\\x0fm[\\x85\\xb4\\xc8\\xab\\x1d\\xc93\\xdc\\xee\\xa6\\xf4(\\xc6\\xc9\\xa9\\*\\xbb]\\xd8cfg\\xed\\xc5\\xe2\\x9fo\\x11n\\xefg7\\xb4f\\xbd\\x8el\\xff\\x12\\xff\\xa0\\xbb\\x96x\\x00)k\\x0c\\xa2lt\\xbb[q\\x00\\x92\\x91\\xd5z\\xe06\\xf5\\xdc@r\\x84\\x94\\xa4\\xa9\\xd1k\\xfb\\x86\\xee\\xa3\\xf6\"f\\xfej\\x1fjl\\xe1\\x1eqyk\\x19b\\xad\\x0e\\xbf\\xaah\\xaf\\xe1,\\xe8bn\t\\xe0\\xe9)\\xfe\\xd0\\xf5goq\\xe3zj\\xba\\xca\\x7f\\xeb\\x8c\\xf8\\xbe ,\\xa9\\x91\\x85\n\\x99\\xcc\\xd5-\\x157\\xe1\ns\\x92\\x99\\xd3\\xc3\\x14aa\\xe9\\xf8s\\x84\\xcb\\xe6f\\x0b\\xdbch\\x16v\\x1f\\x8fd]\\xe2\\x80\\xf5|\\xdcl\\x8f\\xea\\xed\\xbf\\xe0\\xcc\\xae\\x9d6\\xbc\\x85z\\x9czx;\\xb7a_e\\x81x\\xb4q\\xbax\\xd1ld\\x05\\x93\\xd0x>qs~ \\xc6;t"
  816. },
  817. {
  818. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0101\\xafi\\xce\\xcc\\x03\\xc2a\\xa5\\x06\\x8fo\\xbf)(\\xa9t%\\x99\\xdf\\xf9\\xf6\\xb7\\xc2o\\x08x\\xe9\\xf4[{/\\xca\r\\xde\\x84|f.\\xd7\\xe3\\x95\\xa9\\xbde\\xc3\\xd0\\x17@\\xba\\xc1\\xb3|\\x1a\\xcc\\xca\\x8c\\xce\\x8b~\\x03>wdhgl\\x18>\\x18\\xabxi\\xd3fo\\xf5\\xef\\xd9\\xde\\xe6c\\xe5\\xfb\\xcay\\xff\\x06\\xf1a\\x8e\\xb3\\xc1\\xbd\\xc4\\xffn;fs\\x06\\x9f;\\x94\\x8c\\xe8\\xc9\\\\xf0\\x02ekt/\\x96cisl*\\xc3\\xfeyy\\x1e\\xdd\\xe1 hxf\\xdf\\xef\\xfeas:\\xcf\\xcbv\\xe6\\x047\\x0f3\\xa7\\xbc\\x88\\xb2\\xad\\x98 \\xf9\\x9c+\\x04`\\xe3\\xe2\\xacie.\\xa6\\xd73\\x01\\xac\\xdc\\x05i.\\xdc\\xf1}i\\x8b\\xa7;\\xc3l\\x07\\xb5\\xd2\\xe7\\x11\\xd6x\\xde\\x8d\\x01m\\xa1\\xe5\\xe54\\xd0?x\\xe6\\xe5m^\\xdd\\xc5nvl\\x86\\x90\\xff\\xfd\\xc0-\\x83\\x8d\n%\\xd6hzv\\x1a[<'t\\x9cq\\x94'q.h\\x9dk<df,\\xe5a\\x16\\x91\\x9c\\x0fd\\x89\\x0c\\xda\\x7f"
  819. },
  820. {
  821. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010.=\\xaf\\xf5\\xbf\\x1c\\x7fl4\\x17\\xf5j\\xb0\\xff\\xf4&\\xdb\\x005>:/\\xb8#:\\x9e\\x04lat\\xb6\\x02\\x00\\x93\\xe2\\xaa\\x13hf\\x01\\xff\\xc3up<~\\xf0ao\\x93\\xf6t\\xa3\\xe8\\xa1\\xdd9\n\\x80\\x92\\xa3\\xa6f\\xfd1q|\\x8az0\\x13\\x18b\\x10\\x0f\\xaf\\xa4:.\\x84*u4\\xcd\\x9c\\xafrud\\xdf>d\\x9f\\x12q\\xd6\\xac\\xa2\\xcb\\x16\\xc1\\xa8\\x85mz\\xa2a'|\\x9f\\x14\\x17\\x18=z\\x9a\\xe0\"r\\xbev\\x8a5\\x16\\xdde5zu^\\xbf(4\\xaa\\xee\\x8b\\x07\\xaa= tbnj\\xdc\\xda{\\xf9$\\xdc\\xdc\\xd9oh\\xa4\\xf1\\x89\\xaa\\xa7\\x0b\\xf6\\x8ak\\x8b\\x82\\x90n\\x87u\\x8b\\x95\\xc7\\xb1\\x88\\x95\\xa6\\xc5\\xe6=\\x9a\\xedo\\xed\\xc6\\x13\\xaej\\xfb&\\x9dm\t\\xb6\\xf8\\xc04?\\xdd\\x917\\xd4\\xe5\"\\xca\\x99n\\xa3@\\x13\\xbe\\x08\\x14\\xcao5\\xbd\\xc7/\\x88\n\\x8a\\x82t\\x80y\\x9b\\x1d|\\xc7\\xa4\\xe1x\\xd5s\\x97\\x90~^\\xc6sl\\x91,@\\xba\\x95\\x05\\x94\\xdb\\xf63"
  822. },
  823. {
  824. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe5\\x9e\\x18\\xcf\\xf0\\xc4n\\xbf\\x8f\\xd9\\xa8\\xd8\\x94\\xc00\\x8a\\xeb\\xd3tr\\xcf\\xfd\\x85\\x98\\x9b\\x98%\\xa7rq\\x95\\x8c\\xbd\\x88f\\xddo\\x8b\\xe4k\\xba\\xd6y\\xeb\\xcaj\\x91v?\\xd4 z\\xeco%\\x9c\\x96\\x10\r\\xa9]\\x0b\\x14\\xcc\\x91^\\xca\\xa6\\xda:q\\x07\\xa9\\x8d+\\xe8\\xad-o\\x843\\xfad\\xc0\\xb2\"\\x19\\xe6\\x8b\\x08\\xb9p>qn\\x0f=s\\xf5\\xe1\\x95\\xf8\\xee\\x0e\\xa9\\x1e\\x1a\\xff0\\x04\\xf4>\\xb9\\xc6\\x85\\xb0\\xf3\n\\x93@-\\x94\\xab\\xaav\\xf8\\xcc_\\xaa\\xa5\\xbd1f\\x0cq\\xfel\\xdb\\x98\\xa2\\xf9\\xfeh\\xad\\x97$zz\\x8e\\xca\\x9a\\xfd\\x8a\\x13\\x11\\x8ei\\x04\\x0e\\xb3\\xbb\\xe5f/z\\xff8\\xc0d \\x17\\xb23r\\xac\\xf2]\\xc0\\xce\\x06\\xca\\xee\\x9cp\\xf9\\xd3b\\xce&\\x04`\\xa8\\x8a\\xaf\\xbd\\x8c\\xbb\\x15\\x07\\xf7\\xaax\\xa3\\xec\\xaf\\x88b\\x81\\xc4lsi)\\x0c\\xcff|/p\\xc4\\xcal\\x17lf\\x07\\xce\\xbb\\xbd0j0\\xc5d3l^\\xce\\xac\\xce8\\xc0>\\xa9\\x86\\xbc\\x809\\xaa&u"
  825. },
  826. {
  827. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x87\\xfda\\xd9b\\xd8\\xdb\\xf9\\x17\\xd1\\x95\\xb7\\x8a@\\x95\\xfc\\\\x8c\\xf3\\x94n\\xe3\\xc4^\\xe9$k9\\xbd!\\xb4]\\xfa\\xe3\\xfd\\xf1\\xa7cp\\x822\\xa1\\xbbk\\xfb\\xffg\\xcc\\x86r\\x08\\x00\\x05\\xe5 \\x86\\xad\\x94\\xd6\\x9c\\xd0a\\x99w~\\x878lt\\x13\\xbb#\\x95y\\x80\\x8e\\x85r\\xa5g<\\xfb-o\\xca\\x07i\\xf7\\xbc\\xf9`=\\x02~\\x8ec0=\\xf3\\xf6:n!\\xe7t\\xa2j\\x94%e\\x1ay\\x18\\xb9\\xa1\\xa6\\xe7 \\x11\\xd3\\xa3'\\x01\\x9d\\xf5\\xcdqsy\\xcaf\\xa9\\xc2\\xd5 \\x7f\\x0e.#%s\\x80\\x9be\\x06n\\x02\\xb8&7c\\xb6\\xd1m\\xd7\\x90m\\x96\\x19gh\\xbd\\x8f[\\xd28\\xa1\\x14\\x16o,/(uq\\xe3xf\\x08\\xf3\\xa5\\x96\\xee\\xf5\\xa4ed\\xd5\\x07\\x90\\xab\\x9d\\xa6\\xa8\\x01%\\x8d9nl\\xf5\\xdd{\\x0e\\xcf\\xc0x\\xfc{\\x13-\\xadxa\\x00\\xe0\\xea\\x1f\\xb3\\x0b\\xee\\xf8^o\\x7f\\xe9\\x9b\"\\x0f\\x03!\\xf4\\x8e|\\xda\\xb3\\xcf\\xd0\\xd7:\\xbd:aa\\xf1;\\xdetj\\xbd\\xaf"
  828. },
  829. {
  830. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8d\\xf1f\\x89c3\\xc2}\\xab\\xae\\xf9\\x16\\xd2\\x1f\\xc2\\xbf\\xa1\\xf6(\\xdb\\x973\\x93{\\xfcm\\xefq/c:\\xe7\\x16\\x0ef*9fx\\xbf<\\xec\\xbc\\x1f\\xd0\\x95\\xc4\\x80o\\xf0\\xa1\\x08\\xb8\\xa2\\xc4.\\xa8\\x1a\\xe3o(5\\x0cwb\\x11\\xefgw\"\\xd8\\x16r[hnk\\x97\\xec$\r\\xd2\\x956\\xf6\\x81\\xc4\\x93\\x9f}k\\xb2\\xa0\\xa7\\xf7\\xb6\\xb5\\x1bzt\\xc0\\x9d\\xc5\\x92\\x11\\g\\xe0\\xb7\\xafre\\xf4\\xe0\\xe2\\xf1>\\xb0\\xcb\\xbd\\xba>\\xe9\\xdaib0)ue\\xa9t\\x96v{\\xb7g\\x8f\\x0c\\xe1;j(\"\"\\xe6\\xb4\\x05\\xa2\\xb3\\x15\\x1fe#c\\x82dq\\x9fp\\xd6ss\\x80(\\xaerz\\x1b</\\x1e\\ct\\x8b\\xdb\\x9c\\x98\\xd2w\\xad\\xdem\\x1f\\xf75?0\\xe9\\xb0\\xcbs\\xafm@\\xecn\\x10\\xed\\xc0\\x7f\\x83v\\xa7\\xa7j\\xd7\\xda\\x1c29h\\xc3\\x07l\\x1dt\\xa4\\xd1z\\xa9\\x9d}y\\xe9t\\xd5\\x12?\\x8e\\xfd]\\x8aj\\xb9\\x8f'\\xec\\xa8r\\xd3v\\xf2\\xf0\\x00\\x07\\xe5!!("
  831. },
  832. {
  833. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe08n\\xbc\\x10\\xbf\\xa6f\\x9e\\xb0\\xfa\\xb6a2`\\x8b\\xbe\\x17h\\x11\\xf4\\xd7\\xd2\\xc9\\x9dn \\xae\\xea\\x95/\\x85\\x83\\xed\\\\x16s\\xf2\\x92n\\xb4f\\xb7\\xb8r\\xec\\xb8z\\xcag\\x1b\\x8b9ba\\xfe\\xa3\\xad;c\\xd0\\xb9\\xe5\\xabwlxo\\x0f\\xd3\\x82\\xb1u\\xa1\\xa3\\xdc\\x91\\x14\\x0c\\xea\\x18~\\x82\\xa7\\xcf\\xd9>\\x97\\x1d\\xdb\\x01\\xde\\x1di@e\\xbb*\\x06\\xd2@up\t\\x1bz\\xe9!\\xe7\\xfd\\x9d\\xa7\\xb8\\xe4r\\x0e\\x17\\x88 \\x89\\xd2\\x9b\\xd5\\xc21\\xab\\xcf\\xb3\\xba\\xa9\\xf7\\xe1\\x992!:\\xcb\\xcb\\xae\\xe08\\x1a\\xb1\\xd2\\xdd\\x06\\xa3\\x00\\x92\\x08\\xfe\\x8c\\xfa\\xa0\\xe1\\xa8\\xbb\\xf2\\x86dg\\xc8\\x8dkc\\x12;2k\\x11\\x0f\\xe0\\x109\\xf3\\xec2\\xba\\x9a\\x12w\\x17]\\xac\\xa2\\x9e\\x19s\\xbe\\x12\\x9b\\xbb\\x1f\\xb3\\x14h\\xd1\\xec\\xb8j\\x91q\\xf6\\x0bj\\xbf\\x99x<\\xfb\\x83s\\x81\\x18\\xed\\x8b\\xb7'\\xed\\xcb75'\\xf8\\xff1\\xecq\\xd9e\\\\xde\\xb1\\x0b\\x8c\\x94\\xa8>_\\xf0atvp\\x87\\xa9\\x8f-\\x8f\\x88m"
  834. },
  835. {
  836. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1c\\x8d)_\\x8c\\xf7\\x1a\\xdc`\\x9b/m?\\x1b\\xff\\xdd\\xc0mm\\x1b \\xcb\\x1d!,g2\\xae\\xbb\\xea\\x0c \\xbe\\x19\\xa9\\xc8\\x97\\xe5\\xaef\\xe8\\xee3\\xe8\\xd5\\xacb\\x10q\\xa7\\x0b\\xfe\\x15zfm\\x97?w\\xc5b\\x9a\\xf5\\xa8\\x8f\\x92p\\xd8q\\x8c\\xf9\\xee\\xfe\\x99\\xbf\\x11c\\xe46\\x15!\\x8b\\xdc\\x8d\\xc0\\xfc/\\x86\\xbbf\\x0f\\xedv\\xc7\\x91w\\xe5\\xb66\\xee\\x12bx\\xf6\\x1e\\xfe-s\\x02\\xfe/<\\x12\\xc5\\xaf\\x84\\x00\\xf1\\x99n\\x02'ub\\xef\\x80\\xd5\\x91\\xe7k\\xa7'{\\x15b\\x08<\\xed\\xec\\xef\\xb6\\x13z3\\\\x1e\\xd1i\\xe0t\\x91\\xcb\\xbc\\xe9\\xab\\xc0\\x0fs<\\x92\\xa9/\rrh1\\x08\\xd8`\\x96\\xe8\\xcf\\xa8\\x00/3\\xd1\\x8f\\xbf\\x9b\\x9c\\x07gxy\\xd6\\xa9\\xae\\xf0s\\xac\\x074\\x8d\"2p\\x15\\x841\\xb4\\x90\\x82\\x99\\xb8\\xeeqvz\\x8e}\\x01\\x8e\\xb1a\\xe7\\xef\\xdc*d}b\\xdc~\\xf0\\xfe\\x8c\\xdf\\x87\\x07g@\\x8fcim\\x81c\\x83\\xc6x\\xe1\\x1d\\xc0a\\xb5\\x1d\\xdd\\x83\\xe31"
  837. },
  838. {
  839. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010r\\x0ewq/x\\xb2\\x95l\\xfa\\xfbw\\x9a.:\\xd1\\x06\\xd7\\xb7@\\x7f\\xf1<\\x0c\\x1e%o\\x05\\xba\\xc7\\xf9\\xa9b\\x9e\\x06m|q5\\x00nxo,\\xfevu\\x83\\xd3\\xa0\\x9e\\x0cg\"0\\xb9\\xd0\\xd5l\\xce\\xadsr\\xea\\xc9\\xc2x\\x81\\xff\\x11\\xc3v\\x1b|\\xaa\\x16\\xab\\x9b\\xd1\\xa3\\xe3jj\\xef\\xe1\\xdd\\xe4\\x8c\\x17\\xed\\x8fw\\x84\\xdb\\xd8\\xbd\\xe9\\x8bslp-\\xe3\\xb6\\xc5\\xba|\\xde\\x9b`\\xba\\xe7\\x12\t8\\xa6u\\xccn\\xdca\\x9b\\xdc\\xe4\\x14\\x01\\xf4\\xe8\\xae2\\x7fj\\xf3\\xd5\\xc2\\x0e\\\\x85r\\xc2\\xb9\\x96\\xbe\\x9d\\xb3hb\\xb5\\x04tu(\\x85\\x7fb\\xe4\\xac\\xb2\\xcf{xj\\xa5\\x869\\xf7\\x97\\xadl\\xe2\\x91\\xb7\\xc5\\xe0z\\xcc\\x9d\\xe7ad0\\xb2\\x1a\\xbdqm3^\\x14u\\xe8\\xfd\\x88\\xff\\x1e\\xbd\\x17\\xc2\\xf7\\xb2k\\x9ad\\x93u]*\\xed;bm{f\\x12\\x1d\\xace\\x9dzz\\xd2n>{\\x11\\xee\\xf6\\xc7\\xa6\\x8f'h]2\\xcbh\\xa9,sw\\x9c\\xe4\\xd2\\xee\\xae\\xac\\x14\\xc5\\x9c\\xec\\xaa"
  840. },
  841. {
  842. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010f\\xf6e.\\x9c\\xe7[%f\\x02\\xd1j\\x1bo\\xc7\n\\x89\\xc4\\x89k\\xf2\\xd5/h\\x95\\xb1]\\x8a\\xf7\\x9f\\x8a\\x01d\\x10'\\xf3\\xe4\\xfcv;?\\x1f\\xf2\\xf2\\x13\\xa1\\xa4\\xef\\xde\\xff\\xa3{8\\xa8z\\xedd\\x06\\xf0\\xd1k\\x97\\x8d`\\xc8\\xdb\\xfc\\xfa\\xb0&(\\xfc\\xa5$\\xe8\\x18r\\x12\t\\x95f\\xd8\\xe4\\xc6zj\\x02|\\x8c\\x9fu)\\xe9\\xa8\\xfc\\x97\\xc9\\x81\\xb3\\xa4\\x1a\\xad\\xe06\\x05\\xf9o7\\xd6\\x18\\xc6\\xb6\\x04\\xfb\\x8e2!\\xc5|\\x06\\x0e\\x00\\x96\\xf3\\x16\\\\xe9\\xc3fc\\xa5&\\xd5\\xfe\\xad\\xae\\xd1\\xc9kx\\xa2sgp\\xfa0tz!st8\\xa0o\\xa0u\\x98@\\xc1\\x8e\\x88g\\xcex\\xb6\\x85\\xed\\xc9\\x9c\\x13e=\\xc5\\xd2\\xae6\\x92\\xfa&s\\x06\\xf6r\\xfbu]px\\x0e\\x12\"\\xa6\\x80\\xe0\\xb9\\xbd\\x8f\\xc8:\\xc8\\x04\\xa0$\\x97(\\xfa\\x12pw\\xaa\\xf1_p^d\\x18\\x18\\x04\\x83d\\x98vv\\x84\\x04h@\\xe9\\xe8\\xe0\\xfefh\\xfcd6\\xf4d\\xe4\\xd0\\x8b\\xc8\\xdd!3\\x12\\xf7-\\xb0\\x8d\\xc6"
  843. },
  844. {
  845. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf6\\xa1\\xd3z\\xdfg\\x80%`(\\x9d\\x99;\\x90p\\xdcg\\xfc\\xf0\\x82\\xab\\x16\\xc5\\x83\\xe9\\x87\\xa0<eed\\x99x \\x84%\\xfb6\\xe2\\x1c7\\x9bf\\xab\\x92\\x8e\\xb17\\xaa\\x08\\\\x17\\x02p\\xa0\\xfa\\x88\\xa1\\x90#\\x19\\x08\\xc6z\\x83p\\x85\\xfbl\\x9c#\\xde\\x85hf\\xf1\\x0b\\xcd\\xa8\\xcai\rwe\\xaa\\xfdsbw\\xac[\\xd6\\xf9\\xbd\\x88\\x00\\x9d\\xae\\xa8\\x80e\\xe5f\\xae\\x90q\\x01\\x0f\nm\\x98\\x18\\xc9<\\xb2\\x05\\x91\\=\\x15\\x12\\x18b\\x12p\\x7f\\xec\\xca\\xf0\\x86lu\\x92.-n\\x81\\xab\\x03n\\xa4\\xe99\\x1d\\x92z\\xb8=\\xc8\\xe8:\\xf6\\x1a\\x07\\x9b\\xb2tw\\xab\\xbf\\xf2\\xa9\\xb7r\\xa5x/\\xa3md\\xaf6c<\\x82\\x0b\\xc3\\xab\\xf5\\x93\\xf2\\xd7l<\\x93i&\\x0eh\\xe3kx\\xef\\xaam\\x1dy\\xb5\\xd0]\\xfa\\x90\\xe3j\\xbf\\xf0\\xc3\\xacg\\xef\\xec\\xcd\\xc3op\\xacu\\xff(lv\\xcf\\x13\\xb4\\xf9e\\xca\\xc7\\x9e \\xfb\\x1bp\\xac\\xab[\\xbeo\\x9b\\xcd\\xabq\\x7fej;\\x1a\\x9b_8s"
  846. },
  847. {
  848. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x19\\xacs\\xe1d\\xe1_f\\x80%\\xf8\\xc9\\xee\\xd5n\\x8f\\xeb\\xfb\\x06\r\\x94\\xc2a\\x14<\\xa9x\\x9d:\\xfbx86l\\xab\\xaf\"\\x0e\\xd3\\xa3\\x9f\\xc5\\xb8\\x9d\\xc6?\\xdd\\xc0\\x15\\x163\\xd5\\xe8\\x81\\xcel\\xadi\\xff>\td\\xce\\x995v\\xab\\xce\\x95b\\xdc\\xf1\\x18d\\x89\\x94\\xd0y_y\\\\x90\\x04\\x1f\\xcfr\\x0b\\xbdn{p\\xc5_\\xfa\\xd4\\x03\\xd3}\\\n\\xd3\\xd7\\xbf\\xe0yd\\xe3\\xd7\\x83\\xc4\\xd5\\x98\\x9c\\x07&\\x85i\n\\xf9\\x92\\xb29_\\xe2\\x1b\\x98\\xb7r\\x81b\\x12j\\x14fl,t\\xcb\\x8e/bk\\xd2\\xe5\\xfbf\\xa6>\\xa6p\\x96\\xbcv\\xb2-dm\\xab\\x96\\xde\\xa9\\x19:\\x8f\\xad.]b~o\\x1foc\\xb6\\xc1{#\\xcaui\\xb0\\xdeuk\\xe3\\xf4\\x1e\\x9d\\x02\\xf6\\x16f6\\x16\\x83\\xf2|ot\\x9e\\xbfa\\xc5\\xb9\\xe9t\\x99\\x80\\x84\n\\x8e\\xa9\\x94\\x13\\xab\t\\x93\\xf4=\\xf6\\xfd\\xee\\xef\\xd4+go\\x8b?\\xfd\\xd9\\xc8\\x9dn>\\xc2\\xd1\\x93\\xace\\x00\\x9ey<\\x04\\x8a\\xd4\\x1d\t\\xa8\\x18"
  849. },
  850. {
  851. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010sj\\x12{r\\x04e\\xf3\\xaay\\xb1\\x97\\xa2\\xc6v\\x13\\xe1\\xac\\xb3\\x99\\x08\\x00\\x838\\xc2~d\\xb2\\x84b\\x9a\\xde\\xbc\\x80m'+\\x91\\xea\\xa9\\xa7\\xda.b\\xa9\\x1cn`\\xe5\\x8b:;6\\x95\\xc11\\x00 \\xcb[;\\xc4x\\x98\\xbd\\x80\\x01{\\x04uz\\x85ejxu)\\xa3r\\xa8ua\\x0b@\\x87f-|\\xe0\\xa6t\\x83\\x11\\x8c*<{\\x05lpn\\xba\\xa7\\x94\\x1a\\x1e\n\\xe4\\x93\\xe08{\\xe7g\\x12(\\xeecc\\xf7t\\x17\\xc1\\x04hy\\xd8\\xb3y\\xe2b\\xa3t\r$\\xeb\\x98\\xad\\xe0\\xcf\\xefh\\x92\\xff\\xc9rt\\x9e\\xaa|\\xc6d\\x99\\x08\\x1f\\xa8h\\x8f[\\x04\\x9e\\xa0\\x820\\x9cjq\\x9fe/\\x11\\x85\\xf1u1g:\\xeb\\xdd\\xb5\\xdc\\x85\\xc8!\\x1c\\xe6\\x1f\\xa4j\\x02\\xf1\\xb1\\x90\\x05\\xa5ap$\\x12'\\xb8s\\xe2\\xea\\x05\\xdeb\\xf9\\xe3\\xb3t\\xac\\x90/\\xf2\\xaa{v\\xf4;\\x06\\xe1-\\xb9\\x94\\x13\\xba\\xf0\\xb3d\\x92\\xcf\\xc2.\\x82\\xa0jo(\\x0c\\x99+!\\x8a\\xc8\\xb5\\x99\\x11x\\xdf-"
  852. },
  853. {
  854. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd1of\\x17\\xed\\x86\n3+\\xe4d#\\xae\\xba\\x9b.?\\x12d\\x1d\\xc3\\x8d1\\xc0\\xd5\\x96\\xe5m\\xe5a@o\\xb7\\x04g\\xcb\\xd0\\xbb\\x17\"v\\x81\\xbbiu\\xb3b\\x19\\xa7\\x17)\\x8ff\\xf3\\x07\\x18)\\x8a\\xfcps~\\xbb\\x1ej\\xbcp\\x85\\x00\\x97=[h\\xe9\\x1a*\\xc9\\x91\t\\xdfq\\x0bg)\\xc8\\xa9\\xc3\\x18x\\x19$\\xe7\\xc2\\x02\\xfa\\x0f\\xea\\xbd\\xf6u\\x1b\\xc6\\xfftr\\xc6^!p\\x0f%m\\xc9\\xccd\\x1a(\\x96\\xd2i\t\\x8bh\\xc89\\x19\\x94\\xec\\x95{\\xd3\\x9aq\\xb9]+e:\\xb8\\xbf\\xf3\\x86)b\\xe4\\xd8\\xdat\\xc6\\xa2\\xd1\\xfa\\x18\\xc1\\xbf\\xed\\xc3\\xf2pr\\xaak\\xd6\\xd7\\x04\\x00\\xecz\\xeb\\x98\\xe5v<\\xb8-\\x91\\x96\\x9cf\\xbb\\xd8}\\xd5p\\xa8\\x193h\\xc9\\xfb<\\x1f\\x91\\x06.\\xe8\\xc9\\x88\\xfa\\x19\\xf6\\xdc\\xf0x\\x87\\xd1\"\\xe4\\xc4\\xc8\\x93fm\\x95\\x18\\xad|\\x06\\x8c\\x9d\\x0b\\xe6z.\\x18\\x02h\\x0c\\x16>\\xe1,\\x9f8\\x92\\xfaa\\xcd!\\xa5a<}\\xb2\\xd0,\\xa1i\\x9c\\xae\r"
  855. },
  856. {
  857. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010 \\x9ff+\t\\xa3k(\\xc3ab\\x16\\xf1\\xc9\\x84k7n\r\\xffg\\xc6\\xf5\\x1b$\\xb4\\xda\\x9e\\xf4\r\\x90\\xc6\\xec\\x0frq\\xac\\xb7r`w*\\xa8n0\\xdfkz\\xc0<<?\\xd7\\x1bf\\xca\\xce\\xf6\\xa71\\xdb\\xc86\\xdbk\\xeaopa\\x93\\xcdxd\\x8b\\xda'\\xc3\\xb8j\\x7f'\\x9e\\x802~\\x1a\\xe2$:\\xd9\\xcb\\xa6\\xcd\\x90\\x91w\\x067\\xa2{-\\xfe\\x14\\xff\\xfa\\xbf\\xf1\\xe8\\x90\\xc3\\x83q\\e/\\x0c2}\\xe6\\x00\\xe7+\\x1d\\9\\x9b\\x8e\\xaeq\\xab\\xb7*\\xba,il\\xa9\\xf3\r\\x7f\\xed\\x93s\\xbb\\xea\\x82\\xba@\\xaa\\x0f\\xe2\\xc8x\\x0b;i\\xa3\\xf2h\\xff-\\x1a\\x11/\\xd9\\x9d(\\x16@f\\xa8j\\x9b\\x9b\\xe4\\xa3\\x1ae\\x92s\\x8a\\x0b\\xe2\\xb8\\x08\\x13\\xa4\\xae\\xc9\\x14\\xd9\\\\xe5\\xe2'\\x0c\\xd8\\xb7\\xac\\xa5\\xb3?t\\xaagz-\\xcf\\x90w\\x8ct\\x8c\\xff\\x9f\\xab\\xfd\\x13\\x04\\x05_\\xcd\\xe69\\xb5\\xe2@\\xc3 <\\xafh&m\\xbc\\x8d\\xb2,\\xd1\\xf6\\x05u\\xd0^,|\\xf5'\\x04\\xdc\\x9e"
  858. },
  859. {
  860. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd1\\x109*q\\x8fg\\xf5\\xfd\r\\xc2#\\x0c\\x05b?\\xd70\\xc5\\x90\\x7f\\xbe\\x85_\"\\x8b\\x8bq&qq\\xe4\\x16\\x99\\xd8\\xa6\\xb9hg\\x8c\\xe8xz\\x88\\x07\\xe05\\xcd\\x1f\\x97y$\\xb3\\x8e\\x9fy\\xc2]v\\x14\\xe9*\\xf0tg;-6%\\xd9\\x1f\\xd9\\xeb\\x9e\\xab\\xa8s\\x879\\xcc\\xe4t\\xf5\\xf5\\xa9\\x8bue'v\\x0e&\\x0b\\xdcu\\xab\\xdcoei\\x9ew\\xcb\\xd2<e\\xb7$\\xb8\\xcd\\x96\\xa1\\xc5\\xe0\\x8c*\\xa0y\\x7f\\xe5q\\xe1\\xbf\\x88\\xfdk)\\x9ddw\\xfbnmk\\xde\\xba\\x92\\xf6\\xecl\t\\xb3\\x87&5\\xa9\\xdf\\x8b\\x9ci\\xdd/\\x8cw\\xdd\\x1a|y\\x01\\x105\\x13n\\x15&\\xb9\\xfb;\\x0f\\xbay\\x87]\\xa8\\xca\\x87\\xc6\\xd9\\x19\\xc5\\xbb\\xab\\x0e\\xf8\\x92^\\xbcwr\\x82\\x84\\xa87b\\xbev\\xbbg\\x1d\\xf5\\x18\\xa8r\\xe9\\xbdp\\xdc\\x8d\\xc2l(e\\x0c{\\x9a\\x18f\\x06\\x91k\\xa50g\\xebd\\x17\\xaf\\x8d\\xd4?4\\x12\\xfa?\\x00\\x9bm\\xcd5.\\x1fx\\x8b\\x96\\xe8\\xe9\t\\x1f\\x00\\xc2g"
  861. },
  862. {
  863. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010g$\\x16\\xf9vy\\xc9x\\xf8\\x0b\\x1ed\\xf1mty\\xae6gdm\\xdc\\x8f\\x9c\\xd0\\xdcfoeb\\x82w\\x05\\x86\\x95ur\\xa1\\xf7dn\\x19`\\x89\\xf9a\\x87\\xff\\xef\\xe8\\xa2\\xd1\\x0c\\x03\\x84\\x07a\\xb0\\x9d+~\\xd337i\\x94\\xce\\xe2x\\x05\\x08s*g\\xc3\\x07\\xab\\xe9\\x04\\xa4\\xff\\xdbn\\xf0\\xbf0\\x19l{o\\x92h\\xb8\\xa3\\x90\\x9b\\x0f\\x9d!\\x9bh\\xa4\\xa7\\xae\\x8dr\\xb0c\\xbb\\xe6\\xf6\\xe3\\xafz\\x0b&%\\xbe.\\xe7\\x90\\xbe&\\x96\\xff\\xa7\\x853\\x87\\x0c-\\xbf\\xe1\\xc2!\\x1cf\\xfd\\x8e\\xb1\\xf9s\\x08\\xea\\xac\\x07\\xa3\\x14\\xa6\\xbdr\\xf1v\\xcc\\x0f\\xc7\\xcf\\xbe\\x08{\\x16\\xb7h\\xfb\\xd3\\xee\\xcc\\x11\\x15>\\x9br\\xfa\\x9e\\xd5\\x9d \\x12\\x9b\\xd0fa\\xffq#s\\x0e\\xf0&\\x80\\xda\\xdeo\\xefh8\\xf1\\x8a\\xb0p\\xdd\\xceu\\x84\\xa7\\x8d\\x92f\\xd5@8g\\xcef\\x06\\x8d\\xbf\\xb1\\x84q\\xf5\\xc7\\xda>ij\\xebpj\\x82\\x1b\\xa3\\xaf\\xb2\\xaf\\xc6ayr\\x10\\xf1\\xa4\\x14o\\xaa\\xdb\\xe1u\\xa1\\q"
  864. },
  865. {
  866. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u\\x95\\x9a\\x02\\xfa;s\n\\x92dz\\xbb\\xe2\\xf3+{\\xeenl\\x1a\\xb8!\\x18\\x04v\\xdai\\xbb\\xcdsa\\x18}sa:u\\xa5\\x0c\\xa1\\x85\\xe4\\xd6\\x03\\xba6lf\\x05%0\\xa5\\x00i\\x9d}\\xc6`\\x04\\xbf\\x0b\\xda_\\x8cbh\\xefft\\x89e\\xd8\\x92\\xbe\\xf0\\xe4\\x9c\\xd5@,\\xa2\\x7f\\xe6\\xcba\\xb3-%\\xe9\\x90a\\xf1\\\\x14\\x853\\xc6\\x98y\\x98\\xa8?\\x83wk\\xbb\\xdc\\xa5@m\\x11\\xc4\\xbc}|\\x85\\xcf&\n\\xae\\xee_\\x94e\\\\xa3w\\x00$g\\x04\\xa2e\\x85\\x90+\\xe7\\x0f\\xf4\\x86\\xd4\\x80f\\x96h\\x16\\xa2\\xedu\\xbe\\x0b\\xe8\\xda4\\x01\\x12\\x10\\xba{\\xbcgj\\x05+q\\x96\\xb2\\xe3b\\xd9\\x8d\\xde\\x8dq\\xc6\\xad\\xa6);l\\xee\\x16k94m@8\\xb58\\xe8\\xfe\\x14\\xe6\\xb6c\\x02i8n\\x82\\xf4\\xa3u5f\\x1d\\xe6\\x905e\\x16j\\xdbf\\xf4\\xc3bhc\\x94\\xd9\\xd6\\x93\\x14!\\x95z\\xae\\xda \\xc0\\xae\\xe3\\xfd\\xc3|\\x8b\\x15\\x80<!k\\xf6\\xb1_2)\\x05\\x98-"
  867. },
  868. {
  869. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xab?\\x9c\\xf7\\xe9\\xcfzw\\xc1lf/\\x18\\xd4\\x99\\x12\\x8d\\xb0\\xacc\\x1f\\xa9\\x89\\x12^\\x9a\\xf0\\xb2v\\xce\\xc5\\xe5\\xf3\\x11lqi\\xf8\\x04 \r$\\xbb4\\xa3\\xa4_\\xd02fb\\x0e\\x11\\xbd\\x9bs$\r\\x8d\\xe0a]\\x1e\\xd4yo\\x0c\\xa7\\x87)\\x8a\\x98$q\\x8b4up\\xbef\\xd631:\\x95\\xcd\\x8e-\\x8d\\xd0\\xe2)\\x03a\\xde&\\x13\\xae_\\xe89a\\xbe\\xa9f\\xa5j\\xf2\\xc8\\xb9\\xda\\x96\\xd2va\\x95\t]\\x92\\xee\\x8euv\\x18\\x89\\x9a`\\x11\\xb0\\xbe\\xa4\\x82\\xb0\\x84vf\\x86\\x98!\\xbe\\xf3\\x81sj\\x18\\xf2\\xd5\\x97\\xde\\xfd\\x8bhj\\xbc 0\\xb7\\xe3\\x12\\xdcl\\xb6\\xd1\\x1b)\\xa4)\\xbe\\xb6\\x1d=e\\xe8@k\\x8e\\x8f *\\x98\\x11td\\x07zik\\xd8\\xa0\\xb5\\x0e\\xff\\xe5\\x8a\\xfaj\\x03\\xadg\\xd55f\\x10\\xa2z\\x9d\\x18b\\x1b*\\xd7\\xcbxlqg\\xeb\\xda/x7\\xcd\\x1e\\x8c\\xec\\xf5\\xbb])\\x03\\x1c\\xc1[\\xf9g\\xa5~zb\\xea\\x8d}iau\\x17\\x1c\\x9f3cc"
  870. },
  871. {
  872. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010&\\xe1.\\xa4\\x8a0\\xf8\\x1at\\xeb\\xf4\\x17\\xec\\x9d\\xa5f\\xa2l\\xbb\\x9b\n\\xe6\\xfd\\x0c0\\x92\\xe0:\\xa0\\xb4\\xfe\\xa4\\x91\\x9b\\xf7\\xd4\\x0ci\\xd9\\xaf`\\xe3\\xbd\\xcf\\xdc\\x8c\\x8dg\\x9d\\xb7\\x0b\\xc7\\x9d\\xfc\\x148v\\x96\\x12\\x82\\xd4,kr\\xff\\xa3}#\\xaa\\xd9v\\x1e\\x07\\x8e\\x0e5io{:\\x02\\x12\\xc8\\x11\\x0f\\xf3\\xb0j\\xc9\\xafjr\\xb0f\\xb8\\x81\\xb2\\xca\\xb1wv(\\xbck\\xfb\\x83\\x7fqp\\xbc7\\x86z\\x1ab&\\xb5x\\x8e\\x9a\\x19\\xb2\\xcc \\xbet\\x8a%2\\x93}%\\xaev\\xb0e\n\\xc7\\xc5\\x1a\\x1a\\x8b\\xb6*\\xd2\\x87\\xdf\\xff2n\\xd2p\\x85\\x19\\xfer\\xb5\\x16u\\x990z\\x0c\\xb9v\\x81\\xbb\\x94*\nk\\xf1e\\x98\\xa6y>\\xe1\n\\x17r\\xee\\x95f\\x16\\xf5c\\xaf\\x0c\\x90m\\x94\\x01\\xe1j\\xbc\\xc48[,c>1\r\\x9a\\xb34\\x91g\\x02a\\xa3\r)=\\xe3\\x1cez-\n\\xfe2a-@{mf\\xba\\xcc\\x01\\x88'\\xef\\xb0\\xc7]\\x11\\x80\\x04\\xc4\\x83\\xd9\\x8d\\xef\\xf9r\\xa4\\xfaq"
  873. },
  874. {
  875. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010u|)`\\x85i\\x16\\xb0\\x07\\x96\\xd1\\xc2<\\x13\\x1am\\xf5\\xc0\\xac!\\xd8\\x0e'a\\xa7v\\x99\\x06\\xf1(ss\\x8c\\xf6\\x86\\xa8\\xa7;\\xc2\\xd8\\xf8 \\xc9w_\\x8a\\xbdn\\xef\\x1a\na@\\xee\\x11\\x7f\\xfc\\xbe'\\xbf\\x8b\\xc5\\x026\\xb3;\\xa6\t0\\x00\\xe8\\xed\\x8c}h\\xb2\\xe2\\xceu\\xd2\\xe1\\xf5\\xdelv-\\xa1\\xbae\\x9d/\\xa6\\xc1\\xa3f\\xdaw\\xa9\\x00\\xb6\\xb0g\\xcd\\x13\\xcf\\xa8\\xe1\\x8bc\\xfdw\\xbc(\\xca\\xd8:*m\\xbb\\xc3\\xa5\\xa0z!&\\x19\\x7ft\\x07lq\\x82\\xb8\\x16\\xff\\xc7\\x80\\xb6\"s\\xb3{\\xf4\\xf9\\x84\\xeeo\\xe5t\\x05\\xcd\\xbb\\xd6\\x14\\xa4d\\x8d\\x07\\xa5\\x9c\\xfc\\x9c(\\xa2\\xb6'\\x07\\xce\\x9bm\\xee>\\x02c\\}\\xbd\\xeck\\xea\\x14\\x8a\\x10\\x83`\\x9a\\xb5\\xfb\\x1a\\xe7\\x8e/\\xcee\\x93\\x80\\x93\\xec\\x8d\\x84g\\xc1\\xa9`.\\x11(ng\\x16\\xe1\\xe2\\x13\\x99\\x8e\\xa5\\xbc\\x0b\\xc2/pz<\\xe6\\x1dx\\x7f\\x05\\x97\\x85\\xca\\xbc\\xb6es\\xb3\\xdf\\xa5/2\\x9c\\xf6\\xa0t\\xd0\\x80\\xd4\\x00\\x1f+$"
  876. },
  877. {
  878. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb2\\xe0\\xce\\x89t\\xedt<\\xe8\\xdfb\\xe48x.\\x1eho8\\xbe\\x05\\x968\\xe9\\xd1\\x98\\xa8\\x15\\x0f!4\\xac\\xe7uk\\x89-h\\x06\\xd4ed\\xf8\\xca;\\xec\\xe7!:'i\\xae\t\\xfb/\\xb0\\xb1\\xd2w\\xa7\\xd4\\xcf\\x82$\\xd1\\xab\\x80\\x03s9j\\xf7at\\x8b\\xf3\\x9e\\xa8k\\xea\\xef'\\x86\\x8b+\\xa8\\xe2\\xe1,\\xdd\\x15\\x81\\x15\\x0c\\xed\\xe7\\xda\\xdd$.\\x9f\\xbfg\\xe0\\x15\\xc09\\xc7\n\\x08\\x14\\x11<\\x08\\xc3\\xc0\\xe0\\xd7\\xc4\\x8el<q\\xcavz\\x0f\\xfe\\xcf]{d\\xad~;\\xc0\\xbd(\\x14\\x8cq\\xbb\\xa0\\xa2\\x8a*\\x12r\\xce\\xad\\xe9r0\\x12i\\xfc\\x88\\xc5\\xc1z\\xd1ld\\x165z\\xf6xg\\x1c\\x0f\\x8dk\\xfe!\\x03\\xe9p\\xb5\\x1e1\\x96\\xec-\\xe0\\xde\\xf4\\x00s\\x8e\\x93<t\\xe6;e\\xe4\\x83\\x9bx\\xd2'\\xb0\\x08\\xef\\xa7c\\\\xd2\\xcf\\xd4z\\x9f:\\xa9\\x18\\xd3\\xb8\\x92\\x1f\\xd6pypjie\\\\x98o\\xcc\\xd4?\\xd3\\x1cm`|\\x1b\\x02\\xa9c{\\x08\\xe6\\x01}xa_c"
  879. },
  880. {
  881. "http_request": "winword.exe_WSASend_get /pki/crl/products/miccodsigpca_08-31-2010.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 14 feb 2019 06:01:18 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  882. },
  883. {
  884. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsofttimestamppca.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 16 feb 2019 02:02:49 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  885. },
  886. {
  887. "http_request": "winword.exe_WSASend_\\xda\\x04\\x01\\x00\\x7f\\x01\\x00\\x00{\\x03\\x01]\\x0c\\x0en\\x87jr'`\\xd5\\xa0\\xe3 \\xf8\\xae\\xc0\\xf7\\x96\\xe5\\xcf\\xe3\\xa31;\\x9bsz\\x01q\\xd3\\xe6\\xa2\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00:\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00!\\x00\\x1f\\x00\\x00\\x1cactivation.sls.microsoft.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  888. },
  889. {
  890. "http_request": "winword.exe_WSASend_\\\\x00\\x01\\x01\\x06\\x10\\x00\\x01\\x02\\x01\\x00\\x10@epw\\xea%\\x97\\x95\\x9f\\xacg\\xfa\\x97\\xa2in\\x06\\xca\\xbd`\\xd1a\\x8a\\x1eq6\\x01\\xeco\\x07um+\\x11\\x8a\\xb93?\\xe7b\\xdcug\\x15{l\\xfc\\x93\\x04\\xec\\xb4<\\xea$s\\xa8\\x14\\xb0*f\\xd1\\xdf\\xfd(k$\\xd4:\\x97\\x1a\\xe4\\xbe\\xfb\\xf6\\xbf\\xd2\\xc7\\xdd\\x14j\\xfd\\x98$\\x85\t\\xb8e\\xc8\\xe2\\xaea\\x9e\\xb85e\\xb7\\xbe\\xb6\\x7f5\\x97\\xf3g\\xc3\n7\\xe7\\x18z\\x17\\x87\\xa9\\xc3\\xfc\\x91/i\\xd7u\\x1fm\\xaf\\xd1b\\x0e\\xeb\\xe0\\xb2t\\x1a\\xfa\\xd1\\xc5\\xf8_\\xd0\\xcb`h\\xc9\\x92_\\xb5\\xc8\\x03\\xb1\\xa1\\x0b\\xb5o\\xd9hl\\xb3\\x0f\\xfc\\x8av\\x8d\\x80\\x8d\\x00s\\xb9\\x19\\x8d\\\\xac\\xc9\\x89\\xa7e#\\xa7/\\xc3\\xa4m\\xb3\\x98\\x8ej\\x96?c\\xbep\\xb7\\xfa\\xbf\\xef\\x04\\x88\\x1d\\x01x\\xbc]k/\\x88g\\x92\\xf2\\xa1dt%\\x1bz\\x0fh\\xd3\\xc4\\xf6\\xe8\\x8bk\\xcc\\xa9\\x1b\\x98\"\\~\\xdcgi\\x9e\\x1c\\x16\\xd1\\x9ca\\x9a\\xff\\xab.t~\\xc4\\xdb\\x9by"
  891. },
  892. {
  893. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01`\\xf9\\xcb\\xe0\\x1e\\x9f\\x15z\\xcd\\xf8]\"\\xca\\xe5j\\xb9\\xeea\\xbac\\x94\\xcd\\xa2\\xd6\\x8d\\xf1\\xe6\\xe8\\x9d\\xa9r\\x17y\\xa0\\xa7\\xdcw\n\\x99b7\\xb4\\xef\\x90o!\\x07\\xa8\\xfc\\xa8\\x15^\\x0b\\x91\\xfd\\xe7\\xb8\\x14\\xd5!#8\\xee\\xe3\\x90\\x98\\xf1\\xc4\\xb19\\x1a\\x19\\xe5\\x81\\x9e\\x8e\\x94`\\x8c\\x988m\\x7f,?\\x12j\\x1d\\xfb\\xf4.\\x1f\\xd7\\xf0\\xd4\\xbb$8<d\\x88&\\x00\\x89\\xfc\\xcc{\\x8c\\x9c:\\xc9\\xdcup\\x9ff\\xaf\\xfcz0\r\\x01\\xe8\\xe0\\xdcl\\xd5\\xd0\\x11%\\xe2\\xdel\\xb5=\\x80a0'(\\x0c\\xf7\\xc0va\\xa3o\\x06\\x7f\\x83]\\xa91\\x08\\x9e\\xf7_\\xfb1\\x04+e\\x08\\xfdb\\xda\\xfd\\x8a\\x0f\\xfd\\x07\\x89f\\xa5\\x99\\xdc\\x01y\\x90y\\xf2\\xcb\\xe4\\xf3\\xa2\\xf8\\xed\\xd6\\xe8\\xf5\\x1b\\x19c\\xf0\\x18\\xc8\\xd7\\x10\\x92\\xbb\\xf5{\\xa5b\\xdaj?\\xd5\\xc4b/\\x95\\x1d@\\xd4q\\x96pi\\x96(\\xd9\\x95\\x02\\xe9\\x98\\x9a%[m\\x91|{\\xb7\\xf4\\xe3\\xb7\\xe3\\x13\\x86\\xe9\\xdaq\\xf4\\xe2\n\\xcdnz\\xc4\\xc5\\xd2"
  894. },
  895. {
  896. "http_request": "winword.exe_WSASend_\\x17\\x03\\x019p\\xf5\\xdd\\xaa\\xd9d(w\\xe2\\xc9\\x99\\xc5\\xc45ri\\xde!z\\xe0@\\x1c\\x1fp\\xacy\\xe1\\xa1m\\x02\\xc9o\\x92\\xbd\\xd7\\xdc\\xa9sc\\xa0\\xbbt\\xe5\\xb4\\x1f\\x17\\x99\\x95\\x0ez[\\xb4\\xb3w2\\xbf\\xa4\\x02#\\x16~\\x86\\x1d$\\x1e\\xc2\\x13\\7|\\x89\\x99os6l<\\xf9'\\xce\\x9f\\xb0i\\x81\\xf8\\x8f\\x11\" \\xf0\\xa1\\xaa4{0q/a\\xe3/qa1#\\x81\\x01q\\xfa2\\x1d\\xcchjz\\x9d\\x0b\\xa0q\\x140\\xf6\\x12sm\\xa6\n\t\\xd1\\x1c_\\xfbb5\\xc1\\xf0\\x0e\\xb44\\xdb\\x12\\xe8\\x02u\\xb5\\x14\\xf4\\x7f\\\\x92\\x12\\xe3g\\xb2\\xa43\\xb8\\xa4\\x90|)*/\\xc0\\xcb\\x1bivo\\x8d\\x15\\x81a\\xc2\\x02\\xff\\xb3\\xfa\\xd4cf\\xac\\x0b\\x17\\xff\\xab_t\\xd3\\x7f\\x9d&\\xcb\\xd6\\xc6\\xc2\\xf1\\xa0\\x10\\xaa\\x1a\\x8f\\xb8\\xac\\xb5\\xa5\\xd6]t_nj\\xe4=\\xa9\\x8e\\x17\\xda\\x07g\\x08\\xdb\\x953r;|\\xb0h\\xe3\\xc9\\x9f\\x17ge\\xf8\\x85.\\xfdk\\x80k\\xae\\xc9\\xa6\\x97\\xc2d=}\\xd1h\\xf8"
  897. },
  898. {
  899. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsofttimestamppca.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  900. }
  901. ]
  902. },
  903. {
  904. "Description": "Installs itself for autorun at Windows startup",
  905. "Details": [
  906. {
  907. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\AdvStart.ini"
  908. },
  909. {
  910. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ekpwaqch.exe"
  911. },
  912. {
  913. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ekpwaqch.exe"
  914. },
  915. {
  916. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\AdvStart.ini"
  917. }
  918. ]
  919. },
  920. {
  921. "Description": "Creates a hidden or system file",
  922. "Details": [
  923. {
  924. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm"
  925. },
  926. {
  927. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\~$e_certification_application.docx"
  928. }
  929. ]
  930. },
  931. {
  932. "Description": "File has been identified by 30 Antiviruses on VirusTotal as malicious",
  933. "Details": [
  934. {
  935. "MicroWorld-eScan": "Gen:Variant.Johnnie.180440"
  936. },
  937. {
  938. "FireEye": "Generic.mg.4caebe06a29f1392"
  939. },
  940. {
  941. "ALYac": "Gen:Variant.Johnnie.180440"
  942. },
  943. {
  944. "Cylance": "Unsafe"
  945. },
  946. {
  947. "BitDefender": "Gen:Variant.Johnnie.180440"
  948. },
  949. {
  950. "K7GW": "Spyware ( 0000d4291 )"
  951. },
  952. {
  953. "K7AntiVirus": "Spyware ( 0000d4291 )"
  954. },
  955. {
  956. "Arcabit": "Trojan.Johnnie.D2C0D8"
  957. },
  958. {
  959. "Invincea": "heuristic"
  960. },
  961. {
  962. "NANO-Antivirus": "Trojan.Win32.KeyLogger.frnflk"
  963. },
  964. {
  965. "ESET-NOD32": "a variant of Win32/Spy.KeyLogger.NJK"
  966. },
  967. {
  968. "Kaspersky": "Trojan.Win32.Agent.xaalqi"
  969. },
  970. {
  971. "Ad-Aware": "Gen:Variant.Johnnie.180440"
  972. },
  973. {
  974. "Emsisoft": "Gen:Variant.Johnnie.180440 (B)"
  975. },
  976. {
  977. "F-Secure": "Trojan.TR/Dropper.Gen"
  978. },
  979. {
  980. "DrWeb": "Trojan.Siggen8.33080"
  981. },
  982. {
  983. "SentinelOne": "DFI - Malicious PE"
  984. },
  985. {
  986. "Jiangmin": "Trojan.Agent.bzgw"
  987. },
  988. {
  989. "Fortinet": "W32/KeyLogger.NJK!tr"
  990. },
  991. {
  992. "Endgame": "malicious (high confidence)"
  993. },
  994. {
  995. "Microsoft": "Trojan:Win32/Fuerboos.D!cl"
  996. },
  997. {
  998. "ZoneAlarm": "Trojan.Win32.Agent.xaalqi"
  999. },
  1000. {
  1001. "MAX": "malware (ai score=87)"
  1002. },
  1003. {
  1004. "Malwarebytes": "Trojan.KeyLogger"
  1005. },
  1006. {
  1007. "Rising": "Spyware.KeyLogger!8.12F (TFE:dGZlOgTBgaqZtzOBwA)"
  1008. },
  1009. {
  1010. "eGambit": "Unsafe.AI_Score_64%"
  1011. },
  1012. {
  1013. "GData": "Gen:Variant.Johnnie.180440"
  1014. },
  1015. {
  1016. "AVG": "FileRepMalware"
  1017. },
  1018. {
  1019. "Avast": "FileRepMalware"
  1020. },
  1021. {
  1022. "CrowdStrike": "win/malicious_confidence_80% (D)"
  1023. }
  1024. ]
  1025. },
  1026. {
  1027. "Description": "Checks the presence of disk drives in the registry, possibly for anti-virtualization",
  1028. "Details": []
  1029. },
  1030. {
  1031. "Description": "Attempts to modify proxy settings",
  1032. "Details": []
  1033. },
  1034. {
  1035. "Description": "Creates a copy of itself",
  1036. "Details": [
  1037. {
  1038. "copy": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ekpwaqch.exe"
  1039. }
  1040. ]
  1041. },
  1042. {
  1043. "Description": "Harvests information related to installed mail clients",
  1044. "Details": [
  1045. {
  1046. "key": "HKEY_LOCAL_MACHINE\\Software\\Clients\\Mail"
  1047. },
  1048. {
  1049. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\Mail\\(Default)"
  1050. }
  1051. ]
  1052. },
  1053. {
  1054. "Description": "Attempts to modify Microsoft Office security settings",
  1055. "Details": []
  1056. },
  1057. {
  1058. "Description": "Anomalous binary characteristics",
  1059. "Details": [
  1060. {
  1061. "anomaly": "Actual checksum does not match that reported in PE header"
  1062. }
  1063. ]
  1064. }
  1065. ]
  1066.  
  1067. [*] Started Service: [
  1068. "osppsvc",
  1069. "WerSvc"
  1070. ]
  1071.  
  1072. [*] Executed Commands: [
  1073. "cmd.exe /c C:\\Users\\user\\AppData\\Local\\Temp\\dbe_certification_application.docx",
  1074. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ekpwaqch.exe",
  1075. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
  1076. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
  1077. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  1078. "C:\\Users\\user\\AppData\\Local\\Temp\\dbe_certification_application.docx",
  1079. "\"C:\\Program Files (x86)\\Microsoft Office\\Office15\\WINWORD.EXE\" /n \"C:\\Users\\user\\AppData\\Local\\Temp\\dbe_certification_application.docx\" /o \"u\"",
  1080. "C:\\Users\\user\\AppData\\Local\\Temp\\dbe_certification_application.docx ",
  1081. "\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"",
  1082. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup"
  1083. ]
  1084.  
  1085. [*] Mutexes: [
  1086. "Local\\WininetStartupMutex",
  1087. "Local\\_!MSFTHISTORY!_",
  1088. "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
  1089. "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
  1090. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
  1091. "Local\\WininetConnectionMutex",
  1092. "Local\\WininetProxyRegistryMutex",
  1093. "Local\\ZonesCounterMutex",
  1094. "Local\\ZoneAttributeCacheCounterMutex",
  1095. "Local\\ZonesCacheCounterMutex",
  1096. "Local\\ZonesLockedCacheCounterMutex",
  1097. "Local\\!IETld!Mutex",
  1098. "Local\\10MU_ACBPIDS_S-1-5-5-0-111722",
  1099. "Local\\10MU_ACB10_S-1-5-5-0-111722",
  1100. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  1101. "CicLoadWinStaWinSta0",
  1102. "Local\\{F99C425F-9135-43ed-BD7D-396DE488DC53}",
  1103. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  1104. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  1105. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  1106. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  1107. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  1108. "Global\\MsoShellExtRegAccess_S-1-5-21-0000000000-0000000000-0000000000-1000",
  1109. "Global\\ADAP_WMI_ENTRY",
  1110. "Global\\RefreshRA_Mutex",
  1111. "Global\\RefreshRA_Mutex_Lib",
  1112. "Global\\RefreshRA_Mutex_Flag"
  1113. ]
  1114.  
  1115. [*] Modified Files: [
  1116. "C:\\Users\\user\\AppData\\Local\\Temp\\dbe_certification_application.docx",
  1117. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  1118. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  1119. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
  1120. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\dnserrordiagoff_webOC[1]",
  1121. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\dnserrordiagoff_webOC[1]",
  1122. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ErrorPageTemplate[1]",
  1123. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ErrorPageTemplate[2]",
  1124. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\errorPageStrings[1]",
  1125. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\errorPageStrings[1]",
  1126. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\httpErrorPagesScripts[1]",
  1127. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\httpErrorPagesScripts[1]",
  1128. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\background_gradient[1]",
  1129. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\info_48[1]",
  1130. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\background_gradient[1]",
  1131. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\info_48[1]",
  1132. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\background_gradient[1]",
  1133. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\info_48[1]",
  1134. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\bullet[1]",
  1135. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\down[1]",
  1136. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\bullet[1]",
  1137. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\down[1]",
  1138. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ekpwaqch.exe",
  1139. "\\??\\PIPE\\samr",
  1140. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  1141. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  1142. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  1143. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  1144. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  1145. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  1146. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  1147. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  1148. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR3BBB.tmp.cvr",
  1149. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
  1150. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\~$Normal.dotm",
  1151. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{173F3EAD-BC47-40C6-A7AE-08F7582FA1F1}.tmp",
  1152. "C:\\Users\\user\\AppData\\Local\\Temp\\~$e_certification_application.docx",
  1153. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  1154. "C:\\Users\\user\\AppData\\Local\\Temp\\mso4457.tmp",
  1155. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{E0A789F7-14F4-49B8-8CAD-4358A83C4A3E}.tmp",
  1156. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{C7D125B3-7B06-46E2-A0ED-A77B97E02EF5}.tmp",
  1157. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{CCBB21B5-13B8-4AF8-B7E4-8B0515F546B1}.tmp",
  1158. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1159. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  1160. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  1161. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  1162. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  1163. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4D90.tmp",
  1164. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4D91.tmp",
  1165. "C:\\Users\\user\\AppData\\Local\\Temp\\cab55A0.tmp",
  1166. "C:\\Users\\user\\AppData\\Local\\Temp\\cab55FF.tmp",
  1167. "C:\\Users\\user\\AppData\\Local\\Temp\\cab562F.tmp",
  1168. "C:\\Users\\user\\AppData\\Local\\Temp\\cab566E.tmp",
  1169. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5680.tmp",
  1170. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5681.tmp",
  1171. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56C0.tmp",
  1172. "C:\\Users\\user\\AppData\\Local\\Temp\\cab567F.tmp",
  1173. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56D1.tmp",
  1174. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56E2.tmp",
  1175. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56F2.tmp",
  1176. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5703.tmp",
  1177. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5733.tmp",
  1178. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5764.tmp",
  1179. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5763.tmp",
  1180. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57A3.tmp",
  1181. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57D5.tmp",
  1182. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57A4.tmp",
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57A5.tmp",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\cab594D.tmp",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\cab596D.tmp",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\cab597E.tmp",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\cab59AE.tmp",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\cab59AF.tmp",
  1189. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  1190. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5B75.tmp",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BA5.tmp",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BB5.tmp",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BC6.tmp",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5C44.tmp",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5C64.tmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5C65.tmp",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5CA5.tmp",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5D32.tmp",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5D33.tmp",
  1201. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  1202. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\7396C420A8E1BC1DA97F1AF0D10BAD21",
  1203. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\F90F18257CBB4D84216AC1E1F3BB2C76",
  1204. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\F90F18257CBB4D84216AC1E1F3BB2C76",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5FD4.tmp",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6014.tmp\\architecture.glox",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6045.tmp\\InterconnectedBlockProcess.glox",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6044.tmp\\ThemePictureAccent.glox",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6014.tmp\\Content.inf",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6045.tmp\\Content.inf",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60A3.tmp\\Equations.dotx",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6044.tmp\\Content.inf",
  1213. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328884[[fn=architecture]].glox",
  1214. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328975[[fn=Theme Picture Accent]].glox",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60A3.tmp\\Content.inf",
  1216. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328925[[fn=Interconnected Block Process]].glox",
  1217. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM01840907[[fn=Equations]].dotx",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD623B.tmp\\RadialPictureList.glox",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD624C.tmp\\rings.glox",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD623C.tmp\\chevronaccent.glox",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD623B.tmp\\Content.inf",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629B.tmp\\harvardanglia2008officeonline.xsl",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629C.tmp\\TabbedArc.glox",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629E.tmp\\mlaseventheditionofficeonline.xsl",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62AF.tmp\\TabList.glox",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD631D.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629D.tmp\\HexagonRadial.glox",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD624C.tmp\\Content.inf",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD623C.tmp\\Content.inf",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD631E.tmp\\sist02.xsl",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629B.tmp\\Content.inf",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629C.tmp\\Content.inf",
  1233. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62AF.tmp\\Content.inf",
  1234. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328940[[fn=Radial Picture List]].glox",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629D.tmp\\Content.inf",
  1236. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD631D.tmp\\Content.inf",
  1237. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629E.tmp\\Content.inf",
  1238. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328998[[fn=Rings]].glox",
  1239. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328905[[fn=Chevron Accent]].glox",
  1240. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD631E.tmp\\Content.inf",
  1241. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328951[[fn=Tabbed Arc]].glox",
  1242. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851221[[fn=harvardanglia2008officeonline]].xsl",
  1243. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328919[[fn=Hexagon Radial]].glox",
  1244. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx",
  1245. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851225[[fn=mlaseventheditionofficeonline]].xsl",
  1246. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851227[[fn=sist02]].xsl",
  1247. "C:\\Users\\user\\AppData\\Local\\Temp\\cab660D.tmp",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\cab66FA.tmp",
  1249. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328972[[fn=Tab List]].glox",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\cab676B.tmp",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\cab67CA.tmp",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66CA.tmp\\iso690nmerical.xsl",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD670B.tmp\\ThemePictureGrid.glox",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD676A.tmp\\content.inf",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66FB.tmp\\VaryingWidthList.glox",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6879.tmp",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67DA.tmp\\content.inf",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD670B.tmp\\Content.inf",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD676A.tmp\\Wood_Type.thmx",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66CA.tmp\\Content.inf",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66FB.tmp\\Content.inf",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6868.tmp\\content.inf",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68D7.tmp\\content.inf",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67DA.tmp\\Metropolitan.thmx",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68D7.tmp\\Dividend.thmx",
  1266. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851224[[fn=iso690nmerical]].xsl",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6927.tmp\\content.inf",
  1268. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090434[[fn=Wood Type]].thmx",
  1269. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328986[[fn=Theme Picture Grid]].glox",
  1270. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328990[[fn=Varying Width List]].glox",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6868.tmp\\View.thmx",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6927.tmp\\Frame.thmx",
  1273. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457464[[fn=Dividend]].thmx",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6AEF.tmp",
  1275. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457491[[fn=Metropolitan]].thmx",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A50.tmp\\Element design set.dotx",
  1277. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457475[[fn=Frame]].thmx",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A71.tmp\\gosttitle.xsl",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B00.tmp\\CircleProcess.glox",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6AFF.tmp\\gb.xsl",
  1281. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457515[[fn=View]].thmx",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A50.tmp\\Content.inf",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A71.tmp\\Content.inf",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B00.tmp\\Content.inf",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6AFF.tmp\\Content.inf",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C2A.tmp\\Headlines.thmx",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C2B.tmp\\ieee2006officeonline.xsl",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C2B.tmp\\Content.inf",
  1289. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328908[[fn=Circle Process]].glox",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C2A.tmp\\Content.inf",
  1291. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851220[[fn=gosttitle]].xsl",
  1292. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998158[[fn=Element]].dotx",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6E30.tmp",
  1294. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851222[[fn=ieee2006officeonline]].xsl",
  1295. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001103[[fn=Headlines]].thmx",
  1296. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851218[[fn=gb]].xsl",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EAE.tmp\\Crop.thmx",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EAE.tmp\\Content.inf",
  1299. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001105[[fn=Crop]].thmx",
  1300. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6FC8.tmp",
  1301. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7027.tmp\\content.inf",
  1302. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7027.tmp\\Parallax.thmx",
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\cab70B4.tmp",
  1304. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457496[[fn=Parallax]].thmx",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\cab724D.tmp",
  1306. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD722C.tmp\\Badge.thmx",
  1307. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD722C.tmp\\Content.inf",
  1308. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001106[[fn=Badge]].thmx",
  1309. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD72FA.tmp\\content.inf",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD72FA.tmp\\Quotable.thmx",
  1311. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457503[[fn=Quotable]].thmx",
  1312. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7443.tmp",
  1313. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7453.tmp\\pictureorgchart.glox",
  1314. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7453.tmp\\Content.inf",
  1315. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74A2.tmp\\Berlin.thmx",
  1316. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328935[[fn=Picture Organization Chart]].glox",
  1317. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74A2.tmp\\content.inf",
  1318. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033917[[fn=Berlin]].thmx",
  1319. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD77C0.tmp\\APASixthEditionOfficeOnline.xsl",
  1320. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD77C0.tmp\\Content.inf",
  1321. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851216[[fn=apasixtheditionofficeonline]].xsl",
  1322. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7929.tmp",
  1323. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A72.tmp\\iso690.xsl",
  1324. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A73.tmp\\gostname.xsl",
  1325. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7B52.tmp",
  1326. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A94.tmp\\chicago.xsl",
  1327. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A73.tmp\\Content.inf",
  1328. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AC4.tmp\\turabian.xsl",
  1329. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A72.tmp\\Content.inf",
  1330. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A83.tmp\\Circuit.thmx",
  1331. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A94.tmp\\Content.inf",
  1332. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851219[[fn=gostname]].xsl",
  1333. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BEF.tmp\\content.inf",
  1334. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851223[[fn=iso690]].xsl",
  1335. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BFF.tmp\\ConvergingText.glox",
  1336. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BEF.tmp\\Savon.thmx",
  1337. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AC4.tmp\\Content.inf",
  1338. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851217[[fn=chicago]].xsl",
  1339. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A83.tmp\\content.inf",
  1340. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BFF.tmp\\Content.inf",
  1341. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D68.tmp\\PictureFrame.glox",
  1342. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457510[[fn=Savon]].thmx",
  1343. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7F3E.tmp",
  1344. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Bibliography Styles\\TM02851226[[fn=turabian]].xsl",
  1345. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328916[[fn=Converging Text]].glox",
  1346. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D68.tmp\\Content.inf",
  1347. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033919[[fn=Circuit]].thmx",
  1348. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7F4E.tmp\\Banded.thmx",
  1349. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328932[[fn=Picture Frame]].glox",
  1350. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8153.tmp\\content.inf",
  1351. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7F4E.tmp\\content.inf",
  1352. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8319.tmp\\BracketList.glox",
  1353. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8702.tmp",
  1354. "C:\\Users\\user\\AppData\\Local\\Temp\\cab87CE.tmp",
  1355. "C:\\Users\\user\\AppData\\Local\\Temp\\cab88D9.tmp",
  1356. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8153.tmp\\Droplet.thmx",
  1357. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03090430[[fn=Banded]].thmx",
  1358. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8319.tmp\\Content.inf",
  1359. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D9D.tmp",
  1360. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\ExcludeDictionaryEN0409.lex",
  1361. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F65.tmp",
  1362. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328893[[fn=BracketList]].glox",
  1363. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8DAE.tmp\\content.inf",
  1364. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033925[[fn=Droplet]].thmx",
  1365. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8D1F.tmp\\content.inf",
  1366. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab92E0.tmp",
  1367. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9311.tmp",
  1368. "C:\\Users\\user\\AppData\\Local\\Temp\\cab95A5.tmp",
  1369. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8DAE.tmp\\Damask.thmx",
  1370. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8D1F.tmp\\Slate.thmx",
  1371. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar92F1.tmp",
  1372. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD939F.tmp\\content.inf",
  1373. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab996F.tmp",
  1374. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD93FD.tmp\\content.inf",
  1375. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD94BA.tmp\\ThemePictureAlternatingAccent.glox",
  1376. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD939F.tmp\\Main_Event.thmx",
  1377. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9970.tmp",
  1378. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033929[[fn=Slate]].thmx",
  1379. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD93FD.tmp\\Mesh.thmx",
  1380. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD94BA.tmp\\Content.inf",
  1381. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033921[[fn=Damask]].thmx",
  1382. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9CCC.tmp",
  1383. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9CCD.tmp",
  1384. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033927[[fn=Main Event]].thmx",
  1385. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\SmartArt Graphics\\1033\\TM03328983[[fn=Theme Picture Alternating Accent]].glox",
  1386. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM03457485[[fn=Mesh]].thmx",
  1387. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9F11.tmp",
  1388. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9F12.tmp",
  1389. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9F9F.tmp\\content.inf",
  1390. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9F9F.tmp\\Vapor_Trail.thmx",
  1391. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA2DC.tmp\\Insight design set.dotx",
  1392. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3C8.tmp\\Feathered.thmx",
  1393. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM04033937[[fn=Vapor Trail]].thmx",
  1394. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA2DC.tmp\\Content.inf",
  1395. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3C8.tmp\\Content.inf",
  1396. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Word Document Building Blocks\\1033\\TM03998159[[fn=Insight]].dotx",
  1397. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\TM10001104[[fn=Feathered]].thmx",
  1398. "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
  1399. "C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat",
  1400. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\AdvStart.ini",
  1401. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\dnserrordiagoff_webOC[1]",
  1402. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\ErrorPageTemplate[1]",
  1403. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\errorPageStrings[1]",
  1404. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\httpErrorPagesScripts[2]",
  1405. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\httpErrorPagesScripts[1]",
  1406. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\bullet[2]",
  1407. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\background_gradient[2]",
  1408. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\down[1]",
  1409. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\info_48[2]",
  1410. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\down[2]",
  1411. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  1412. "\\??\\WMIDataDevice"
  1413. ]
  1414.  
  1415. [*] Deleted Files: [
  1416. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\dnserrordiagoff_webOC[1]",
  1417. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\dnserrordiagoff_webOC[1]",
  1418. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ErrorPageTemplate[1]",
  1419. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\ErrorPageTemplate[2]",
  1420. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\errorPageStrings[2]",
  1421. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\errorPageStrings[1]",
  1422. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\errorPageStrings[1]",
  1423. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\httpErrorPagesScripts[1]",
  1424. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\httpErrorPagesScripts[1]",
  1425. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\background_gradient[1]",
  1426. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\background_gradient[1]",
  1427. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\info_48[1]",
  1428. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\background_gradient[1]",
  1429. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\info_48[1]",
  1430. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\down[1]",
  1431. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\info_48[1]",
  1432. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\bullet[1]",
  1433. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\bullet[1]",
  1434. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\down[1]",
  1435. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\down[1]",
  1436. "C:\\Users\\user\\AppData\\Local\\Temp\\CVR3BBB.tmp",
  1437. "C:\\Users\\user\\AppData\\Local\\Temp\\mso4457.tmp",
  1438. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1439. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab4D90.tmp",
  1440. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar4D91.tmp",
  1441. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1442. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5D32.tmp",
  1443. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5D33.tmp",
  1444. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6014.tmp",
  1445. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6045.tmp",
  1446. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6044.tmp",
  1447. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60A3.tmp",
  1448. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6014.tmp\\architecture.glox",
  1449. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6044.tmp\\ThemePictureAccent.glox",
  1450. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5FD4.tmp",
  1451. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6045.tmp\\InterconnectedBlockProcess.glox",
  1452. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5763.tmp",
  1453. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD60A3.tmp\\Equations.dotx",
  1454. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56C0.tmp",
  1455. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD623B.tmp",
  1456. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM03457444[[fn=Basis]].eftx",
  1457. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD624C.tmp",
  1458. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD623C.tmp",
  1459. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56F2.tmp",
  1460. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629B.tmp",
  1461. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM03457444[[fn=Basis]].xml",
  1462. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629C.tmp",
  1463. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629E.tmp",
  1464. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD631D.tmp",
  1465. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629D.tmp",
  1466. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62AF.tmp",
  1467. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD631E.tmp",
  1468. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM03457444[[fn=Basis]].xml",
  1469. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD623B.tmp\\RadialPictureList.glox",
  1470. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD624C.tmp\\rings.glox",
  1471. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD623C.tmp\\chevronaccent.glox",
  1472. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629C.tmp\\TabbedArc.glox",
  1473. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629B.tmp\\harvardanglia2008officeonline.xsl",
  1474. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629D.tmp\\HexagonRadial.glox",
  1475. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD631D.tmp\\Text Sidebar (Annual Report Red and Black design).docx",
  1476. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD629E.tmp\\mlaseventheditionofficeonline.xsl",
  1477. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD631E.tmp\\sist02.xsl",
  1478. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5C64.tmp",
  1479. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD62AF.tmp\\TabList.glox",
  1480. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5B75.tmp",
  1481. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5733.tmp",
  1482. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56E2.tmp",
  1483. "C:\\Users\\user\\AppData\\Local\\Temp\\cab55A0.tmp",
  1484. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66CA.tmp",
  1485. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD670B.tmp",
  1486. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD676A.tmp",
  1487. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66FB.tmp",
  1488. "C:\\Users\\user\\AppData\\Local\\Temp\\cab566E.tmp",
  1489. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57A4.tmp",
  1490. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5764.tmp",
  1491. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57A3.tmp",
  1492. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67DA.tmp",
  1493. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57D5.tmp",
  1494. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6868.tmp",
  1495. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68D7.tmp",
  1496. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6927.tmp",
  1497. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66CA.tmp\\iso690nmerical.xsl",
  1498. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD676A.tmp\\Wood_Type.thmx",
  1499. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD670B.tmp\\ThemePictureGrid.glox",
  1500. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD66FB.tmp\\VaryingWidthList.glox",
  1501. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD68D7.tmp\\Dividend.thmx",
  1502. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD67DA.tmp\\Metropolitan.thmx",
  1503. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A50.tmp",
  1504. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6927.tmp\\Frame.thmx",
  1505. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A71.tmp",
  1506. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B00.tmp",
  1507. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6AFF.tmp",
  1508. "C:\\Users\\user\\AppData\\Local\\Temp\\cab567F.tmp",
  1509. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BA5.tmp",
  1510. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6868.tmp\\View.thmx",
  1511. "C:\\Users\\user\\AppData\\Local\\Temp\\cab66FA.tmp",
  1512. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5C65.tmp",
  1513. "C:\\Users\\user\\AppData\\Local\\Temp\\cab660D.tmp",
  1514. "C:\\Users\\user\\AppData\\Local\\Temp\\cab67CA.tmp",
  1515. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C2A.tmp",
  1516. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C2B.tmp",
  1517. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6879.tmp",
  1518. "C:\\Users\\user\\AppData\\Local\\Temp\\cab676B.tmp",
  1519. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6B00.tmp\\CircleProcess.glox",
  1520. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A71.tmp\\gosttitle.xsl",
  1521. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6A50.tmp\\Element design set.dotx",
  1522. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BC6.tmp",
  1523. "C:\\Users\\user\\AppData\\Local\\Temp\\cab562F.tmp",
  1524. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5681.tmp",
  1525. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C2B.tmp\\ieee2006officeonline.xsl",
  1526. "C:\\Users\\user\\AppData\\Local\\Temp\\cab594D.tmp",
  1527. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6C2A.tmp\\Headlines.thmx",
  1528. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6AFF.tmp\\gb.xsl",
  1529. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EAE.tmp",
  1530. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6AEF.tmp",
  1531. "C:\\Users\\user\\AppData\\Local\\Temp\\cab59AE.tmp",
  1532. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD6EAE.tmp\\Crop.thmx",
  1533. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6E30.tmp",
  1534. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7027.tmp",
  1535. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7027.tmp\\Parallax.thmx",
  1536. "C:\\Users\\user\\AppData\\Local\\Temp\\cab6FC8.tmp",
  1537. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD722C.tmp",
  1538. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD72FA.tmp",
  1539. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD722C.tmp\\Badge.thmx",
  1540. "C:\\Users\\user\\AppData\\Local\\Temp\\cab70B4.tmp",
  1541. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD72FA.tmp\\Quotable.thmx",
  1542. "C:\\Users\\user\\AppData\\Local\\Temp\\cab724D.tmp",
  1543. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7453.tmp",
  1544. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74A2.tmp",
  1545. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7453.tmp\\pictureorgchart.glox",
  1546. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5BB5.tmp",
  1547. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD74A2.tmp\\Berlin.thmx",
  1548. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7443.tmp",
  1549. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD77C0.tmp",
  1550. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD77C0.tmp\\APASixthEditionOfficeOnline.xsl",
  1551. "C:\\Users\\user\\AppData\\Local\\Temp\\cab59AF.tmp",
  1552. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A72.tmp",
  1553. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A73.tmp",
  1554. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A94.tmp",
  1555. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AC4.tmp",
  1556. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A83.tmp",
  1557. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A73.tmp\\gostname.xsl",
  1558. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BEF.tmp",
  1559. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A72.tmp\\iso690.xsl",
  1560. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BFF.tmp",
  1561. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A94.tmp\\chicago.xsl",
  1562. "C:\\Users\\user\\AppData\\Local\\Temp\\cab596D.tmp",
  1563. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D68.tmp",
  1564. "C:\\Users\\user\\AppData\\Local\\Temp\\cab597E.tmp",
  1565. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BEF.tmp\\Savon.thmx",
  1566. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7AC4.tmp\\turabian.xsl",
  1567. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7BFF.tmp\\ConvergingText.glox",
  1568. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7A83.tmp\\Circuit.thmx",
  1569. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7F4E.tmp",
  1570. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5680.tmp",
  1571. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7D68.tmp\\PictureFrame.glox",
  1572. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7B52.tmp",
  1573. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8153.tmp",
  1574. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8319.tmp",
  1575. "C:\\Users\\user\\AppData\\Local\\Temp\\cab57A5.tmp",
  1576. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5703.tmp",
  1577. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7929.tmp",
  1578. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD7F4E.tmp\\Banded.thmx",
  1579. "C:\\Users\\user\\AppData\\Local\\Temp\\cab55FF.tmp",
  1580. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8D1F.tmp",
  1581. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8319.tmp\\BracketList.glox",
  1582. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8DAE.tmp",
  1583. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8153.tmp\\Droplet.thmx",
  1584. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5C44.tmp",
  1585. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD939F.tmp",
  1586. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD93FD.tmp",
  1587. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD94BA.tmp",
  1588. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56D1.tmp",
  1589. "C:\\Users\\user\\AppData\\Local\\Temp\\cab7F3E.tmp",
  1590. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8D1F.tmp\\Slate.thmx",
  1591. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab92E0.tmp",
  1592. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD8DAE.tmp\\Damask.thmx",
  1593. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar92F1.tmp",
  1594. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8702.tmp",
  1595. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD939F.tmp\\Main_Event.thmx",
  1596. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab996F.tmp",
  1597. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD94BA.tmp\\ThemePictureAlternatingAccent.glox",
  1598. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD93FD.tmp\\Mesh.thmx",
  1599. "C:\\Users\\user\\AppData\\Local\\Temp\\cab87CE.tmp",
  1600. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9970.tmp",
  1601. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8D9D.tmp",
  1602. "C:\\Users\\user\\AppData\\Local\\Temp\\cab8F65.tmp",
  1603. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5CA5.tmp",
  1604. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9CCC.tmp",
  1605. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9F9F.tmp",
  1606. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab9F11.tmp",
  1607. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9CCD.tmp",
  1608. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar9F12.tmp",
  1609. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA2DC.tmp",
  1610. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3C8.tmp",
  1611. "C:\\Users\\user\\AppData\\Local\\Temp\\TCD9F9F.tmp\\Vapor_Trail.thmx",
  1612. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA2DC.tmp\\Insight design set.dotx",
  1613. "C:\\Users\\user\\AppData\\Local\\Temp\\TCDA3C8.tmp\\Feathered.thmx",
  1614. "C:\\Users\\user\\AppData\\Local\\Temp\\cab9311.tmp",
  1615. "C:\\Users\\user\\AppData\\Local\\Temp\\cab95A5.tmp",
  1616. "C:\\Users\\user\\AppData\\Local\\Temp\\cab88D9.tmp",
  1617. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\dnserrordiagoff_webOC[1]",
  1618. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\ErrorPageTemplate[1]",
  1619. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\errorPageStrings[1]",
  1620. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\httpErrorPagesScripts[2]",
  1621. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\httpErrorPagesScripts[1]",
  1622. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\background_gradient[2]",
  1623. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\bullet[2]",
  1624. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\down[2]"
  1625. ]
  1626.  
  1627. [*] Modified Registry Keys: [
  1628. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Local\\Temp\\namebro",
  1629. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Local\\Temp\\namebro\\namebro",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  1632. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\Exes_4caebe06a29f139244f1dbabce06db7a_RASAPI32",
  1633. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_4caebe06a29f139244f1dbabce06db7a_RASAPI32\\EnableFileTracing",
  1634. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_4caebe06a29f139244f1dbabce06db7a_RASAPI32\\EnableConsoleTracing",
  1635. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_4caebe06a29f139244f1dbabce06db7a_RASAPI32\\FileTracingMask",
  1636. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_4caebe06a29f139244f1dbabce06db7a_RASAPI32\\ConsoleTracingMask",
  1637. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_4caebe06a29f139244f1dbabce06db7a_RASAPI32\\MaxFileSize",
  1638. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\Exes_4caebe06a29f139244f1dbabce06db7a_RASAPI32\\FileDirectory",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings",
  1642. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Local\\Temp\\Text1",
  1643. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Local\\Temp\\Text1\\Text1",
  1644. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  1645. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  1646. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  1647. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  1648. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  1649. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  1650. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  1651. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  1652. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\WORDFiles",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\kz#",
  1655. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\ProductFiles",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LanguageResources\\EnabledLanguages\\1033",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\MTTT",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\:5%",
  1659. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\\\x7fg%",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1FBAA16",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\1FBAA16\\1FBAA16",
  1679. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1680. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1681. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1682. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1717. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1718. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1719. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1743. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1745. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1746. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1747. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1748. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1749. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1750. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1751. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1752. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1753. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1754. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1755. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1756. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1757. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1758. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1759. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1760. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1761. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1762. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1763. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1766. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1767. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1768. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1769. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1770. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1771. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1772. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1773. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1774. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1775. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1776. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1777. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1778. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1779. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1780. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1781. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1782. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1783. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1784. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1785. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1786. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1787. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1788. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1789. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1790. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1791. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1792. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1793. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1794. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1795. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1798. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1799. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1800. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1801. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1802. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1803. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1804. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1805. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1806. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1807. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1808. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1809. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1810. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1812. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1814. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1815. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1816. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1817. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1818. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1819. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1820. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1821. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1822. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1823. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1824. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1825. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1826. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1827. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1828. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1829. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1833. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1834. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1835. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1838. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1839. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1840. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1841. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1844. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1845. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1846. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1847. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1848. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1849. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1850. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1851. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1854. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1855. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1856. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1857. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1858. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1859. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1860. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1861. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1862. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1863. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1864. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1865. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1866. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1867. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1868. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1869. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1870. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1871. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1872. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1873. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1874. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1875. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1876. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1877. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1878. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1879. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1880. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1881. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1884. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1885. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1886. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1887. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1888. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1889. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1890. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1891. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1892. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1893. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1894. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1895. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1896. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1897. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1898. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1899. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1900. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1901. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1903. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1905. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1906. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1907. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1908. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1909. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1910. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1911. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1912. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1913. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1914. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1915. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1916. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1917. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1918. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1919. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1920. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1921. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1922. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1923. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1924. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1925. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1926. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1927. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1928. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1929. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1934. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1935. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1936. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1937. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1938. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1939. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1940. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1941. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1943. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1944. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1945. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1946. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1947. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1948. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1949. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1950. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1951. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1952. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1953. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1954. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1955. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1958. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1959. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1960. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1961. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1962. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1963. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1964. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1967. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1970. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1975. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1976. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1977. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1978. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1979. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1980. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1981. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1982. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1984. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Licensing\\09D07EFC505F4D9CBFD5ACE3217F6654",
  1985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\NextUpdate",
  1986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\LastUpdate",
  1987. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1990. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1994. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1995. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1996. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1998. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  2000. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  2001. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  2002. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  2003. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  2004. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  2005. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  2006. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  2007. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  2008. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  2009. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  2010. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  2011. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  2012. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  2013. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  2014. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  2015. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  2016. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  2017. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  2018. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  2019. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  2020. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  2021. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  2022. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  2023. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  2024. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  2025. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  2026. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  2027. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  2028. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  2029. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  2030. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  2031. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  2032. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  2033. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  2034. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  2035. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  2036. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  2037. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  2038. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  2039. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  2040. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  2041. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  2042. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  2043. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  2044. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  2045. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  2046. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  2047. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  2048. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  2049. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  2050. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  2051. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  2052. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  2053. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  2054. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  2055. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  2056. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  2057. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  2058. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  2059. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  2060. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  2061. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  2062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  2063. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  2064. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  2065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  2066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  2067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  2068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  2069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  2070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  2071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  2072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  2073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  2074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  2075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  2076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  2077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  2078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  2079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  2080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  2081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  2082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  2083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  2084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  2085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  2086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  2087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  2088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  2089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  2090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  2091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  2092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  2093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  2094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  2095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  2096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  2097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  2098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  2099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  2100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  2101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  2102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  2103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  2104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  2105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  2106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  2107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  2108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  2109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  2110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  2111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  2112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  2113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  2114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  2115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  2116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  2117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  2118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  2119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  2120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  2121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  2122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  2123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  2124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  2125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  2126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  2127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  2128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  2129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  2130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  2131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  2132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  2133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  2134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  2135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  2136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  2137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  2138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  2139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  2140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  2141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  2142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  2143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  2144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  2145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  2146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  2147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  2148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  2149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  2150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  2151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  2152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  2153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  2154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  2155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  2156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  2157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  2158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  2159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  2160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  2161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  2162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  2163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  2164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  2165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  2166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  2167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  2168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  2169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  2170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  2171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  2172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  2173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  2174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  2175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  2176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  2177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  2178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  2179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  2180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  2181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  2182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  2183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  2184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  2185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  2186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  2187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  2188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  2189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  2190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  2191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  2192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  2193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  2194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  2195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  2196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  2197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  2198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  2199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  2200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  2201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  2202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  2203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  2204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  2205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  2206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  2207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  2208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  2209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  2210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  2211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  2212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  2213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  2214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  2215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  2216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  2217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  2218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  2219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  2220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  2221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  2222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  2223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  2224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  2225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  2226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  2227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  2228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  2229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  2230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  2231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  2232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  2233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  2234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  2235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  2236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  2237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  2238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  2239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  2240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  2241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  2242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  2243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  2244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  2245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  2246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  2247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  2248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  2249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  2250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  2251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  2252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  2253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  2254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  2255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  2256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  2257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  2258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  2259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  2260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  2261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  2262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  2263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  2264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  2265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  2266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  2267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  2268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  2269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  2270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  2271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  2272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  2273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  2274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  2275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  2276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\NextUpdate",
  2277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\LastUpdate",
  2278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\NextUpdate",
  2279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\LastUpdate",
  2280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\NextUpdate",
  2281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\LastUpdate",
  2282. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  2283. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\ServiceSessionId",
  2284. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\Directory",
  2285. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\e1558f5d-68db-49e4-be44-11b21fe4c927",
  2286. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\e1558f5d-68db-49e4-be44-11b21fe4c927\\0",
  2287. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\e1558f5d-68db-49e4-be44-11b21fe4c927\\1",
  2288. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\e1558f5d-68db-49e4-be44-11b21fe4c927\\2",
  2289. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\e1558f5d-68db-49e4-be44-11b21fe4c927\\3",
  2290. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\e1558f5d-68db-49e4-be44-11b21fe4c927\\4",
  2291. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\e1558f5d-68db-49e4-be44-11b21fe4c927\\5",
  2292. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\e1558f5d-68db-49e4-be44-11b21fe4c927\\6",
  2293. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\e1558f5d-68db-49e4-be44-11b21fe4c927\\7",
  2294. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\e1558f5d-68db-49e4-be44-11b21fe4c927\\8",
  2295. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\cd6f536d-be31-499d-990f-9fda1f2193ed",
  2296. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\cd6f536d-be31-499d-990f-9fda1f2193ed\\0",
  2297. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\cd6f536d-be31-499d-990f-9fda1f2193ed\\1",
  2298. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\cd6f536d-be31-499d-990f-9fda1f2193ed\\2",
  2299. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\cd6f536d-be31-499d-990f-9fda1f2193ed\\3",
  2300. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\cd6f536d-be31-499d-990f-9fda1f2193ed\\4",
  2301. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\cd6f536d-be31-499d-990f-9fda1f2193ed\\5",
  2302. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\cd6f536d-be31-499d-990f-9fda1f2193ed\\6",
  2303. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\cd6f536d-be31-499d-990f-9fda1f2193ed\\7",
  2304. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\data\\cd6f536d-be31-499d-990f-9fda1f2193ed\\8",
  2305. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\namebro",
  2306. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\namebro\\namebro",
  2307. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\ekpwaqch_RASAPI32",
  2308. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\ekpwaqch_RASAPI32\\EnableFileTracing",
  2309. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\ekpwaqch_RASAPI32\\EnableConsoleTracing",
  2310. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\ekpwaqch_RASAPI32\\FileTracingMask",
  2311. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\ekpwaqch_RASAPI32\\ConsoleTracingMask",
  2312. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\ekpwaqch_RASAPI32\\MaxFileSize",
  2313. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\ekpwaqch_RASAPI32\\FileDirectory",
  2314. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\asdsww",
  2315. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\asdsww\\asdsww",
  2316. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\bweqwqe",
  2317. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\bweqwqe\\bweqwqe",
  2318. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cqweqwe",
  2319. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\cqweqwe\\cqweqwe",
  2320. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dqweqweqwe",
  2321. "HKEY_CURRENT_USER\\Software\\VB and VBA Program Settings\\C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\dqweqweqwe\\dqweqweqwe",
  2322. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-{05901221-D566-11d1-B2F0-00A0C9062910}",
  2323. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dll[MofResourceName]",
  2324. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.mui[MofResourceName]",
  2325. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sys[ACPIMOFResource]",
  2326. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.mui[ACPIMOFResource]",
  2327. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sys[MofResourceName]",
  2328. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.mui[MofResourceName]",
  2329. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sys[MofResource]",
  2330. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.mui[MofResource]",
  2331. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sys[HDAudioMofName]",
  2332. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.mui[HDAudioMofName]",
  2333. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sys[PROCESSORWMI]",
  2334. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.mui[PROCESSORWMI]",
  2335. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYS[PortclsMof]",
  2336. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.mui[PortclsMof]",
  2337. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
  2338. ]
  2339.  
  2340. [*] Deleted Registry Keys: [
  2341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  2342. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  2343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  2344. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  2345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
  2346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL",
  2347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\:5%",
  2348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\\\x7fg%",
  2349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\kz#",
  2350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  2351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  2352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  2353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  2354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  2355. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sys[MonitorWMI]"
  2356. ]
  2357.  
  2358. [*] DNS Communications: []
  2359.  
  2360. [*] Domains: []
  2361.  
  2362. [*] Network Communication - ICMP: []
  2363.  
  2364. [*] Network Communication - HTTP: [
  2365. {
  2366. "count": 1,
  2367. "body": "",
  2368. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2369. "user-agent": "Microsoft-CryptoAPI/6.1",
  2370. "method": "GET",
  2371. "host": "ocsp.digicert.com",
  2372. "version": "1.1",
  2373. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  2374. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nCache-Control: max-age = 89056\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Mar 2019 18:30:24 GMT\r\nIf-None-Match: \"5c9529c0-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2375. "port": 80
  2376. },
  2377. {
  2378. "count": 1,
  2379. "body": "",
  2380. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2381. "user-agent": "Microsoft-CryptoAPI/6.1",
  2382. "method": "GET",
  2383. "host": "ocsp.msocsp.com",
  2384. "version": "1.1",
  2385. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  2386. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  2387. "port": 80
  2388. },
  2389. {
  2390. "count": 2,
  2391. "body": "",
  2392. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2393. "user-agent": "Microsoft-CryptoAPI/6.1",
  2394. "method": "GET",
  2395. "host": "crl.microsoft.com",
  2396. "version": "1.1",
  2397. "path": "/pki/crl/products/microsoftrootcert.crl",
  2398. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2399. "port": 80
  2400. },
  2401. {
  2402. "count": 1,
  2403. "body": "",
  2404. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  2405. "user-agent": "Microsoft-CryptoAPI/6.1",
  2406. "method": "GET",
  2407. "host": "crl.microsoft.com",
  2408. "version": "1.1",
  2409. "path": "/pki/crl/products/microsoftrootcert.crl",
  2410. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2411. "port": 80
  2412. },
  2413. {
  2414. "count": 10,
  2415. "body": "",
  2416. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2417. "user-agent": "Microsoft-CryptoAPI/6.1",
  2418. "method": "GET",
  2419. "host": "crl.microsoft.com",
  2420. "version": "1.1",
  2421. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  2422. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2423. "port": 80
  2424. },
  2425. {
  2426. "count": 7,
  2427. "body": "",
  2428. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2429. "user-agent": "Microsoft-CryptoAPI/6.1",
  2430. "method": "GET",
  2431. "host": "crl.microsoft.com",
  2432. "version": "1.1",
  2433. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2434. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 16 Feb 2019 02:02:49 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2435. "port": 80
  2436. },
  2437. {
  2438. "count": 2,
  2439. "body": "",
  2440. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2441. "user-agent": "Microsoft-CryptoAPI/6.1",
  2442. "method": "GET",
  2443. "host": "crl.microsoft.com",
  2444. "version": "1.1",
  2445. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2446. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 03 May 2019 05:00:32 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2447. "port": 80
  2448. },
  2449. {
  2450. "count": 1,
  2451. "body": "",
  2452. "uri": "http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2453. "user-agent": "Microsoft-CryptoAPI/6.1",
  2454. "method": "GET",
  2455. "host": "crl.microsoft.com",
  2456. "version": "1.1",
  2457. "path": "/pki/crl/products/MicrosoftTimeStampPCA.crl",
  2458. "data": "GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  2459. "port": 80
  2460. },
  2461. {
  2462. "count": 1,
  2463. "body": "",
  2464. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  2465. "user-agent": "Microsoft-CryptoAPI/6.1",
  2466. "method": "GET",
  2467. "host": "ocsp.digicert.com",
  2468. "version": "1.1",
  2469. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D",
  2470. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D HTTP/1.1\r\nCache-Control: max-age = 128165\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 11:02:13 GMT\r\nIf-None-Match: \"5c961235-1d7\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2471. "port": 80
  2472. },
  2473. {
  2474. "count": 1,
  2475. "body": "",
  2476. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2477. "user-agent": "Microsoft-CryptoAPI/6.1",
  2478. "method": "GET",
  2479. "host": "ocsp.digicert.com",
  2480. "version": "1.1",
  2481. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D",
  2482. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEA%2BdzSc7B3UzA8k03selSwo%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  2483. "port": 80
  2484. }
  2485. ]
  2486.  
  2487. [*] Network Communication - SMTP: []
  2488.  
  2489. [*] Network Communication - Hosts: []
  2490.  
  2491. [*] Network Communication - IRC: []
  2492.  
  2493. [*] Static Analysis: {
  2494. "pe": {
  2495. "peid_signatures": null,
  2496. "imports": [
  2497. {
  2498. "imports": [
  2499. {
  2500. "name": "__vbaVarTstGt",
  2501. "address": "0x401000"
  2502. },
  2503. {
  2504. "name": "__vbaVarSub",
  2505. "address": "0x401004"
  2506. },
  2507. {
  2508. "name": "__vbaStrI2",
  2509. "address": "0x401008"
  2510. },
  2511. {
  2512. "name": null,
  2513. "address": "0x40100c"
  2514. },
  2515. {
  2516. "name": "_CIcos",
  2517. "address": "0x401010"
  2518. },
  2519. {
  2520. "name": "_adj_fptan",
  2521. "address": "0x401014"
  2522. },
  2523. {
  2524. "name": "__vbaStrI4",
  2525. "address": "0x401018"
  2526. },
  2527. {
  2528. "name": "__vbaHresultCheck",
  2529. "address": "0x40101c"
  2530. },
  2531. {
  2532. "name": "__vbaVarMove",
  2533. "address": "0x401020"
  2534. },
  2535. {
  2536. "name": "__vbaVarVargNofree",
  2537. "address": "0x401024"
  2538. },
  2539. {
  2540. "name": "__vbaAryMove",
  2541. "address": "0x401028"
  2542. },
  2543. {
  2544. "name": "__vbaFreeVar",
  2545. "address": "0x40102c"
  2546. },
  2547. {
  2548. "name": "__vbaLateIdCall",
  2549. "address": "0x401030"
  2550. },
  2551. {
  2552. "name": "__vbaStrVarMove",
  2553. "address": "0x401034"
  2554. },
  2555. {
  2556. "name": "__vbaLenBstr",
  2557. "address": "0x401038"
  2558. },
  2559. {
  2560. "name": null,
  2561. "address": "0x40103c"
  2562. },
  2563. {
  2564. "name": "__vbaPut3",
  2565. "address": "0x401040"
  2566. },
  2567. {
  2568. "name": "__vbaEnd",
  2569. "address": "0x401044"
  2570. },
  2571. {
  2572. "name": "__vbaFreeVarList",
  2573. "address": "0x401048"
  2574. },
  2575. {
  2576. "name": "_adj_fdiv_m64",
  2577. "address": "0x40104c"
  2578. },
  2579. {
  2580. "name": null,
  2581. "address": "0x401050"
  2582. },
  2583. {
  2584. "name": "__vbaNextEachVar",
  2585. "address": "0x401054"
  2586. },
  2587. {
  2588. "name": "__vbaFreeObjList",
  2589. "address": "0x401058"
  2590. },
  2591. {
  2592. "name": null,
  2593. "address": "0x40105c"
  2594. },
  2595. {
  2596. "name": "__vbaVarIndexLoadRef",
  2597. "address": "0x401060"
  2598. },
  2599. {
  2600. "name": "__vbaStrErrVarCopy",
  2601. "address": "0x401064"
  2602. },
  2603. {
  2604. "name": "_adj_fprem1",
  2605. "address": "0x401068"
  2606. },
  2607. {
  2608. "name": null,
  2609. "address": "0x40106c"
  2610. },
  2611. {
  2612. "name": "__vbaRecAnsiToUni",
  2613. "address": "0x401070"
  2614. },
  2615. {
  2616. "name": null,
  2617. "address": "0x401074"
  2618. },
  2619. {
  2620. "name": null,
  2621. "address": "0x401078"
  2622. },
  2623. {
  2624. "name": "__vbaForEachCollAd",
  2625. "address": "0x40107c"
  2626. },
  2627. {
  2628. "name": "__vbaVarCmpNe",
  2629. "address": "0x401080"
  2630. },
  2631. {
  2632. "name": "__vbaStrCat",
  2633. "address": "0x401084"
  2634. },
  2635. {
  2636. "name": "__vbaLsetFixstr",
  2637. "address": "0x401088"
  2638. },
  2639. {
  2640. "name": "__vbaSetSystemError",
  2641. "address": "0x40108c"
  2642. },
  2643. {
  2644. "name": "__vbaLenBstrB",
  2645. "address": "0x401090"
  2646. },
  2647. {
  2648. "name": "__vbaHresultCheckObj",
  2649. "address": "0x401094"
  2650. },
  2651. {
  2652. "name": "__vbaLenVar",
  2653. "address": "0x401098"
  2654. },
  2655. {
  2656. "name": "_adj_fdiv_m32",
  2657. "address": "0x40109c"
  2658. },
  2659. {
  2660. "name": null,
  2661. "address": "0x4010a0"
  2662. },
  2663. {
  2664. "name": "__vbaAryVar",
  2665. "address": "0x4010a4"
  2666. },
  2667. {
  2668. "name": null,
  2669. "address": "0x4010a8"
  2670. },
  2671. {
  2672. "name": "__vbaAryDestruct",
  2673. "address": "0x4010ac"
  2674. },
  2675. {
  2676. "name": null,
  2677. "address": "0x4010b0"
  2678. },
  2679. {
  2680. "name": "__vbaVarIndexLoadRefLock",
  2681. "address": "0x4010b4"
  2682. },
  2683. {
  2684. "name": null,
  2685. "address": "0x4010b8"
  2686. },
  2687. {
  2688. "name": "__vbaVarForInit",
  2689. "address": "0x4010bc"
  2690. },
  2691. {
  2692. "name": "__vbaExitProc",
  2693. "address": "0x4010c0"
  2694. },
  2695. {
  2696. "name": null,
  2697. "address": "0x4010c4"
  2698. },
  2699. {
  2700. "name": "__vbaStrLike",
  2701. "address": "0x4010c8"
  2702. },
  2703. {
  2704. "name": null,
  2705. "address": "0x4010cc"
  2706. },
  2707. {
  2708. "name": "__vbaObjSet",
  2709. "address": "0x4010d0"
  2710. },
  2711. {
  2712. "name": "__vbaOnError",
  2713. "address": "0x4010d4"
  2714. },
  2715. {
  2716. "name": null,
  2717. "address": "0x4010d8"
  2718. },
  2719. {
  2720. "name": "_adj_fdiv_m16i",
  2721. "address": "0x4010dc"
  2722. },
  2723. {
  2724. "name": "__vbaObjSetAddref",
  2725. "address": "0x4010e0"
  2726. },
  2727. {
  2728. "name": "_adj_fdivr_m16i",
  2729. "address": "0x4010e4"
  2730. },
  2731. {
  2732. "name": "__vbaVarIndexLoad",
  2733. "address": "0x4010e8"
  2734. },
  2735. {
  2736. "name": null,
  2737. "address": "0x4010ec"
  2738. },
  2739. {
  2740. "name": "__vbaForEachCollVar",
  2741. "address": "0x4010f0"
  2742. },
  2743. {
  2744. "name": "__vbaStrFixstr",
  2745. "address": "0x4010f4"
  2746. },
  2747. {
  2748. "name": null,
  2749. "address": "0x4010f8"
  2750. },
  2751. {
  2752. "name": "__vbaRefVarAry",
  2753. "address": "0x4010fc"
  2754. },
  2755. {
  2756. "name": "__vbaFpR8",
  2757. "address": "0x401100"
  2758. },
  2759. {
  2760. "name": "__vbaBoolVarNull",
  2761. "address": "0x401104"
  2762. },
  2763. {
  2764. "name": "_CIsin",
  2765. "address": "0x401108"
  2766. },
  2767. {
  2768. "name": "__vbaErase",
  2769. "address": "0x40110c"
  2770. },
  2771. {
  2772. "name": null,
  2773. "address": "0x401110"
  2774. },
  2775. {
  2776. "name": "__vbaVarCmpGt",
  2777. "address": "0x401114"
  2778. },
  2779. {
  2780. "name": "__vbaVargVarMove",
  2781. "address": "0x401118"
  2782. },
  2783. {
  2784. "name": null,
  2785. "address": "0x40111c"
  2786. },
  2787. {
  2788. "name": null,
  2789. "address": "0x401120"
  2790. },
  2791. {
  2792. "name": "__vbaChkstk",
  2793. "address": "0x401124"
  2794. },
  2795. {
  2796. "name": null,
  2797. "address": "0x401128"
  2798. },
  2799. {
  2800. "name": "__vbaFileClose",
  2801. "address": "0x40112c"
  2802. },
  2803. {
  2804. "name": "EVENT_SINK_AddRef",
  2805. "address": "0x401130"
  2806. },
  2807. {
  2808. "name": null,
  2809. "address": "0x401134"
  2810. },
  2811. {
  2812. "name": "__vbaGenerateBoundsError",
  2813. "address": "0x401138"
  2814. },
  2815. {
  2816. "name": "__vbaGet3",
  2817. "address": "0x40113c"
  2818. },
  2819. {
  2820. "name": null,
  2821. "address": "0x401140"
  2822. },
  2823. {
  2824. "name": "__vbaStrCmp",
  2825. "address": "0x401144"
  2826. },
  2827. {
  2828. "name": "__vbaAryConstruct2",
  2829. "address": "0x401148"
  2830. },
  2831. {
  2832. "name": "__vbaVarTstEq",
  2833. "address": "0x40114c"
  2834. },
  2835. {
  2836. "name": "__vbaPutOwner4",
  2837. "address": "0x401150"
  2838. },
  2839. {
  2840. "name": "__vbaNextEachCollVar",
  2841. "address": "0x401154"
  2842. },
  2843. {
  2844. "name": null,
  2845. "address": "0x401158"
  2846. },
  2847. {
  2848. "name": "__vbaPrintObj",
  2849. "address": "0x40115c"
  2850. },
  2851. {
  2852. "name": "__vbaI2I4",
  2853. "address": "0x401160"
  2854. },
  2855. {
  2856. "name": "__vbaObjVar",
  2857. "address": "0x401164"
  2858. },
  2859. {
  2860. "name": "DllFunctionCall",
  2861. "address": "0x401168"
  2862. },
  2863. {
  2864. "name": null,
  2865. "address": "0x40116c"
  2866. },
  2867. {
  2868. "name": "__vbaVarOr",
  2869. "address": "0x401170"
  2870. },
  2871. {
  2872. "name": null,
  2873. "address": "0x401174"
  2874. },
  2875. {
  2876. "name": "__vbaVarLateMemSt",
  2877. "address": "0x401178"
  2878. },
  2879. {
  2880. "name": null,
  2881. "address": "0x40117c"
  2882. },
  2883. {
  2884. "name": "__vbaLbound",
  2885. "address": "0x401180"
  2886. },
  2887. {
  2888. "name": "_adj_fpatan",
  2889. "address": "0x401184"
  2890. },
  2891. {
  2892. "name": "__vbaR4Var",
  2893. "address": "0x401188"
  2894. },
  2895. {
  2896. "name": "__vbaFixstrConstruct",
  2897. "address": "0x40118c"
  2898. },
  2899. {
  2900. "name": "__vbaLateIdCallLd",
  2901. "address": "0x401190"
  2902. },
  2903. {
  2904. "name": "__vbaR8Cy",
  2905. "address": "0x401194"
  2906. },
  2907. {
  2908. "name": "__vbaRedim",
  2909. "address": "0x401198"
  2910. },
  2911. {
  2912. "name": "__vbaStrR8",
  2913. "address": "0x40119c"
  2914. },
  2915. {
  2916. "name": "__vbaRecUniToAnsi",
  2917. "address": "0x4011a0"
  2918. },
  2919. {
  2920. "name": "EVENT_SINK_Release",
  2921. "address": "0x4011a4"
  2922. },
  2923. {
  2924. "name": "__vbaNew",
  2925. "address": "0x4011a8"
  2926. },
  2927. {
  2928. "name": null,
  2929. "address": "0x4011ac"
  2930. },
  2931. {
  2932. "name": null,
  2933. "address": "0x4011b0"
  2934. },
  2935. {
  2936. "name": "__vbaUI1I2",
  2937. "address": "0x4011b4"
  2938. },
  2939. {
  2940. "name": "_CIsqrt",
  2941. "address": "0x4011b8"
  2942. },
  2943. {
  2944. "name": "__vbaObjIs",
  2945. "address": "0x4011bc"
  2946. },
  2947. {
  2948. "name": "__vbaVarAnd",
  2949. "address": "0x4011c0"
  2950. },
  2951. {
  2952. "name": "EVENT_SINK_QueryInterface",
  2953. "address": "0x4011c4"
  2954. },
  2955. {
  2956. "name": "__vbaStr2Vec",
  2957. "address": "0x4011c8"
  2958. },
  2959. {
  2960. "name": "__vbaUI1I4",
  2961. "address": "0x4011cc"
  2962. },
  2963. {
  2964. "name": "__vbaExceptHandler",
  2965. "address": "0x4011d0"
  2966. },
  2967. {
  2968. "name": null,
  2969. "address": "0x4011d4"
  2970. },
  2971. {
  2972. "name": null,
  2973. "address": "0x4011d8"
  2974. },
  2975. {
  2976. "name": "__vbaPrintFile",
  2977. "address": "0x4011dc"
  2978. },
  2979. {
  2980. "name": "__vbaStrToUnicode",
  2981. "address": "0x4011e0"
  2982. },
  2983. {
  2984. "name": null,
  2985. "address": "0x4011e4"
  2986. },
  2987. {
  2988. "name": "_adj_fprem",
  2989. "address": "0x4011e8"
  2990. },
  2991. {
  2992. "name": "_adj_fdivr_m64",
  2993. "address": "0x4011ec"
  2994. },
  2995. {
  2996. "name": null,
  2997. "address": "0x4011f0"
  2998. },
  2999. {
  3000. "name": null,
  3001. "address": "0x4011f4"
  3002. },
  3003. {
  3004. "name": null,
  3005. "address": "0x4011f8"
  3006. },
  3007. {
  3008. "name": null,
  3009. "address": "0x4011fc"
  3010. },
  3011. {
  3012. "name": "__vbaFPException",
  3013. "address": "0x401200"
  3014. },
  3015. {
  3016. "name": "__vbaInStrVar",
  3017. "address": "0x401204"
  3018. },
  3019. {
  3020. "name": null,
  3021. "address": "0x401208"
  3022. },
  3023. {
  3024. "name": "__vbaUbound",
  3025. "address": "0x40120c"
  3026. },
  3027. {
  3028. "name": "__vbaStrVarVal",
  3029. "address": "0x401210"
  3030. },
  3031. {
  3032. "name": "__vbaVarCat",
  3033. "address": "0x401214"
  3034. },
  3035. {
  3036. "name": null,
  3037. "address": "0x401218"
  3038. },
  3039. {
  3040. "name": "__vbaI2Var",
  3041. "address": "0x40121c"
  3042. },
  3043. {
  3044. "name": null,
  3045. "address": "0x401220"
  3046. },
  3047. {
  3048. "name": null,
  3049. "address": "0x401224"
  3050. },
  3051. {
  3052. "name": null,
  3053. "address": "0x401228"
  3054. },
  3055. {
  3056. "name": "_CIlog",
  3057. "address": "0x40122c"
  3058. },
  3059. {
  3060. "name": "__vbaErrorOverflow",
  3061. "address": "0x401230"
  3062. },
  3063. {
  3064. "name": "__vbaFileOpen",
  3065. "address": "0x401234"
  3066. },
  3067. {
  3068. "name": "__vbaVarLateMemCallLdRf",
  3069. "address": "0x401238"
  3070. },
  3071. {
  3072. "name": "__vbaVar2Vec",
  3073. "address": "0x40123c"
  3074. },
  3075. {
  3076. "name": "__vbaInStr",
  3077. "address": "0x401240"
  3078. },
  3079. {
  3080. "name": null,
  3081. "address": "0x401244"
  3082. },
  3083. {
  3084. "name": null,
  3085. "address": "0x401248"
  3086. },
  3087. {
  3088. "name": "__vbaR8Str",
  3089. "address": "0x40124c"
  3090. },
  3091. {
  3092. "name": "__vbaNew2",
  3093. "address": "0x401250"
  3094. },
  3095. {
  3096. "name": "_adj_fdiv_m32i",
  3097. "address": "0x401254"
  3098. },
  3099. {
  3100. "name": "_adj_fdivr_m32i",
  3101. "address": "0x401258"
  3102. },
  3103. {
  3104. "name": "__vbaVarSetObj",
  3105. "address": "0x40125c"
  3106. },
  3107. {
  3108. "name": null,
  3109. "address": "0x401260"
  3110. },
  3111. {
  3112. "name": "__vbaStrCopy",
  3113. "address": "0x401264"
  3114. },
  3115. {
  3116. "name": "__vbaI4Str",
  3117. "address": "0x401268"
  3118. },
  3119. {
  3120. "name": null,
  3121. "address": "0x40126c"
  3122. },
  3123. {
  3124. "name": "__vbaVarCmpLt",
  3125. "address": "0x401270"
  3126. },
  3127. {
  3128. "name": "__vbaFreeStrList",
  3129. "address": "0x401274"
  3130. },
  3131. {
  3132. "name": null,
  3133. "address": "0x401278"
  3134. },
  3135. {
  3136. "name": "_adj_fdivr_m32",
  3137. "address": "0x40127c"
  3138. },
  3139. {
  3140. "name": "__vbaPowerR8",
  3141. "address": "0x401280"
  3142. },
  3143. {
  3144. "name": "_adj_fdiv_r",
  3145. "address": "0x401284"
  3146. },
  3147. {
  3148. "name": null,
  3149. "address": "0x401288"
  3150. },
  3151. {
  3152. "name": null,
  3153. "address": "0x40128c"
  3154. },
  3155. {
  3156. "name": "__vbaVarTstNe",
  3157. "address": "0x401290"
  3158. },
  3159. {
  3160. "name": "__vbaVarSetVar",
  3161. "address": "0x401294"
  3162. },
  3163. {
  3164. "name": "__vbaI4Var",
  3165. "address": "0x401298"
  3166. },
  3167. {
  3168. "name": null,
  3169. "address": "0x40129c"
  3170. },
  3171. {
  3172. "name": "__vbaVarCmpEq",
  3173. "address": "0x4012a0"
  3174. },
  3175. {
  3176. "name": "__vbaFpCy",
  3177. "address": "0x4012a4"
  3178. },
  3179. {
  3180. "name": "__vbaAryLock",
  3181. "address": "0x4012a8"
  3182. },
  3183. {
  3184. "name": "__vbaVarAdd",
  3185. "address": "0x4012ac"
  3186. },
  3187. {
  3188. "name": "__vbaLateMemCall",
  3189. "address": "0x4012b0"
  3190. },
  3191. {
  3192. "name": null,
  3193. "address": "0x4012b4"
  3194. },
  3195. {
  3196. "name": "__vbaStrComp",
  3197. "address": "0x4012b8"
  3198. },
  3199. {
  3200. "name": "__vbaVarDup",
  3201. "address": "0x4012bc"
  3202. },
  3203. {
  3204. "name": "__vbaStrToAnsi",
  3205. "address": "0x4012c0"
  3206. },
  3207. {
  3208. "name": null,
  3209. "address": "0x4012c4"
  3210. },
  3211. {
  3212. "name": "__vbaVarLateMemCallLd",
  3213. "address": "0x4012c8"
  3214. },
  3215. {
  3216. "name": "__vbaFpI4",
  3217. "address": "0x4012cc"
  3218. },
  3219. {
  3220. "name": null,
  3221. "address": "0x4012d0"
  3222. },
  3223. {
  3224. "name": "__vbaLateMemCallLd",
  3225. "address": "0x4012d4"
  3226. },
  3227. {
  3228. "name": "_CIatan",
  3229. "address": "0x4012d8"
  3230. },
  3231. {
  3232. "name": null,
  3233. "address": "0x4012dc"
  3234. },
  3235. {
  3236. "name": "__vbaAryCopy",
  3237. "address": "0x4012e0"
  3238. },
  3239. {
  3240. "name": "__vbaCastObj",
  3241. "address": "0x4012e4"
  3242. },
  3243. {
  3244. "name": "__vbaStrMove",
  3245. "address": "0x4012e8"
  3246. },
  3247. {
  3248. "name": "__vbaForEachVar",
  3249. "address": "0x4012ec"
  3250. },
  3251. {
  3252. "name": null,
  3253. "address": "0x4012f0"
  3254. },
  3255. {
  3256. "name": "__vbaStrVarCopy",
  3257. "address": "0x4012f4"
  3258. },
  3259. {
  3260. "name": "__vbaR8IntI4",
  3261. "address": "0x4012f8"
  3262. },
  3263. {
  3264. "name": "_allmul",
  3265. "address": "0x4012fc"
  3266. },
  3267. {
  3268. "name": "_CItan",
  3269. "address": "0x401300"
  3270. },
  3271. {
  3272. "name": "__vbaNextEachCollAd",
  3273. "address": "0x401304"
  3274. },
  3275. {
  3276. "name": "__vbaAryUnlock",
  3277. "address": "0x401308"
  3278. },
  3279. {
  3280. "name": "__vbaUI1Var",
  3281. "address": "0x40130c"
  3282. },
  3283. {
  3284. "name": "__vbaVarForNext",
  3285. "address": "0x401310"
  3286. },
  3287. {
  3288. "name": "_CIexp",
  3289. "address": "0x401314"
  3290. },
  3291. {
  3292. "name": "__vbaFreeObj",
  3293. "address": "0x401318"
  3294. },
  3295. {
  3296. "name": "__vbaFreeStr",
  3297. "address": "0x40131c"
  3298. },
  3299. {
  3300. "name": null,
  3301. "address": "0x401320"
  3302. }
  3303. ],
  3304. "dll": "MSVBVM60.DLL"
  3305. }
  3306. ],
  3307. "digital_signers": null,
  3308. "exported_dll_name": null,
  3309. "actual_checksum": "0x00117f3c",
  3310. "overlay": null,
  3311. "imagebase": "0x00400000",
  3312. "reported_checksum": "0x000dcb33",
  3313. "icon_hash": null,
  3314. "entrypoint": "0x00403a58",
  3315. "timestamp": "2019-06-18 07:13:09",
  3316. "osversion": "4.0",
  3317. "sections": [
  3318. {
  3319. "name": ".text",
  3320. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  3321. "virtual_address": "0x00001000",
  3322. "size_of_data": "0x0008a000",
  3323. "entropy": "5.27",
  3324. "raw_address": "0x00001000",
  3325. "virtual_size": "0x00089844",
  3326. "characteristics_raw": "0x60000020"
  3327. },
  3328. {
  3329. "name": ".data",
  3330. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  3331. "virtual_address": "0x0008b000",
  3332. "size_of_data": "0x00001000",
  3333. "entropy": "0.00",
  3334. "raw_address": "0x0008b000",
  3335. "virtual_size": "0x00005174",
  3336. "characteristics_raw": "0xc0000040"
  3337. },
  3338. {
  3339. "name": ".rsrc",
  3340. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  3341. "virtual_address": "0x00091000",
  3342. "size_of_data": "0x00081000",
  3343. "entropy": "7.98",
  3344. "raw_address": "0x0008c000",
  3345. "virtual_size": "0x00080f18",
  3346. "characteristics_raw": "0x40000040"
  3347. }
  3348. ],
  3349. "resources": [],
  3350. "dirents": [
  3351. {
  3352. "virtual_address": "0x00000000",
  3353. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  3354. "size": "0x00000000"
  3355. },
  3356. {
  3357. "virtual_address": "0x00089b44",
  3358. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  3359. "size": "0x00000028"
  3360. },
  3361. {
  3362. "virtual_address": "0x00091000",
  3363. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  3364. "size": "0x00080f18"
  3365. },
  3366. {
  3367. "virtual_address": "0x00000000",
  3368. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  3369. "size": "0x00000000"
  3370. },
  3371. {
  3372. "virtual_address": "0x00000000",
  3373. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  3374. "size": "0x00000000"
  3375. },
  3376. {
  3377. "virtual_address": "0x00000000",
  3378. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  3379. "size": "0x00000000"
  3380. },
  3381. {
  3382. "virtual_address": "0x00000000",
  3383. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  3384. "size": "0x00000000"
  3385. },
  3386. {
  3387. "virtual_address": "0x00000000",
  3388. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  3389. "size": "0x00000000"
  3390. },
  3391. {
  3392. "virtual_address": "0x00000000",
  3393. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  3394. "size": "0x00000000"
  3395. },
  3396. {
  3397. "virtual_address": "0x00000000",
  3398. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  3399. "size": "0x00000000"
  3400. },
  3401. {
  3402. "virtual_address": "0x00000000",
  3403. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  3404. "size": "0x00000000"
  3405. },
  3406. {
  3407. "virtual_address": "0x00000238",
  3408. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  3409. "size": "0x00000020"
  3410. },
  3411. {
  3412. "virtual_address": "0x00001000",
  3413. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  3414. "size": "0x00000328"
  3415. },
  3416. {
  3417. "virtual_address": "0x00000000",
  3418. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  3419. "size": "0x00000000"
  3420. },
  3421. {
  3422. "virtual_address": "0x00000000",
  3423. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  3424. "size": "0x00000000"
  3425. },
  3426. {
  3427. "virtual_address": "0x00000000",
  3428. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  3429. "size": "0x00000000"
  3430. }
  3431. ],
  3432. "exports": [],
  3433. "guest_signers": {},
  3434. "imphash": "23028877b3ded4155a8cd065c88d1374",
  3435. "icon_fuzzy": null,
  3436. "icon": null,
  3437. "pdbpath": null,
  3438. "imported_dll_count": 1,
  3439. "versioninfo": []
  3440. }
  3441. }
  3442.  
  3443. [*] Resolved APIs: [
  3444. "cryptbase.dll.SystemFunction036",
  3445. "uxtheme.dll.ThemeInitApiHook",
  3446. "user32.dll.IsProcessDPIAware",
  3447. "oleaut32.dll.OleLoadPictureEx",
  3448. "oleaut32.dll.DispCallFunc",
  3449. "oleaut32.dll.LoadTypeLibEx",
  3450. "oleaut32.dll.UnRegisterTypeLib",
  3451. "oleaut32.dll.CreateTypeLib2",
  3452. "oleaut32.dll.VarDateFromUdate",
  3453. "oleaut32.dll.VarUdateFromDate",
  3454. "oleaut32.dll.GetAltMonthNames",
  3455. "oleaut32.dll.VarNumFromParseNum",
  3456. "oleaut32.dll.VarParseNumFromStr",
  3457. "oleaut32.dll.VarDecFromR4",
  3458. "oleaut32.dll.VarDecFromR8",
  3459. "oleaut32.dll.VarDecFromDate",
  3460. "oleaut32.dll.VarDecFromI4",
  3461. "oleaut32.dll.VarDecFromCy",
  3462. "oleaut32.dll.VarR4FromDec",
  3463. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  3464. "oleaut32.dll.GetRecordInfoFromGuids",
  3465. "oleaut32.dll.SafeArrayGetRecordInfo",
  3466. "oleaut32.dll.SafeArraySetRecordInfo",
  3467. "oleaut32.dll.SafeArrayGetIID",
  3468. "oleaut32.dll.SafeArraySetIID",
  3469. "oleaut32.dll.SafeArrayCopyData",
  3470. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  3471. "oleaut32.dll.SafeArrayCreateEx",
  3472. "oleaut32.dll.VarFormat",
  3473. "oleaut32.dll.VarFormatDateTime",
  3474. "oleaut32.dll.VarFormatNumber",
  3475. "oleaut32.dll.VarFormatPercent",
  3476. "oleaut32.dll.VarFormatCurrency",
  3477. "oleaut32.dll.VarWeekdayName",
  3478. "oleaut32.dll.VarMonthName",
  3479. "oleaut32.dll.VarAdd",
  3480. "oleaut32.dll.VarAnd",
  3481. "oleaut32.dll.VarCat",
  3482. "oleaut32.dll.VarDiv",
  3483. "oleaut32.dll.VarEqv",
  3484. "oleaut32.dll.VarIdiv",
  3485. "oleaut32.dll.VarImp",
  3486. "oleaut32.dll.VarMod",
  3487. "oleaut32.dll.VarMul",
  3488. "oleaut32.dll.VarOr",
  3489. "oleaut32.dll.VarPow",
  3490. "oleaut32.dll.VarSub",
  3491. "oleaut32.dll.VarXor",
  3492. "oleaut32.dll.VarAbs",
  3493. "oleaut32.dll.VarFix",
  3494. "oleaut32.dll.VarInt",
  3495. "oleaut32.dll.VarNeg",
  3496. "oleaut32.dll.VarNot",
  3497. "oleaut32.dll.VarRound",
  3498. "oleaut32.dll.VarCmp",
  3499. "oleaut32.dll.VarDecAdd",
  3500. "oleaut32.dll.VarDecCmp",
  3501. "oleaut32.dll.VarBstrCat",
  3502. "oleaut32.dll.VarCyMulI4",
  3503. "oleaut32.dll.VarBstrCmp",
  3504. "ole32.dll.CoCreateInstanceEx",
  3505. "ole32.dll.CLSIDFromProgIDEx",
  3506. "sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary",
  3507. "user32.dll.GetSystemMetrics",
  3508. "user32.dll.MonitorFromWindow",
  3509. "user32.dll.MonitorFromRect",
  3510. "user32.dll.MonitorFromPoint",
  3511. "user32.dll.EnumDisplayMonitors",
  3512. "user32.dll.GetMonitorInfoA",
  3513. "lpk.dll.LpkEditControl",
  3514. "comctl32.dll.HIMAGELIST_QueryInterface",
  3515. "comctl32.dll.DrawShadowText",
  3516. "comctl32.dll.DrawSizeBox",
  3517. "comctl32.dll.DrawScrollBar",
  3518. "comctl32.dll.SizeBoxHwnd",
  3519. "comctl32.dll.ScrollBar_MouseMove",
  3520. "comctl32.dll.ScrollBar_Menu",
  3521. "comctl32.dll.HandleScrollCmd",
  3522. "comctl32.dll.DetachScrollBars",
  3523. "comctl32.dll.AttachScrollBars",
  3524. "comctl32.dll.CCSetScrollInfo",
  3525. "comctl32.dll.CCGetScrollInfo",
  3526. "comctl32.dll.CCEnableScrollBar",
  3527. "comctl32.dll.QuerySystemGestureStatus",
  3528. "uxtheme.dll.#49",
  3529. "uxtheme.dll.CloseThemeData",
  3530. "ole32.dll.CoTaskMemAlloc",
  3531. "ole32.dll.CreateBindCtx",
  3532. "comctl32.dll.#328",
  3533. "comctl32.dll.#334",
  3534. "ole32.dll.CoGetMalloc",
  3535. "ole32.dll.CoGetApartmentType",
  3536. "ole32.dll.CoRegisterInitializeSpy",
  3537. "comctl32.dll.#236",
  3538. "oleaut32.dll.#6",
  3539. "comctl32.dll.#332",
  3540. "comctl32.dll.#320",
  3541. "ole32.dll.StringFromGUID2",
  3542. "comctl32.dll.#324",
  3543. "comctl32.dll.#323",
  3544. "apphelp.dll.ApphelpCheckShellObject",
  3545. "ole32.dll.CoCreateInstance",
  3546. "ntdll.dll.RtlDllShutdownInProgress",
  3547. "comctl32.dll.#386",
  3548. "comctl32.dll.#329",
  3549. "propsys.dll.#417",
  3550. "propsys.dll.PSGetNameFromPropertyKey",
  3551. "propsys.dll.PSStringFromPropertyKey",
  3552. "propsys.dll.InitVariantFromBuffer",
  3553. "oleaut32.dll.#9",
  3554. "propsys.dll.PropVariantToGUID",
  3555. "ole32.dll.PropVariantClear",
  3556. "ole32.dll.CoInitializeEx",
  3557. "ole32.dll.CoTaskMemFree",
  3558. "ole32.dll.CoUninitialize",
  3559. "kernel32.dll.InitializeSRWLock",
  3560. "kernel32.dll.AcquireSRWLockExclusive",
  3561. "kernel32.dll.AcquireSRWLockShared",
  3562. "kernel32.dll.ReleaseSRWLockExclusive",
  3563. "kernel32.dll.ReleaseSRWLockShared",
  3564. "uxtheme.dll.DrawThemeBackground",
  3565. "oleaut32.dll.#2",
  3566. "kernel32.dll.GetThreadPreferredUILanguages",
  3567. "kernel32.dll.SetThreadPreferredUILanguages",
  3568. "kernel32.dll.LocaleNameToLCID",
  3569. "kernel32.dll.GetLocaleInfoEx",
  3570. "kernel32.dll.LCIDToLocaleName",
  3571. "kernel32.dll.GetSystemDefaultLocaleName",
  3572. "advapi32.dll.RegEnumKeyW",
  3573. "oleaut32.dll.#283",
  3574. "oleaut32.dll.#284",
  3575. "kernel32.dll.GetComputerNameA",
  3576. "kernel32.dll.NlsGetCacheUpdateCount",
  3577. "kernel32.dll.GlobalMemoryStatusEx",
  3578. "kernel32.dll.Sleep",
  3579. "advapi32.dll.OpenThreadToken",
  3580. "advapi32.dll.InitializeSecurityDescriptor",
  3581. "advapi32.dll.SetEntriesInAclW",
  3582. "ntmarta.dll.GetMartaExtensionInterface",
  3583. "advapi32.dll.SetSecurityDescriptorDacl",
  3584. "advapi32.dll.IsTextUnicode",
  3585. "comctl32.dll.#338",
  3586. "comctl32.dll.#339",
  3587. "shell32.dll.#102",
  3588. "shell32.dll.SHGetPathFromIDListW",
  3589. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  3590. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  3591. "sechost.dll.ConvertSidToStringSidW",
  3592. "profapi.dll.#104",
  3593. "propsys.dll.PSCreateMemoryPropertyStore",
  3594. "propsys.dll.PSPropertyBag_WriteStr",
  3595. "propsys.dll.PSPropertyBag_WriteGUID",
  3596. "propsys.dll.PSPropertyBag_ReadGUID",
  3597. "urlmon.dll.CreateUri",
  3598. "wininet.dll.InternetQueryOptionA",
  3599. "advapi32.dll.EventActivityIdControl",
  3600. "advapi32.dll.EventWriteTransfer",
  3601. "kernel32.dll.SetFileInformationByHandle",
  3602. "shell32.dll.SHGetFolderPathW",
  3603. "kernel32.dll.GetModuleHandleW",
  3604. "ws2_32.dll.accept",
  3605. "ws2_32.dll.bind",
  3606. "ws2_32.dll.closesocket",
  3607. "ws2_32.dll.connect",
  3608. "ws2_32.dll.getpeername",
  3609. "ws2_32.dll.getsockname",
  3610. "ws2_32.dll.getsockopt",
  3611. "ws2_32.dll.ntohl",
  3612. "ws2_32.dll.htonl",
  3613. "ws2_32.dll.htons",
  3614. "ws2_32.dll.inet_addr",
  3615. "ws2_32.dll.inet_ntoa",
  3616. "ws2_32.dll.ioctlsocket",
  3617. "ws2_32.dll.listen",
  3618. "ws2_32.dll.ntohs",
  3619. "ws2_32.dll.recv",
  3620. "ws2_32.dll.recvfrom",
  3621. "ws2_32.dll.select",
  3622. "ws2_32.dll.send",
  3623. "ws2_32.dll.sendto",
  3624. "ws2_32.dll.setsockopt",
  3625. "ws2_32.dll.shutdown",
  3626. "ws2_32.dll.socket",
  3627. "ws2_32.dll.gethostbyname",
  3628. "ws2_32.dll.gethostname",
  3629. "ws2_32.dll.WSAIoctl",
  3630. "ws2_32.dll.WSAGetLastError",
  3631. "ws2_32.dll.WSASetLastError",
  3632. "ws2_32.dll.WSAStartup",
  3633. "ws2_32.dll.WSACleanup",
  3634. "ws2_32.dll.__WSAFDIsSet",
  3635. "ws2_32.dll.getaddrinfo",
  3636. "ws2_32.dll.freeaddrinfo",
  3637. "ws2_32.dll.getnameinfo",
  3638. "ws2_32.dll.WSALookupServiceBeginW",
  3639. "ws2_32.dll.WSALookupServiceNextW",
  3640. "ws2_32.dll.WSALookupServiceEnd",
  3641. "ws2_32.dll.WSANSPIoctl",
  3642. "ws2_32.dll.WSAStringToAddressA",
  3643. "ws2_32.dll.WSAStringToAddressW",
  3644. "ws2_32.dll.WSAAddressToStringA",
  3645. "dnsapi.dll.DnsGetProxyInformation",
  3646. "dnsapi.dll.DnsFreeProxyName",
  3647. "iphlpapi.dll.GetIpForwardTable2",
  3648. "iphlpapi.dll.FreeMibTable",
  3649. "iphlpapi.dll.GetIfEntry2",
  3650. "iphlpapi.dll.ConvertInterfaceGuidToLuid",
  3651. "iphlpapi.dll.ResolveIpNetEntry2",
  3652. "iphlpapi.dll.GetIpNetEntry2",
  3653. "shlwapi.dll.#260",
  3654. "urlmon.dll.CreateURLMonikerEx",
  3655. "urlmon.dll.CreateAsyncBindCtxEx",
  3656. "urlmon.dll.RegisterBindStatusCallback",
  3657. "urlmon.dll.CreateFormatEnumerator",
  3658. "urlmon.dll.UrlMkGetSessionOption",
  3659. "urlmon.dll.CoInternetCreateSecurityManager",
  3660. "rasapi32.dll.RasEnumEntriesW",
  3661. "rtutils.dll.TraceRegisterExA",
  3662. "rtutils.dll.TracePrintfExA",
  3663. "shlwapi.dll.PathCanonicalizeW",
  3664. "shlwapi.dll.PathRemoveFileSpecW",
  3665. "shlwapi.dll.PathFindFileNameW",
  3666. "rasapi32.dll.RasConnectionNotificationW",
  3667. "sensapi.dll.IsNetworkAlive",
  3668. "rpcrt4.dll.RpcBindingFromStringBindingW",
  3669. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  3670. "rpcrt4.dll.NdrClientCall2",
  3671. "sechost.dll.NotifyServiceStatusChangeA",
  3672. "nlaapi.dll.NSPStartup",
  3673. "iphlpapi.dll.GetAdapterIndex",
  3674. "rasadhlp.dll.WSAttemptAutodialAddr",
  3675. "rasadhlp.dll.WSAttemptAutodialName",
  3676. "rasadhlp.dll.WSNoteSuccessfulHostentLookup",
  3677. "kernel32.dll.IsWow64Process",
  3678. "urlmon.dll.RevokeBindStatusCallback",
  3679. "urlmon.dll.CreateIUriBuilder",
  3680. "advapi32.dll.AddMandatoryAce",
  3681. "version.dll.GetFileVersionInfoSizeW",
  3682. "version.dll.GetFileVersionInfoW",
  3683. "version.dll.VerQueryValueW",
  3684. "urlmon.dll.#330",
  3685. "urlmon.dll.#414",
  3686. "urlmon.dll.RegisterFormatEnumerator",
  3687. "oleaut32.dll.#3",
  3688. "urlmon.dll.CoInternetIsFeatureEnabled",
  3689. "oleaut32.dll.#201",
  3690. "wininet.dll.CreateUrlCacheEntryA",
  3691. "wininet.dll.CommitUrlCacheEntryA",
  3692. "oleaut32.dll.#7",
  3693. "oleaut32.dll.#8",
  3694. "ieframe.dll.#302",
  3695. "urlmon.dll.#101",
  3696. "oleaut32.dll.VariantClear",
  3697. "mlang.dll.#112",
  3698. "wininet.dll.GetUrlCacheEntryInfoA",
  3699. "advapi32.dll.RegQueryValueExA",
  3700. "advapi32.dll.RegCloseKey",
  3701. "ole32.dll.CoGetObjectContext",
  3702. "imgutil.dll.DecodeImage",
  3703. "oleaut32.dll.#147",
  3704. "oleaut32.dll.#4",
  3705. "comctl32.dll.ImageList_Create",
  3706. "comctl32.dll.ImageList_ReplaceIcon",
  3707. "wininet.dll.GetUrlCacheEntryInfoExW",
  3708. "user32.dll.GetAsyncKeyState",
  3709. "comctl32.dll.ImageList_Destroy",
  3710. "oleaut32.dll.#500",
  3711. "ole32.dll.CoRevokeInitializeSpy",
  3712. "comctl32.dll.#388",
  3713. "advapi32.dll.UnregisterTraceGuids",
  3714. "ntdll.dll.EtwUnregisterTraceGuids",
  3715. "rpcrt4.dll.RpcBindingFree",
  3716. "comctl32.dll.#321",
  3717. "cryptsp.dll.CryptReleaseContext",
  3718. "ole32.dll.CoGetClassObject",
  3719. "ole32.dll.CoGetMarshalSizeMax",
  3720. "ole32.dll.CoMarshalInterface",
  3721. "ole32.dll.CoUnmarshalInterface",
  3722. "ole32.dll.StringFromIID",
  3723. "ole32.dll.CoGetPSClsid",
  3724. "ole32.dll.CoReleaseMarshalData",
  3725. "ole32.dll.DcomChannelSetHResult",
  3726. "vssapi.dll.CreateWriter",
  3727. "advapi32.dll.LookupAccountNameW",
  3728. "sechost.dll.LookupAccountNameLocalW",
  3729. "advapi32.dll.LookupAccountSidW",
  3730. "samcli.dll.NetLocalGroupGetMembers",
  3731. "samlib.dll.SamConnect",
  3732. "rpcrt4.dll.NdrClientCall3",
  3733. "rpcrt4.dll.RpcStringBindingComposeW",
  3734. "rpcrt4.dll.RpcStringFreeW",
  3735. "samlib.dll.SamOpenDomain",
  3736. "samlib.dll.SamLookupNamesInDomain",
  3737. "samlib.dll.SamOpenAlias",
  3738. "samlib.dll.SamFreeMemory",
  3739. "samlib.dll.SamCloseHandle",
  3740. "samlib.dll.SamGetMembersInAlias",
  3741. "netutils.dll.NetApiBufferFree",
  3742. "ole32.dll.CoCreateGuid",
  3743. "ole32.dll.StringFromCLSID",
  3744. "propsys.dll.VariantToPropVariant",
  3745. "wbemcore.dll.Reinitialize",
  3746. "wbemsvc.dll.DllGetClassObject",
  3747. "wbemsvc.dll.DllCanUnloadNow",
  3748. "authz.dll.AuthzInitializeContextFromToken",
  3749. "authz.dll.AuthzInitializeObjectAccessAuditEvent2",
  3750. "authz.dll.AuthzAccessCheck",
  3751. "authz.dll.AuthzFreeAuditEvent",
  3752. "authz.dll.AuthzFreeContext",
  3753. "authz.dll.AuthzInitializeResourceManager",
  3754. "authz.dll.AuthzFreeResourceManager",
  3755. "rpcrt4.dll.RpcBindingCreateW",
  3756. "rpcrt4.dll.RpcBindingBind",
  3757. "rpcrt4.dll.I_RpcMapWin32Status",
  3758. "advapi32.dll.EventRegister",
  3759. "advapi32.dll.EventUnregister",
  3760. "advapi32.dll.EventWrite",
  3761. "kernel32.dll.RegCloseKey",
  3762. "kernel32.dll.RegSetValueExW",
  3763. "kernel32.dll.RegOpenKeyExW",
  3764. "kernel32.dll.RegQueryValueExW",
  3765. "wmisvc.dll.IsImproperShutdownDetected",
  3766. "wevtapi.dll.EvtRender",
  3767. "wevtapi.dll.EvtNext",
  3768. "wevtapi.dll.EvtClose",
  3769. "wevtapi.dll.EvtQuery",
  3770. "wevtapi.dll.EvtCreateRenderContext",
  3771. "rpcrt4.dll.RpcBindingSetOption",
  3772. "ole32.dll.CoCreateFreeThreadedMarshaler",
  3773. "ole32.dll.CreateStreamOnHGlobal",
  3774. "advapi32.dll.RegCreateKeyExW",
  3775. "advapi32.dll.RegSetValueExW",
  3776. "cryptsp.dll.CryptAcquireContextW",
  3777. "cryptsp.dll.CryptGenRandom",
  3778. "kernelbase.dll.InitializeAcl",
  3779. "kernelbase.dll.AddAce",
  3780. "sechost.dll.ConvertStringSecurityDescriptorToSecurityDescriptorW",
  3781. "kernel32.dll.IsThreadAFiber",
  3782. "kernel32.dll.OpenProcessToken",
  3783. "kernelbase.dll.GetTokenInformation",
  3784. "kernelbase.dll.DuplicateTokenEx",
  3785. "kernelbase.dll.AdjustTokenPrivileges",
  3786. "sechost.dll.LookupAccountSidLocalW",
  3787. "kernel32.dll.SetThreadToken",
  3788. "kernelbase.dll.CheckTokenMembership",
  3789. "kernelbase.dll.AllocateAndInitializeSid",
  3790. "oleaut32.dll.#285",
  3791. "advapi32.dll.RegOpenKeyW",
  3792. "oleaut32.dll.#12",
  3793. "oleaut32.dll.#286",
  3794. "ole32.dll.CLSIDFromString",
  3795. "oleaut32.dll.#17",
  3796. "oleaut32.dll.#20",
  3797. "oleaut32.dll.#19",
  3798. "oleaut32.dll.#25",
  3799. "ole32.dll.CoRevertToSelf",
  3800. "advapi32.dll.LogonUserExExW",
  3801. "sspicli.dll.LogonUserExExW",
  3802. "authz.dll.AuthzInitializeContextFromSid",
  3803. "ole32.dll.CoGetCallContext",
  3804. "ole32.dll.CoImpersonateClient",
  3805. "ole32.dll.CoSwitchCallContext",
  3806. "oleaut32.dll.#287",
  3807. "oleaut32.dll.#288",
  3808. "oleaut32.dll.#289",
  3809. "advapi32.dll.WmiMofEnumerateResourcesW",
  3810. "advapi32.dll.WmiFreeBuffer",
  3811. "kernel32.dll.SortGetHandle",
  3812. "kernel32.dll.SortCloseHandle",
  3813. "fastprox.dll.DllGetClassObject",
  3814. "fastprox.dll.DllCanUnloadNow",
  3815. "oleaut32.dll.#290",
  3816. "iphlpapi.dll.GetAdaptersAddresses",
  3817. "iphlpapi.dll.ConvertLengthToIpv4Mask",
  3818. "oleaut32.dll.#15",
  3819. "oleaut32.dll.#26",
  3820. "oleaut32.dll.#16",
  3821. "dnsapi.dll.DnsQueryConfigAllocEx",
  3822. "iphlpapi.dll.GetCurrentThreadCompartmentId",
  3823. "dnsapi.dll.DnsFreeConfigStructure",
  3824. "dnsapi.dll.DnsQueryConfigDword",
  3825. "kernel32.dll.SetThreadUILanguage",
  3826. "kernel32.dll.CopyFileExW",
  3827. "kernel32.dll.IsDebuggerPresent",
  3828. "kernel32.dll.SetConsoleInputExeNameW",
  3829. "shell32.dll.ShellExecuteExW",
  3830. "ole32.dll.OleInitialize",
  3831. "propsys.dll.PSPropertyBag_WriteDWORD",
  3832. "propsys.dll.PSPropertyBag_ReadDWORD",
  3833. "propsys.dll.PSPropertyBag_ReadBSTR",
  3834. "propsys.dll.PSPropertyBag_ReadStrAlloc",
  3835. "advapi32.dll.RegQueryValueW",
  3836. "propsys.dll.#430",
  3837. "advapi32.dll.RegOpenKeyExW",
  3838. "advapi32.dll.RegGetValueW",
  3839. "ole32.dll.CoTaskMemRealloc",
  3840. "propsys.dll.InitPropVariantFromStringAsVector",
  3841. "propsys.dll.PSCoerceToCanonicalValue",
  3842. "propsys.dll.PropVariantToStringAlloc",
  3843. "ole32.dll.CoAllowSetForegroundWindow",
  3844. "advapi32.dll.SaferiIsExecutableFileType",
  3845. "advapi32.dll.SaferGetPolicyInformation",
  3846. "advapi32.dll.CommandLineFromMsiDescriptor",
  3847. "msiltcfg.dll.MsiSetInternalUI",
  3848. "msiltcfg.dll.MsiConfigureProductExW",
  3849. "msiltcfg.dll.MsiProvideComponentFromDescriptorW",
  3850. "msiltcfg.dll.MsiDecomposeDescriptorW",
  3851. "msiltcfg.dll.MsiGetProductInfoW",
  3852. "msiltcfg.dll.MsiAdvertiseScriptW",
  3853. "msiltcfg.dll.MsiQueryProductStateW",
  3854. "msiltcfg.dll.MsiIsProductElevatedW",
  3855. "msiltcfg.dll.MsiReinstallProductW",
  3856. "user32.dll.MsgWaitForMultipleObjects",
  3857. "user32.dll.PeekMessageW",
  3858. "user32.dll.TranslateMessage",
  3859. "user32.dll.DispatchMessageW",
  3860. "user32.dll.GetProcessWindowStation",
  3861. "user32.dll.CloseWindowStation",
  3862. "user32.dll.GetUserObjectInformationW",
  3863. "msi.dll.MsiDecomposeDescriptorW",
  3864. "msi.dll.MsiGetComponentPathW",
  3865. "msi.dll.MsiGetProductInfoW",
  3866. "msi.dll.MsiProvideComponentFromDescriptorW",
  3867. "msi.dll.MsiQueryFeatureStateW",
  3868. "msi.dll.MsiQueryFeatureStateFromDescriptorW",
  3869. "msi.dll.MsiSetInternalUI",
  3870. "msi.dll.MsiAdvertiseScriptW",
  3871. "msi.dll.MsiQueryProductStateW",
  3872. "msi.dll.MsiIsProductElevatedW",
  3873. "msi.dll.MsiReinstallProductW",
  3874. "msi.dll.MsiConfigureProductExW",
  3875. "kernel32.dll.GetNativeSystemInfo",
  3876. "kernel32.dll.GetSystemWow64DirectoryW",
  3877. "kernel32.dll.GetFileAttributesExW",
  3878. "sfc.dll.SfcIsKeyProtected",
  3879. "sfc.dll.SfcIsFileProtected",
  3880. "setupapi.dll.PnpIsFilePnpDriver",
  3881. "devrtl.dll.DevRtlGetThreadLogToken",
  3882. "apphelp.dll.AllowPermLayer",
  3883. "kernel32.dll.BaseIsAppcompatInfrastructureDisabled",
  3884. "apphelp.dll.SdbInitDatabase",
  3885. "apphelp.dll.SdbGetMatchingExe",
  3886. "apphelp.dll.SdbReleaseDatabase",
  3887. "mpr.dll.WNetGetConnectionW",
  3888. "ole32.dll.OleUninitialize",
  3889. "kernelbase.dll.SetThreadStackGuarantee",
  3890. "user32.dll.SystemParametersInfoW",
  3891. "wwlib.dll.FMain",
  3892. "wwlib.dll.wdCommandDispatch",
  3893. "wwlib.dll.wdGetApplicationObject",
  3894. "advapi32.dll.RegQueryValueExW",
  3895. "advapi32.dll.RegOpenKeyExA",
  3896. "user32.dll.GetDC",
  3897. "gdi32.dll.GetDeviceCaps",
  3898. "user32.dll.ReleaseDC",
  3899. "mso.dll.#1868",
  3900. "mso.dll.#7148",
  3901. "mso.dll.#735",
  3902. "mso.dll.#2225",
  3903. "user32.dll.RegisterWindowMessageA",
  3904. "mso.dll.#596",
  3905. "mso.dll.#935",
  3906. "mso.dll.#1918",
  3907. "mso.dll.#2288",
  3908. "advapi32.dll.RegCreateKeyExA",
  3909. "advapi32.dll.RegSetValueExA",
  3910. "d2d1.dll.#1",
  3911. "kernel32.dll.WerRegisterMemoryBlock",
  3912. "user32.dll.RegisterClassExW",
  3913. "user32.dll.RegisterWindowMessageW",
  3914. "user32.dll.CreateWindowExW",
  3915. "user32.dll.GetWindowLongW",
  3916. "user32.dll.DefWindowProcW",
  3917. "user32.dll.SetWindowLongW",
  3918. "wtsapi32.dll.WTSRegisterSessionNotification",
  3919. "user32.dll.IsWindow",
  3920. "user32.dll.GetWindowThreadProcessId",
  3921. "winsta.dll.WinStationRegisterConsoleNotification",
  3922. "advapi32.dll.CreateWellKnownSid",
  3923. "rpcrt4.dll.RpcAsyncInitializeHandle",
  3924. "rpcrt4.dll.NdrAsyncClientCall",
  3925. "dxgi.dll.CreateDXGIFactory1",
  3926. "gdi32.dll.D3DKMTOpenAdapterFromGdiDisplayName",
  3927. "gdi32.dll.D3DKMTCloseAdapter",
  3928. "gdi32.dll.D3DKMTQueryAdapterInfo",
  3929. "gdi32.dll.D3DKMTOpenAdapterFromDeviceName",
  3930. "setupapi.dll.SetupDiGetClassDevsW",
  3931. "setupapi.dll.SetupDiEnumDeviceInterfaces",
  3932. "setupapi.dll.SetupDiGetDeviceInterfaceDetailW",
  3933. "setupapi.dll.SetupDiDestroyDeviceInfoList",
  3934. "setupapi.dll.SetupDiGetDevicePropertyW",
  3935. "wintrust.dll.WinVerifyTrust",
  3936. "user32.dll.SystemParametersInfoA",
  3937. "user32.dll.BeginPaint",
  3938. "user32.dll.ValidateRect",
  3939. "user32.dll.GetForegroundWindow",
  3940. "mso.dll.#9880",
  3941. "mso.dll.#759",
  3942. "msi.dll.#137",
  3943. "msi.dll.#37",
  3944. "msi.dll.#113",
  3945. "advapi32.dll.CheckTokenMembership",
  3946. "msi.dll.#193",
  3947. "msi.dll.#173",
  3948. "advapi32.dll.RegEnumValueW",
  3949. "user32.dll.GetKeyboardLayoutList",
  3950. "mso.dll.#542",
  3951. "mso.dll.#2131",
  3952. "mso.dll.#4727",
  3953. "mso.dll.#127",
  3954. "mso.dll.#1091",
  3955. "mso.dll.#1213",
  3956. "mso.dll.#1980",
  3957. "mso.dll.#3144",
  3958. "mso.dll.#4474",
  3959. "mso.dll.#6521",
  3960. "mso.dll.#2817",
  3961. "mso.dll.#1594",
  3962. "mso.dll.#3184",
  3963. "mso.dll.#8395",
  3964. "mso.dll.#912",
  3965. "mso.dll.#8483",
  3966. "mso.dll.#165",
  3967. "user32.dll.GetKeyboardLayout",
  3968. "mso.dll.#8879",
  3969. "mso.dll.#9462",
  3970. "mso.dll.#6730",
  3971. "mso.dll.#5436",
  3972. "mso.dll.#7927",
  3973. "mso.dll.#5372",
  3974. "advapi32.dll.RegQueryInfoKeyW",
  3975. "advapi32.dll.RegEnumKeyExW",
  3976. "mso.dll.#7964",
  3977. "mso.dll.#6786",
  3978. "mso.dll.#6985",
  3979. "user32.dll.GetDoubleClickTime",
  3980. "mso.dll.#6948",
  3981. "mso.dll.#1527",
  3982. "mso.dll.#7497",
  3983. "mso.dll.#5916",
  3984. "advapi32.dll.OpenProcessToken",
  3985. "advapi32.dll.GetTokenInformation",
  3986. "advapi32.dll.GetLengthSid",
  3987. "advapi32.dll.CopySid",
  3988. "advapi32.dll.IsValidSid",
  3989. "advapi32.dll.InitializeAcl",
  3990. "advapi32.dll.AddAccessAllowedAce",
  3991. "advapi32.dll.ConvertSidToStringSidA",
  3992. "mso.dll.#4606",
  3993. "mso.dll.#5893",
  3994. "mso.dll.#1822",
  3995. "user32.dll.GetMonitorInfoW",
  3996. "mso.dll.#1286",
  3997. "kernel32.dll.QueryActCtxW",
  3998. "kernel32.dll.ActivateActCtx",
  3999. "kernel32.dll.FindActCtxSectionStringW",
  4000. "kernel32.dll.DeactivateActCtx",
  4001. "user32.dll.RegisterClassW",
  4002. "user32.dll.LoadCursorA",
  4003. "user32.dll.GetSysColor",
  4004. "gdi32.dll.CreateSolidBrush",
  4005. "gdi32.dll.CreateDIBSection",
  4006. "gdi32.dll.GetObjectW",
  4007. "imm32.dll.ImmDisableIME",
  4008. "user32.dll.IsWindowEnabled",
  4009. "user32.dll.GetWindowLongA",
  4010. "user32.dll.SetWindowLongA",
  4011. "dwmapi.dll.DwmIsCompositionEnabled",
  4012. "gdi32.dll.CreateRectRgn",
  4013. "user32.dll.SetWindowRgn",
  4014. "user32.dll.LoadImageA",
  4015. "user32.dll.SendMessageW",
  4016. "user32.dll.InvalidateRect",
  4017. "user32.dll.GetWindowRect",
  4018. "user32.dll.IsWinEventHookInstalled",
  4019. "user32.dll.NotifyWinEvent",
  4020. "user32.dll.ShowWindow",
  4021. "user32.dll.UpdateWindow",
  4022. "user32.dll.IsRectEmpty",
  4023. "gdi32.dll.CreateCompatibleDC",
  4024. "gdi32.dll.SelectObject",
  4025. "user32.dll.SetRect",
  4026. "gdi32.dll.GetClipBox",
  4027. "gdi32.dll.SelectClipRgn",
  4028. "gdi32.dll.IntersectClipRect",
  4029. "user32.dll.OffsetRect",
  4030. "user32.dll.IntersectRect",
  4031. "gdi32.dll.SetDIBitsToDevice",
  4032. "gdi32.dll.DeleteDC",
  4033. "user32.dll.EndPaint",
  4034. "mso.dll.#1336",
  4035. "user32.dll.LoadIconW",
  4036. "user32.dll.LoadImageW",
  4037. "user32.dll.LoadCursorW",
  4038. "user32.dll.SetCursor",
  4039. "user32.dll.RegisterClipboardFormatA",
  4040. "mso.dll.#7680",
  4041. "msi.dll.#203",
  4042. "mso.dll.#5328",
  4043. "msptls.dll.?LsGetRubyLsimethods@Ptls6@@YGJPAUlsimethods@1@@Z",
  4044. "msptls.dll.?LsGetTatenakayokoLsimethods@Ptls6@@YGJPAUlsimethods@1@@Z",
  4045. "msptls.dll.?LsGetWarichuLsimethods@Ptls6@@YGJPAUlsimethods@1@@Z",
  4046. "msptls.dll.?LsGetReverseLsimethods@Ptls6@@YGJPAUlsimethods@1@@Z",
  4047. "msptls.dll.?LsGetVRubyLsimethods@Ptls6@@YGJPAUlsimethods@1@@Z",
  4048. "msptls.dll.?LsGetMathLsimethods@Ptls6@@YGJPAUlsimethods@1@@Z",
  4049. "msptls.dll.?LsCreateContext@Ptls6@@YGJPBUlscontextinfo@1@PAPAUlscontext@1@@Z",
  4050. "mso.dll.#4636",
  4051. "mso.dll.#5251",
  4052. "mso.dll.#5467",
  4053. "msptls.dll.?LsGetPenaltyModule@Ptls6@@YGJPAUlscontext@1@PAPAUtspenaltymodule@1@@Z",
  4054. "msptls.dll.?FsCreateContext@Ptls6@@YGJPBUfscontextinfo@1@PAPAUfscontext@1@@Z",
  4055. "mso.dll.#2026",
  4056. "mso.dll.#3392",
  4057. "mso.dll.#1666",
  4058. "mso.dll.#8534",
  4059. "mso.dll.#6845",
  4060. "mso.dll.#5135",
  4061. "mso.dll.#8427",
  4062. "mso.dll.#5589",
  4063. "advapi32.dll.RegNotifyChangeKeyValue",
  4064. "mso.dll.#7165",
  4065. "mso.dll.#2878",
  4066. "mso.dll.#6137",
  4067. "mso.dll.#9019",
  4068. "mso.dll.#690",
  4069. "mso.dll.#6359",
  4070. "mso.dll.#2975",
  4071. "mso.dll.#7936",
  4072. "mso.dll.#7345",
  4073. "mso.dll.#1305",
  4074. "mso.dll.#2243",
  4075. "mso.dll.#3931",
  4076. "mso.dll.#7949",
  4077. "uxtheme.dll.IsThemeActive",
  4078. "uxtheme.dll.IsAppThemed",
  4079. "kernel32.dll.CreateActCtxW",
  4080. "kernel32.dll.ReleaseActCtx",
  4081. "uxtheme.dll.GetThemeAppProperties",
  4082. "gdi32.dll.CreateFontIndirectA",
  4083. "gdi32.dll.GetTextMetricsA",
  4084. "gdi32.dll.GetTextFaceW",
  4085. "gdi32.dll.GetOutlineTextMetricsW",
  4086. "mso.dll.#7139",
  4087. "mso.dll.#2545",
  4088. "mso.dll.#5239",
  4089. "mso.dll.#6103",
  4090. "mso.dll.#5573",
  4091. "mso.dll.#2727",
  4092. "gdi32.dll.CreateFontIndirectW",
  4093. "mso.dll.#5974",
  4094. "mso.dll.#7170",
  4095. "gdi32.dll.GetCharWidth32W",
  4096. "mso.dll.#7125",
  4097. "gdi32.dll.GetTextExtentPoint32W",
  4098. "gdi32.dll.DeleteObject",
  4099. "gdi32.dll.SetTextColor",
  4100. "gdi32.dll.SetBkMode",
  4101. "gdi32.dll.GetObjectType",
  4102. "gdi32.dll.GetTextMetricsW",
  4103. "gdi32.dll.ExtTextOutW",
  4104. "mso.dll.#2594",
  4105. "mso.dll.#415",
  4106. "mso.dll.#8595",
  4107. "mso.dll.#49",
  4108. "mso.dll.#534",
  4109. "mso.dll.#8275",
  4110. "mso.dll.#7785",
  4111. "mso.dll.#9131",
  4112. "mso.dll.#4906",
  4113. "mso.dll.#4113",
  4114. "mso.dll.#4631",
  4115. "mso.dll.#9306",
  4116. "user32.dll.FindWindowW",
  4117. "mso.dll.#1969",
  4118. "mso.dll.#8651",
  4119. "mso.dll.#4134",
  4120. "mso.dll.#9010",
  4121. "mso.dll.#7864",
  4122. "mso.dll.#9177",
  4123. "mso.dll.#8223",
  4124. "mso.dll.#6428",
  4125. "mso.dll.#4477",
  4126. "mso.dll.#741",
  4127. "d3d10_1.dll.D3D10CreateDevice1",
  4128. "d3d10warp.dll.D3DKMTOpenAdapterFromGdiDisplayName",
  4129. "d3d10warp.dll.D3DKMTOpenAdapterFromDeviceName",
  4130. "d3d10warp.dll.D3DKMTGetDisplayModeList",
  4131. "d3d10warp.dll.D3DKMTSetVidPnSourceOwner",
  4132. "d3d10warp.dll.D3DKMTSetDisplayMode",
  4133. "d3d10warp.dll.D3DKMTCloseAdapter",
  4134. "d3d10warp.dll.D3DKMTSetGammaRamp",
  4135. "d3d10warp.dll.D3DKMTGetDeviceState",
  4136. "d3d10warp.dll.D3DKMTQueryAdapterInfo",
  4137. "d3d10warp.dll.D3DKMTWaitForVerticalBlankEvent",
  4138. "gdi32.dll.D3DKMTCreateDCFromMemory",
  4139. "gdi32.dll.D3DKMTDestroyDCFromMemory",
  4140. "gdi32.dll.D3DKMTCheckVidPnExclusiveOwnership",
  4141. "gdi32.dll.D3DKMTCheckMonitorPowerState",
  4142. "gdi32.dll.D3DKMTCheckSharedResourceAccess",
  4143. "d3d10_1core.dll.D3D10CoreCreateDevice1",
  4144. "d3d10_1core.dll.D3D10CoreGetSupportedVersions",
  4145. "d3d10_1core.dll.D3D10CoreGetVersion",
  4146. "d3d10warp.dll.D3DKMTCreateAllocation",
  4147. "d3d10warp.dll.D3DKMTQueryResourceInfo",
  4148. "d3d10warp.dll.D3DKMTOpenResource",
  4149. "d3d10warp.dll.D3DKMTDestroyAllocation",
  4150. "d3d10warp.dll.D3DKMTSetAllocationPriority",
  4151. "d3d10warp.dll.D3DKMTQueryAllocationResidency",
  4152. "d3d10warp.dll.D3DKMTCreateDevice",
  4153. "d3d10warp.dll.D3DKMTDestroyDevice",
  4154. "d3d10warp.dll.D3DKMTGetRuntimeData",
  4155. "d3d10warp.dll.D3DKMTLock",
  4156. "d3d10warp.dll.D3DKMTUnlock",
  4157. "d3d10warp.dll.D3DKMTGetMultisampleMethodList",
  4158. "d3d10warp.dll.D3DKMTPresent",
  4159. "d3d10warp.dll.D3DKMTRender",
  4160. "d3d10warp.dll.D3DKMTGetSharedPrimaryHandle",
  4161. "d3d10warp.dll.D3DKMTEscape",
  4162. "d3d10warp.dll.D3DKMTSetContextSchedulingPriority",
  4163. "d3d10warp.dll.D3DKMTGetContextSchedulingPriority",
  4164. "d3d10warp.dll.D3DKMTCreateContext",
  4165. "d3d10warp.dll.D3DKMTDestroyContext",
  4166. "d3d10warp.dll.D3DKMTCreateSynchronizationObject",
  4167. "d3d10warp.dll.D3DKMTDestroySynchronizationObject",
  4168. "d3d10warp.dll.D3DKMTWaitForSynchronizationObject",
  4169. "d3d10warp.dll.D3DKMTSignalSynchronizationObject",
  4170. "d3d10warp.dll.D3DKMTSetDisplayPrivateDriverFormat",
  4171. "d3d10warp.dll.OpenAdapter10_2",
  4172. "d3d10_1core.dll.D3D10CoreRegisterLayers",
  4173. "d3d10warp.dll.#50",
  4174. "mso.dll.#7766",
  4175. "d3d11.dll.D3D11CreateDevice",
  4176. "advapi32.dll.EventProviderEnabled",
  4177. "windowscodecs.dll.WICCreateImagingFactory_Proxy",
  4178. "dwrite.dll.DWriteCreateFactory",
  4179. "mso.dll.#7355",
  4180. "mso.dll.#9571",
  4181. "mso.dll.#3351",
  4182. "mso.dll.#5634",
  4183. "user32.dll.GetPropW",
  4184. "user32.dll.SetPropW",
  4185. "mso.dll.#4485",
  4186. "user32.dll.IsWindowVisible",
  4187. "mso.dll.#5330",
  4188. "gdi32.dll.GetLayout",
  4189. "gdi32.dll.GdiRealizationInfo",
  4190. "gdi32.dll.FontIsLinked",
  4191. "gdi32.dll.GetTextFaceAliasW",
  4192. "gdi32.dll.GetFontAssocStatus",
  4193. "mso.dll.#907",
  4194. "mso.dll.#6563",
  4195. "mso.dll.#4688",
  4196. "mso.dll.#2401",
  4197. "mso.dll.#8412",
  4198. "mscoree.dll.GetRequestedRuntimeInfo",
  4199. "shlwapi.dll.UrlIsW",
  4200. "mscoree.dll.LockClrVersion",
  4201. "mscoree.dll.CLRCreateInstance",
  4202. "gdiplus.dll.GdiplusStartup",
  4203. "kernel32.dll.IsProcessorFeaturePresent",
  4204. "user32.dll.GetWindowInfo",
  4205. "user32.dll.GetAncestor",
  4206. "user32.dll.EnumDisplayDevicesA",
  4207. "gdi32.dll.GdiIsMetaPrintDC",
  4208. "user32.dll.RegisterClassA",
  4209. "kernel32.dll.FlsAlloc",
  4210. "kernel32.dll.FlsGetValue",
  4211. "kernel32.dll.FlsSetValue",
  4212. "kernel32.dll.FlsFree",
  4213. "advapi32.dll.CredEnumerateW",
  4214. "user32.dll.CreateWindowExA",
  4215. "user32.dll.DefWindowProcA",
  4216. "user32.dll.AddClipboardFormatListener",
  4217. "user32.dll.PostMessageA",
  4218. "user32.dll.IsWindowUnicode",
  4219. "advapi32.dll.EqualSid",
  4220. "advapi32.dll.RegQueryInfoKeyA",
  4221. "ole32.dll.OleLoadFromStream",
  4222. "oleaut32.dll.SysAllocStringByteLen",
  4223. "oleaut32.dll.SysFreeString",
  4224. "oleaut32.dll.VariantChangeType",
  4225. "shell32.dll.SHParseDisplayName",
  4226. "user32.dll.GetWindowTextW",
  4227. "gdi32.dll.CreateBitmap",
  4228. "gdi32.dll.CreatePatternBrush",
  4229. "advapi32.dll.RevertToSelf",
  4230. "user32.dll.GetFocus",
  4231. "ws2_32.dll.#115",
  4232. "ole32.dll.CoSetProxyBlanket",
  4233. "riched20.dll.REMSOHInst",
  4234. "riched20.dll.REExtendedRegisterClass",
  4235. "mso.dll.#4628",
  4236. "mso.dll.#4138",
  4237. "mso.dll.#9826",
  4238. "mso.dll.#913",
  4239. "mso.dll.#7629",
  4240. "secur32.dll.GetUserNameExW",
  4241. "mso.dll.#1796",
  4242. "mso.dll.#4418",
  4243. "user32.dll.RegisterRawInputDevices",
  4244. "user32.dll.SetTimer",
  4245. "user32.dll.SetWindowsHookExW",
  4246. "user32.dll.WaitForInputIdle",
  4247. "mso.dll.#7499",
  4248. "mso.dll.#3801",
  4249. "mso.dll.#2029",
  4250. "mso.dll.#5478",
  4251. "mso.dll.#6115",
  4252. "mso.dll.#2117",
  4253. "mso.dll.#3552",
  4254. "mso.dll.#1513",
  4255. "normaliz.dll.IdnToAscii",
  4256. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  4257. "gdi32.dll.GdiFlush",
  4258. "winhttp.dll.WinHttpOpen",
  4259. "osppc.dll.SLClose",
  4260. "osppc.dll.SLConsumeRight",
  4261. "osppc.dll.SLGetPKeyId",
  4262. "osppc.dll.SLGetPolicyInformation",
  4263. "osppc.dll.SLGetApplicationPolicy",
  4264. "osppc.dll.SLGetLicensingStatusInformation",
  4265. "osppc.dll.SLLoadApplicationPolicies",
  4266. "osppc.dll.SLOpen",
  4267. "osppc.dll.SLPersistApplicationPolicies",
  4268. "osppc.dll.SLUnloadApplicationPolicies",
  4269. "osppc.dll.SLGetProductSkuInformation",
  4270. "osppc.dll.SLInstallProofOfPurchase",
  4271. "osppc.dll.SLInstallLicense",
  4272. "osppc.dll.SLRegisterPlugin",
  4273. "osppc.dll.SLUninstallProofOfPurchase",
  4274. "osppc.dll.SLGetPKeyInformation",
  4275. "osppc.dll.SLGetSLIDList",
  4276. "osppc.dll.SLGenerateOfflineInstallationId",
  4277. "osppc.dll.SLDepositOfflineConfirmationId",
  4278. "osppc.dll.SLPersistRTSPayloadOverride",
  4279. "osppc.dll.SLSetAuthenticationData",
  4280. "osppc.dll.SLGetAuthenticationResult",
  4281. "osppc.dll.SLGetServiceInformation",
  4282. "osppc.dll.SLGetInstalledProductKeyIds",
  4283. "osppc.dll.SLUninstallLicense",
  4284. "winhttp.dll.WinHttpSetOption",
  4285. "winhttp.dll.WinHttpSetTimeouts",
  4286. "winhttp.dll.WinHttpConnect",
  4287. "winhttp.dll.WinHttpOpenRequest",
  4288. "winhttp.dll.WinHttpSetStatusCallback",
  4289. "winhttp.dll.WinHttpAddRequestHeaders",
  4290. "shlwapi.dll.#153",
  4291. "winhttp.dll.WinHttpSendRequest",
  4292. "ws2_32.dll.GetAddrInfoW",
  4293. "mso.dll.#1332",
  4294. "mso.dll.#6876",
  4295. "mso.dll.#160",
  4296. "mso.dll.#3800",
  4297. "mso.dll.#717",
  4298. "mso.dll.#5454",
  4299. "mso.dll.#2249",
  4300. "mso.dll.#595",
  4301. "mso.dll.#2112",
  4302. "mso.dll.#2492",
  4303. "mso.dll.#7412",
  4304. "mso.dll.#7727",
  4305. "mso.dll.#4470",
  4306. "mso.dll.#8666",
  4307. "mso.dll.#4361",
  4308. "mso.dll.#7275",
  4309. "mso.dll.#5538",
  4310. "mso.dll.#2543",
  4311. "mso.dll.#7992",
  4312. "user32.dll.PostMessageW",
  4313. "user32.dll.GetWindowTextLengthA",
  4314. "user32.dll.SendMessageA",
  4315. "user32.dll.GetClassLongA",
  4316. "user32.dll.CopyIcon",
  4317. "user32.dll.GetIconInfo",
  4318. "user32.dll.GetActiveWindow",
  4319. "user32.dll.GetWindowPlacement",
  4320. "user32.dll.GetSystemMenu",
  4321. "user32.dll.IsMenu",
  4322. "user32.dll.EnableMenuItem",
  4323. "dwmapi.dll.DwmSetWindowAttribute",
  4324. "user32.dll.GetClassInfoExW",
  4325. "user32.dll.CallNextHookEx",
  4326. "comctl32.dll.SetWindowSubclass",
  4327. "comctl32.dll.DefSubclassProc",
  4328. "user32.dll.KillTimer",
  4329. "comctl32.dll.RemoveWindowSubclass",
  4330. "user32.dll.DestroyWindow",
  4331. "user32.dll.SetWindowPos",
  4332. "mso.dll.#1876",
  4333. "mso.dll.#4369",
  4334. "mso.dll.#2561",
  4335. "mso.dll.#8343",
  4336. "mso.dll.#5440",
  4337. "winspool.drv.#203",
  4338. "user32.dll.VkKeyScanExW",
  4339. "mso.dll.#2179",
  4340. "mso.dll.#9751",
  4341. "mso.dll.#4481",
  4342. "mso.dll.#3726",
  4343. "mso.dll.#9663",
  4344. "mso.dll.#8093",
  4345. "user32.dll.GetClassLongW",
  4346. "mso.dll.#3599",
  4347. "user32.dll.GetClassNameW",
  4348. "mso.dll.#4994",
  4349. "mso.dll.#2660",
  4350. "shell32.dll.DragAcceptFiles",
  4351. "mso.dll.#1158",
  4352. "mso.dll.#2814",
  4353. "mso.dll.#3177",
  4354. "mso.dll.#1437",
  4355. "mso.dll.#4892",
  4356. "mso.dll.#1836",
  4357. "mso.dll.#6439",
  4358. "mso.dll.#6859",
  4359. "mso.dll.#5188",
  4360. "mso.dll.#9736",
  4361. "mso.dll.#7736",
  4362. "mso.dll.#6394",
  4363. "mso.dll.#9234",
  4364. "mso.dll.#3001",
  4365. "mso.dll.#379",
  4366. "mso.dll.#6184",
  4367. "gdi32.dll.EnumFontFamiliesExW",
  4368. "mso.dll.#7639",
  4369. "mso.dll.#2271",
  4370. "mso.dll.#5377",
  4371. "mso.dll.#5686",
  4372. "mso.dll.#8400",
  4373. "mso.dll.#7361",
  4374. "mso.dll.#248",
  4375. "mso.dll.#8985",
  4376. "mso.dll.#4450",
  4377. "mso.dll.#3276",
  4378. "mso.dll.#4020",
  4379. "gdi32.dll.GetTextCharsetInfo",
  4380. "user32.dll.IsIconic",
  4381. "user32.dll.GetClientRect",
  4382. "user32.dll.EqualRect",
  4383. "mso.dll.#7883",
  4384. "mso.dll.#7955",
  4385. "mso.dll.#6482",
  4386. "mso.dll.#4067",
  4387. "user32.dll.ClientToScreen",
  4388. "imm32.dll.ImmAssociateContext",
  4389. "imm32.dll.ImmConfigureIMEA",
  4390. "imm32.dll.ImmCreateContext",
  4391. "imm32.dll.ImmDestroyContext",
  4392. "imm32.dll.ImmEscapeA",
  4393. "imm32.dll.ImmGetCandidateWindow",
  4394. "imm32.dll.ImmGetCompositionFontA",
  4395. "imm32.dll.ImmGetCompositionStringA",
  4396. "imm32.dll.ImmGetCompositionWindow",
  4397. "imm32.dll.ImmGetContext",
  4398. "imm32.dll.ImmGetConversionStatus",
  4399. "imm32.dll.ImmGetDefaultIMEWnd",
  4400. "imm32.dll.ImmGetDescriptionA",
  4401. "imm32.dll.ImmGetIMEFileNameA",
  4402. "imm32.dll.ImmGetOpenStatus",
  4403. "imm32.dll.ImmGetProperty",
  4404. "imm32.dll.ImmGetVirtualKey",
  4405. "imm32.dll.ImmIsIME",
  4406. "imm32.dll.ImmIsUIMessageA",
  4407. "imm32.dll.ImmNotifyIME",
  4408. "imm32.dll.ImmRegisterWordA",
  4409. "imm32.dll.ImmReleaseContext",
  4410. "imm32.dll.ImmSetCandidateWindow",
  4411. "imm32.dll.ImmSetCompositionFontA",
  4412. "imm32.dll.ImmSetCompositionStringA",
  4413. "imm32.dll.ImmSetCompositionWindow",
  4414. "imm32.dll.ImmSetConversionStatus",
  4415. "imm32.dll.ImmSetOpenStatus",
  4416. "imm32.dll.ImmSetStatusWindowPos",
  4417. "imm32.dll.ImmConfigureIMEW",
  4418. "imm32.dll.ImmEscapeW",
  4419. "imm32.dll.ImmGetCompositionFontW",
  4420. "imm32.dll.ImmGetCompositionStringW",
  4421. "imm32.dll.ImmGetDescriptionW",
  4422. "imm32.dll.ImmGetIMEFileNameW",
  4423. "imm32.dll.ImmIsUIMessageW",
  4424. "imm32.dll.ImmRegisterWordW",
  4425. "imm32.dll.ImmSetCompositionFontW",
  4426. "imm32.dll.ImmSetCompositionStringW",
  4427. "user32.dll.SetClassLongW",
  4428. "user32.dll.LoadBitmapA",
  4429. "gdi32.dll.GetObjectA",
  4430. "ws2_32.dll.WSASocketW",
  4431. "ws2_32.dll.#2",
  4432. "ws2_32.dll.#21",
  4433. "ws2_32.dll.#9",
  4434. "user32.dll.CallWindowProcW",
  4435. "ws2_32.dll.FreeAddrInfoW",
  4436. "user32.dll.GetParent",
  4437. "mso.dll.#8841",
  4438. "mso.dll.#682",
  4439. "mso.dll.#490",
  4440. "mso.dll.#9071",
  4441. "mso.dll.#7595",
  4442. "user32.dll.GetKeyboardState",
  4443. "user32.dll.SetWindowsHookExA",
  4444. "mso.dll.#6660",
  4445. "mso.dll.#5013",
  4446. "mso.dll.#1075",
  4447. "mso.dll.#2157",
  4448. "mso.dll.#888",
  4449. "mso.dll.#5472",
  4450. "mso.dll.#5863",
  4451. "shell32.dll.SHGetDesktopFolder",
  4452. "version.dll.GetFileVersionInfoSizeA",
  4453. "version.dll.GetFileVersionInfoA",
  4454. "version.dll.VerQueryValueA",
  4455. "advapi32.dll.RegEnumKeyA",
  4456. "shell32.dll.SHGetSpecialFolderLocation",
  4457. "shell32.dll.#25",
  4458. "shell32.dll.#16",
  4459. "shell32.dll.#152",
  4460. "shell32.dll.#18",
  4461. "ws2_32.dll.#6",
  4462. "ws2_32.dll.#5",
  4463. "schannel.dll.SpUserModeInitialize",
  4464. "ws2_32.dll.WSASend",
  4465. "ws2_32.dll.WSARecv",
  4466. "shell32.dll.#17",
  4467. "mso.dll.#94",
  4468. "mso.dll.#3260",
  4469. "mso.dll.#8369",
  4470. "mso.dll.#2766",
  4471. "mso.dll.#5892",
  4472. "mso.dll.#826",
  4473. "mso.dll.#3047",
  4474. "mso.dll.#4179",
  4475. "mso.dll.#2011",
  4476. "mso.dll.#6664",
  4477. "mso.dll.#8007",
  4478. "mso.dll.#2637",
  4479. "mso.dll.#2938",
  4480. "msi.dll.#82",
  4481. "mso.dll.#7488",
  4482. "mso.dll.#2824",
  4483. "mso.dll.#1176",
  4484. "mso.dll.#5965",
  4485. "mso.dll.#5087",
  4486. "mso.dll.#7974",
  4487. "mso.dll.#469",
  4488. "mso.dll.#2609",
  4489. "mso.dll.#6452",
  4490. "mso.dll.#1774",
  4491. "mso.dll.#4872",
  4492. "mso.dll.#4653",
  4493. "mso.dll.#6873",
  4494. "mso.dll.#3834",
  4495. "mso.dll.#7825",
  4496. "mso.dll.#1242",
  4497. "mso.dll.#4239",
  4498. "mso.dll.#4575",
  4499. "mso.dll.#2231",
  4500. "mso.dll.#332",
  4501. "mso.dll.#1953",
  4502. "mso.dll.#1499",
  4503. "mso.dll.#3449",
  4504. "mso.dll.#6468",
  4505. "mso.dll.#3820",
  4506. "mso.dll.#153",
  4507. "mso.dll.#2031",
  4508. "mso.dll.#6598",
  4509. "mso.dll.#3320",
  4510. "mso.dll.#1747",
  4511. "mso.dll.#4413",
  4512. "mso.dll.#3972",
  4513. "mso.dll.#7849",
  4514. "mso.dll.#10",
  4515. "mso.dll.#9031",
  4516. "mso.dll.#4562",
  4517. "mso.dll.#5767",
  4518. "mso.dll.#1780",
  4519. "mso.dll.#6949",
  4520. "mso.dll.#5457",
  4521. "mso.dll.#1454",
  4522. "mso.dll.#531",
  4523. "mso.dll.#5986",
  4524. "mso.dll.#6767",
  4525. "mso.dll.#5810",
  4526. "mso.dll.#8020",
  4527. "mso.dll.#6427",
  4528. "mso.dll.#7857",
  4529. "mso.dll.#1209",
  4530. "mso.dll.#792",
  4531. "mso.dll.#6491",
  4532. "mso.dll.#6759",
  4533. "mso.dll.#5061",
  4534. "mso.dll.#4153",
  4535. "mso.dll.#3084",
  4536. "mso.dll.#1281",
  4537. "mso.dll.#782",
  4538. "mso.dll.#1864",
  4539. "mso.dll.#2933",
  4540. "shell32.dll.SHGetSpecialFolderPathW",
  4541. "secur32.dll.FreeContextBuffer",
  4542. "ncrypt.dll.SslOpenProvider",
  4543. "ncrypt.dll.GetSChannelInterface",
  4544. "bcryptprimitives.dll.GetHashInterface",
  4545. "ncrypt.dll.SslIncrementProviderReferenceCount",
  4546. "ncrypt.dll.SslImportKey",
  4547. "bcryptprimitives.dll.GetCipherInterface",
  4548. "ncrypt.dll.SslLookupCipherSuiteInfo",
  4549. "user32.dll.LoadStringW",
  4550. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  4551. "ncrypt.dll.BCryptGetProperty",
  4552. "ncrypt.dll.BCryptCreateHash",
  4553. "ncrypt.dll.BCryptHashData",
  4554. "ncrypt.dll.BCryptFinishHash",
  4555. "ncrypt.dll.BCryptDestroyHash",
  4556. "crypt32.dll.CertGetCertificateChain",
  4557. "userenv.dll.GetUserProfileDirectoryW",
  4558. "sechost.dll.ConvertStringSidToSidW",
  4559. "userenv.dll.RegisterGPNotification",
  4560. "gpapi.dll.RegisterGPNotificationInternal",
  4561. "sechost.dll.OpenSCManagerW",
  4562. "sechost.dll.OpenServiceW",
  4563. "sechost.dll.CloseServiceHandle",
  4564. "sechost.dll.QueryServiceConfigW",
  4565. "mso.dll.#8053",
  4566. "user32.dll.GetCursorPos",
  4567. "user32.dll.WindowFromPoint",
  4568. "user32.dll.ScreenToClient",
  4569. "mso.dll.#1338",
  4570. "advapi32.dll.RegDeleteValueA",
  4571. "mso.dll.#3023",
  4572. "mso.dll.#2013",
  4573. "user32.dll.BeginDeferWindowPos",
  4574. "user32.dll.SetParent",
  4575. "user32.dll.SetWindowTextA",
  4576. "user32.dll.DeferWindowPos",
  4577. "user32.dll.EndDeferWindowPos",
  4578. "user32.dll.RedrawWindow",
  4579. "user32.dll.SetRectEmpty",
  4580. "cryptsp.dll.CryptAcquireContextA",
  4581. "cryptsp.dll.CryptCreateHash",
  4582. "cryptsp.dll.CryptHashData",
  4583. "cryptsp.dll.CryptVerifySignatureA",
  4584. "cryptsp.dll.CryptDestroyKey",
  4585. "cryptsp.dll.CryptDestroyHash",
  4586. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  4587. "ncrypt.dll.BCryptImportKeyPair",
  4588. "ncrypt.dll.BCryptVerifySignature",
  4589. "ncrypt.dll.BCryptDestroyKey",
  4590. "crypt32.dll.CertVerifyCertificateChainPolicy",
  4591. "crypt32.dll.CertFreeCertificateChain",
  4592. "crypt32.dll.CertDuplicateCertificateContext",
  4593. "ncrypt.dll.SslEncryptPacket",
  4594. "mso.dll.#4920",
  4595. "mso.dll.#9657",
  4596. "mso.dll.#1777",
  4597. "mso.dll.#7758",
  4598. "mso.dll.#7037",
  4599. "mso.dll.#6983",
  4600. "mso.dll.#2819",
  4601. "mso.dll.#5745",
  4602. "mso.dll.#4902",
  4603. "mso.dll.#9591",
  4604. "mso.dll.#7299",
  4605. "mso.dll.#6964",
  4606. "mso.dll.#5031",
  4607. "mso.dll.#4769",
  4608. "mso.dll.#4002",
  4609. "mso.dll.#2567",
  4610. "mso.dll.#7796",
  4611. "mso.dll.#8733",
  4612. "mso.dll.#6351",
  4613. "mso.dll.#5432",
  4614. "mso.dll.#3429",
  4615. "mso.dll.#9587",
  4616. "mso.dll.#7416",
  4617. "mso.dll.#8547",
  4618. "mso.dll.#7536",
  4619. "mso.dll.#8593",
  4620. "mso.dll.#8176",
  4621. "mso.dll.#9296",
  4622. "mso.dll.#4114",
  4623. "mso.dll.#6401",
  4624. "mso.dll.#1153",
  4625. "mso.dll.#3222",
  4626. "mso.dll.#4184",
  4627. "mso.dll.#3705",
  4628. "mso.dll.#2286",
  4629. "mso.dll.#8392",
  4630. "mso.dll.#6313",
  4631. "mso.dll.#5607",
  4632. "mso.dll.#4447",
  4633. "mso.dll.#7523",
  4634. "mso.dll.#5383",
  4635. "mso.dll.#4770",
  4636. "mso.dll.#7745",
  4637. "mso.dll.#4881",
  4638. "mso.dll.#6257",
  4639. "mso.dll.#5248",
  4640. "mso.dll.#8967",
  4641. "mso.dll.#4402",
  4642. "mso.dll.#9824",
  4643. "mso.dll.#8750",
  4644. "mso.dll.#2827",
  4645. "user32.dll.GetKeyState",
  4646. "mso.dll.#1164",
  4647. "mso.dll.#2631",
  4648. "mso.dll.#6097",
  4649. "mso.dll.#9055",
  4650. "mso.dll.#8194",
  4651. "mso.dll.#8628",
  4652. "mso.dll.#7522",
  4653. "mso.dll.#7937",
  4654. "mso.dll.#6697",
  4655. "mso.dll.#5834",
  4656. "mso.dll.#7453",
  4657. "mso.dll.#9693",
  4658. "mso.dll.#1159",
  4659. "mso.dll.#8782",
  4660. "mso.dll.#7720",
  4661. "mso.dll.#4062",
  4662. "mso.dll.#8339",
  4663. "mso.dll.#4492",
  4664. "mso.dll.#571",
  4665. "mso.dll.#8916",
  4666. "mso.dll.#752",
  4667. "mso.dll.#1572",
  4668. "mso.dll.#171",
  4669. "mso.dll.#718",
  4670. "mso.dll.#6220",
  4671. "mso.dll.#1745",
  4672. "user32.dll.MapWindowPoints",
  4673. "user32.dll.CharUpperW",
  4674. "gdi32.dll.SetMapMode",
  4675. "gdi32.dll.CreateDIBitmap",
  4676. "user32.dll.GetMessageTime",
  4677. "user32.dll.AdjustWindowRectEx",
  4678. "user32.dll.IsZoomed",
  4679. "mso.dll.#6216",
  4680. "mso.dll.#5405",
  4681. "mso.dll.#8301",
  4682. "user32.dll.IsChild",
  4683. "user32.dll.BringWindowToTop",
  4684. "mso.dll.#8573",
  4685. "mso.dll.#8117",
  4686. "mso.dll.#7904",
  4687. "user32.dll.ChangeWindowMessageFilterEx",
  4688. "mso.dll.#5600",
  4689. "mso.dll.#5496",
  4690. "user32.dll.SetFocus",
  4691. "mso.dll.#6443",
  4692. "user32.dll.SetForegroundWindow",
  4693. "mso.dll.#8831",
  4694. "mso.dll.#1512",
  4695. "mso.dll.#1491",
  4696. "mso.dll.#6192",
  4697. "mso.dll.#893",
  4698. "advapi32.dll.AllocateAndInitializeSid",
  4699. "advapi32.dll.FreeSid",
  4700. "mso.dll.#8756",
  4701. "mso.dll.#3059",
  4702. "mso.dll.#9829",
  4703. "mso.dll.#2861",
  4704. "mso.dll.#1719",
  4705. "mso.dll.#2474",
  4706. "mso.dll.#4763",
  4707. "mso.dll.#986",
  4708. "mso.dll.#466",
  4709. "mso.dll.#4572",
  4710. "mso.dll.#6031",
  4711. "mso.dll.#886",
  4712. "mso.dll.#2279",
  4713. "mso.dll.#7826",
  4714. "mso.dll.#971",
  4715. "mso.dll.#9218",
  4716. "mso.dll.#9342",
  4717. "mso.dll.#1443",
  4718. "mso.dll.#9214",
  4719. "mso.dll.#199",
  4720. "mso.dll.#1073",
  4721. "mso.dll.#4255",
  4722. "mso.dll.#3459",
  4723. "ncrypt.dll.SslDecryptPacket",
  4724. "winhttp.dll.WinHttpReceiveResponse",
  4725. "winhttp.dll.WinHttpQueryHeaders",
  4726. "winhttp.dll.WinHttpQueryDataAvailable",
  4727. "winhttp.dll.WinHttpReadData",
  4728. "mso.dll.#5709",
  4729. "webservices.dll.WsCreateError",
  4730. "ntdll.dll.EtwEventWrite",
  4731. "ntdll.dll.EtwEventRegister",
  4732. "ntdll.dll.EtwEventUnregister",
  4733. "webservices.dll.WsCreateHeap",
  4734. "webservices.dll.WsCreateReader",
  4735. "webservices.dll.WsSetInput",
  4736. "webservices.dll.WsFillReader",
  4737. "webservices.dll.WsReadToStartElement",
  4738. "webservices.dll.WsReadStartElement",
  4739. "webservices.dll.WsReadType",
  4740. "winhttp.dll.WinHttpCloseHandle",
  4741. "crypt32.dll.CertFreeCertificateContext",
  4742. "webservices.dll.WsFreeReader",
  4743. "webservices.dll.WsFreeError",
  4744. "webservices.dll.WsFreeHeap",
  4745. "webservices.dll.WsCreateServiceProxyFromTemplate",
  4746. "mso.dll.#8880",
  4747. "winhttp.dll.WinHttpCrackUrl",
  4748. "winhttp.dll.WinHttpWriteData",
  4749. "winhttp.dll.WinHttpSetCredentials",
  4750. "winhttp.dll.WinHttpQueryAuthSchemes",
  4751. "winhttp.dll.WinHttpGetProxyForUrl",
  4752. "winhttp.dll.WinHttpQueryOption",
  4753. "webservices.dll.WsOpenServiceProxy",
  4754. "webservices.dll.WsCall",
  4755. "mso.dll.#9061",
  4756. "webservices.dll.WsAddCustomHeader",
  4757. "shlwapi.dll.StrStrA",
  4758. "shlwapi.dll.UrlUnescapeA",
  4759. "mso.dll.#408",
  4760. "mso.dll.#2714",
  4761. "mso.dll.#8622",
  4762. "mso.dll.#3380",
  4763. "mso.dll.#9378",
  4764. "mso.dll.#7567",
  4765. "mso.dll.#2052",
  4766. "uiautomationcore.dll.UiaClientsAreListening",
  4767. "mso.dll.#7261",
  4768. "mso.dll.#9540",
  4769. "usp10.dll.ScriptGetFontScriptTags",
  4770. "usp10.dll.ScriptGetFontLanguageTags",
  4771. "usp10.dll.ScriptGetFontFeatureTags",
  4772. "mso.dll.#78",
  4773. "mso.dll.#5307",
  4774. "mso.dll.#8647",
  4775. "mso.dll.#387",
  4776. "mso.dll.#9232",
  4777. "mso.dll.#8892",
  4778. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  4779. "bcrypt.dll.BCryptGetProperty",
  4780. "bcrypt.dll.BCryptCreateHash",
  4781. "bcrypt.dll.BCryptHashData",
  4782. "bcrypt.dll.BCryptFinishHash",
  4783. "bcrypt.dll.BCryptDestroyHash",
  4784. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  4785. "mso.dll.#6030",
  4786. "mso.dll.#2935",
  4787. "mso.dll.#4791",
  4788. "mso.dll.#8085",
  4789. "mso.dll.#7915",
  4790. "mso.dll.#9175",
  4791. "mso.dll.#9229",
  4792. "mso.dll.#978",
  4793. "mso.dll.#6493",
  4794. "mso.dll.#8931",
  4795. "shell32.dll.SHGetFileInfoW",
  4796. "mso.dll.#5362",
  4797. "mso.dll.#6044",
  4798. "mso.dll.#6516",
  4799. "mso.dll.#6221",
  4800. "mso.dll.#5780",
  4801. "mso.dll.#4870",
  4802. "mso.dll.#6046",
  4803. "mso.dll.#1540",
  4804. "mso.dll.#1814",
  4805. "mso.dll.#6724",
  4806. "mso.dll.#3224",
  4807. "mso.dll.#5337",
  4808. "mso.dll.#3411",
  4809. "mso.dll.#1241",
  4810. "mso.dll.#2821",
  4811. "mso.dll.#2340",
  4812. "mso.dll.#7287",
  4813. "mso.dll.#5290",
  4814. "mso.dll.#1508",
  4815. "mso.dll.#821",
  4816. "mso.dll.#2378",
  4817. "user32.dll.AdjustWindowRect",
  4818. "mso.dll.#5912",
  4819. "mso.dll.#9719",
  4820. "mso.dll.#8824",
  4821. "mso.dll.#6117",
  4822. "mso.dll.#3307",
  4823. "user32.dll.DestroyIcon",
  4824. "mso.dll.#3813",
  4825. "mso.dll.#1815",
  4826. "user32.dll.PtInRect",
  4827. "mso.dll.#1613",
  4828. "user32.dll.SetWindowTextW",
  4829. "gdi32.dll.GetFontRealizationInfo",
  4830. "gdi32.dll.GetFontFileInfo",
  4831. "gdi32.dll.GetFontFileData",
  4832. "mso.dll.#8572",
  4833. "gdi32.dll.GetViewportOrgEx",
  4834. "gdi32.dll.SetViewportOrgEx",
  4835. "gdi32.dll.SetBkColor",
  4836. "gdi32.dll.ExtTextOutA",
  4837. "mso.dll.#1573",
  4838. "mso.dll.#8612",
  4839. "user32.dll.SetScrollRange",
  4840. "mso.dll.#2509",
  4841. "user32.dll.EnumChildWindows",
  4842. "user32.dll.GetScrollInfo",
  4843. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  4844. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  4845. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  4846. "mso.dll.#6126",
  4847. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  4848. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  4849. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  4850. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  4851. "msptls.dll.?FsAllocMemory@Ptls6@@YGJPAUfscontext@1@JPAPAX@Z",
  4852. "mso.dll.#8693",
  4853. "msptls.dll.?LsGetMinMaxDurUntilHardBreak@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@HPAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@PAJ888@Z",
  4854. "mso.dll.#6330",
  4855. "mso.dll.#832",
  4856. "mso.dll.#7047",
  4857. "mso.dll.#7847",
  4858. "msptls.dll.?FsGetOldParaToReuseFromFmtState@Ptls6@@YGJPAUfspagefmtstate@1@PAPAUfspara@1@@Z",
  4859. "msptls.dll.?FsGetNewParaToReuseFromFmtState@Ptls6@@YGJPAUfspagefmtstate@1@PAPAUfspara@1@@Z",
  4860. "msptls.dll.?FsSetOldParaToReuseIntoFmtState@Ptls6@@YGJPAUfspagefmtstate@1@PAUfspara@1@@Z",
  4861. "msptls.dll.?FsSetNewParaToReuseIntoFmtState@Ptls6@@YGJPAUfspagefmtstate@1@PAUfspara@1@@Z",
  4862. "msptls.dll.?FsCreateSubpage@Ptls6@@YGJPAUfscontext@1@PAUfspagefmtstate@1@PBUfsbreakrecsubpage@1@HPBUfsfmtsubpagein@1@PAPAUfssubpage@1@PAUfsfmtout@1@PAU_fsfmtr@1@PAPAU41@PAPAUfsmcsclient@1@@Z",
  4863. "msptls.dll.?FsGetOutOfFlowDvrSubpage@Ptls6@@YGJPAUfscontext@1@PBUfssubpage@1@PAKPAJ@Z",
  4864. "msptls.dll.?FsDestroyMemory@Ptls6@@YGXPAUfscontext@1@PAX@Z",
  4865. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  4866. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  4867. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  4868. "msptls.dll.?FsQuerySectionBasicColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfstrackdescription@1@PAJ@Z",
  4869. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  4870. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  4871. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  4872. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  4873. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  4874. "msptls.dll.?FsQueryAttachedObjectList@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfsattachedobjectdescription@1@PAJ@Z",
  4875. "msptls.dll.?FsQueryFigureObjectDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfsfiguredetails@1@@Z",
  4876. "msptls.dll.?FsQueryTableObjDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstableobjdetails@1@@Z",
  4877. "msptls.dll.?FsQueryTableObjTableProperDetails@Ptls6@@YGJPAUfscontext@1@PBUfstable@1@PAUfstabledetails@1@@Z",
  4878. "msptls.dll.?FsQueryTableObjRowList@Ptls6@@YGJPAUfscontext@1@PBUfstable@1@JPAUfstablerowdescription@1@PAJ@Z",
  4879. "msptls.dll.?FsQueryTableObjRowDetails@Ptls6@@YGJPAUfscontext@1@PBUfstablerow@1@PAUfstablerowdetails@1@@Z",
  4880. "msptls.dll.?FsQueryTableObjCellList@Ptls6@@YGJPAUfscontext@1@PBUfstablerow@1@JPAW4_fskupdate@1@PAPAUfstablecell@1@PAW4fstablekcellmerge@1@PAJ@Z",
  4881. "msptls.dll.?FsJustifySubpage@Ptls6@@YGJPAUfscontext@1@PAUfssubpage@1@JHW4fskalignpage@1@H@Z",
  4882. "msptls.dll.?FsQuerySubpageDetails@Ptls6@@YGJPAUfscontext@1@PBUfssubpage@1@PAUfssubpagedetails@1@@Z",
  4883. "msptls.dll.?FsQuerySubpageBasicColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssubpage@1@JPAUfstrackdescription@1@PAJ@Z",
  4884. "msptls.dll.?FsQueryTableObjFigureCountWord@Ptls6@@YGJPBUfspara@1@PAJ@Z",
  4885. "msptls.dll.?FsDuplicatePageBreakRecord@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAPAU31@@Z",
  4886. "msptls.dll.?FsDestroyPageBreakRecord@Ptls6@@YGJPAUfscontext@1@PAUfsbreakrecpage@1@@Z",
  4887. "mso.dll.#2566",
  4888. "mso.dll.#1429",
  4889. "mso.dll.#6502",
  4890. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  4891. "msptls.dll.?LsGetObjectName@Ptls6@@YG?AVLSNAMEEXP@1@PBVCLsDnode@1@@Z",
  4892. "msptls.dll.?LsdnFinishWordRegular@Ptls6@@YGJPAVCLsDnode@1@JPAUlsrun@1@PBUlschp@1@PAVCLsObject@1@PBUOBJDIM@1@HHH@Z",
  4893. "msptls.dll.?LsdnSetRigidDup@Ptls6@@YGJPAVCLsDnode@1@J@Z",
  4894. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  4895. "user32.dll.InflateRect",
  4896. "mso.dll.#1100",
  4897. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  4898. "user32.dll.GetCursor",
  4899. "mso.dll.#749",
  4900. "user32.dll.SetScrollInfo",
  4901. "user32.dll.SetScrollPos",
  4902. "mso.dll.#3747",
  4903. "cryptnet.dll.CertDllVerifyRevocation",
  4904. "mso.dll.#8218",
  4905. "mso.dll.#5394",
  4906. "mso.dll.#331",
  4907. "mso.dll.#6829",
  4908. "mso.dll.#539",
  4909. "mso.dll.#4959",
  4910. "mso.dll.#6463",
  4911. "mso.dll.#4987",
  4912. "user32.dll.GetWindow",
  4913. "mso.dll.#7195",
  4914. "mso.dll.#7573",
  4915. "mso.dll.#445",
  4916. "user32.dll.GetCaretBlinkTime",
  4917. "user32.dll.CreateCaret",
  4918. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  4919. "user32.dll.DestroyCaret",
  4920. "user32.dll.GetCaretPos",
  4921. "user32.dll.SetCaretPos",
  4922. "mso.dll.#5932",
  4923. "mso.dll.#2071",
  4924. "mso.dll.#1024",
  4925. "mso.dll.#6245",
  4926. "mso.dll.#9041",
  4927. "mso.dll.#1767",
  4928. "mso.dll.#9369",
  4929. "mso.dll.#4617",
  4930. "user32.dll.FillRect",
  4931. "mso.dll.#343",
  4932. "mso.dll.#9636",
  4933. "mso.dll.#2022",
  4934. "mso.dll.#4750",
  4935. "mso.dll.#1262",
  4936. "mso.dll.#4577",
  4937. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  4938. "mso.dll.#850",
  4939. "mso.dll.#1776",
  4940. "mso.dll.#9026",
  4941. "mso.dll.#4497",
  4942. "mso.dll.#8926",
  4943. "mso.dll.#7212",
  4944. "mso.dll.#5407",
  4945. "shell32.dll.SHAddToRecentDocs",
  4946. "mso.dll.#5152",
  4947. "mso.dll.#3327",
  4948. "mso.dll.#6333",
  4949. "mso.dll.#420",
  4950. "mso.dll.#1335",
  4951. "mso.dll.#2041",
  4952. "mso.dll.#7834",
  4953. "mso.dll.#239",
  4954. "mso.dll.#6357",
  4955. "mso.dll.#7026",
  4956. "mso.dll.#1671",
  4957. "mso.dll.#8263",
  4958. "winhttp.dll.WinHttpTimeFromSystemTime",
  4959. "mso.dll.#9307",
  4960. "mso.dll.#1441",
  4961. "mso.dll.#9223",
  4962. "mso.dll.#6453",
  4963. "mso.dll.#3698",
  4964. "mso.dll.#8565",
  4965. "mso.dll.#8373",
  4966. "mso.dll.#9741",
  4967. "mso.dll.#478",
  4968. "mso.dll.#479",
  4969. "mso.dll.#8633",
  4970. "mso.dll.#5213",
  4971. "mso.dll.#6163",
  4972. "mso.dll.#552",
  4973. "mso.dll.#5630",
  4974. "mso.dll.#2513",
  4975. "mso.dll.#1607",
  4976. "mso.dll.#791",
  4977. "mso.dll.#1848",
  4978. "mso.dll.#8735",
  4979. "mso.dll.#9374",
  4980. "ole32.dll.CoGetCallState",
  4981. "ole32.dll.CoGetActivationState",
  4982. "advapi32.dll.RegisterWaitChainCOMCallback",
  4983. "mso.dll.#5286",
  4984. "mso.dll.#6368",
  4985. "mso.dll.#4262",
  4986. "mso.dll.#1010",
  4987. "mso.dll.#7979",
  4988. "mso.dll.#8549",
  4989. "mso.dll.#8970",
  4990. "mso.dll.#9198",
  4991. "mso.dll.#4795",
  4992. "mso.dll.#1865",
  4993. "mso.dll.#9688",
  4994. "mso.dll.#320",
  4995. "advapi32.dll.RegDeleteKeyA",
  4996. "user32.dll.DestroyCursor",
  4997. "mso.dll.#7173",
  4998. "mso.dll.#8511",
  4999. "mso.dll.#3299",
  5000. "mso.dll.#7001",
  5001. "mso.dll.#8140",
  5002. "mso.dll.#3913",
  5003. "user32.dll.PeekMessageA",
  5004. "mso.dll.#1380",
  5005. "mso.dll.#9500",
  5006. "user32.dll.DispatchMessageA",
  5007. "mso.dll.#999",
  5008. "mso.dll.#287",
  5009. "mso.dll.#1575",
  5010. "user32.dll.OpenClipboard",
  5011. "user32.dll.IsClipboardFormatAvailable",
  5012. "user32.dll.CloseClipboard",
  5013. "mso.dll.#1517",
  5014. "mso.dll.#8046",
  5015. "mso.dll.#4175",
  5016. "mso.dll.#8672",
  5017. "mso.dll.#1990",
  5018. "mso.dll.#3051",
  5019. "mso.dll.#1819",
  5020. "mso.dll.#1419",
  5021. "gdi32.dll.GetCurrentObject",
  5022. "gdi32.dll.BitBlt",
  5023. "gdi32.dll.StretchDIBits",
  5024. "user32.dll.RegisterClipboardFormatW",
  5025. "user32.dll.SetCaretBlinkTime",
  5026. "mso.dll._MsoGetFidUspDll@0",
  5027. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  5028. "usp10.dll.ScriptGetProperties",
  5029. "usp10.dll.ScriptItemize",
  5030. "uxtheme.dll.OpenThemeData",
  5031. "usp10.dll.ScriptGetCMap",
  5032. "user32.dll.HideCaret",
  5033. "user32.dll.ShowCaret",
  5034. "user32.dll.GetWindowTextLengthW",
  5035. "user32.dll.EnableWindow",
  5036. "msctf.dll.SetInputScope",
  5037. "user32.dll.GetWindowRgn",
  5038. "gdi32.dll.CreateCompatibleBitmap",
  5039. "gdi32.dll.SaveDC",
  5040. "gdi32.dll.SetPixel",
  5041. "gdi32.dll.GetPixel",
  5042. "gdi32.dll.RestoreDC",
  5043. "mso.dll.#806",
  5044. "mso.dll.#4908",
  5045. "mso.dll.#8439",
  5046. "mso.dll.#2736",
  5047. "gdi32.dll.GetTextAlign",
  5048. "mso.dll.#8122",
  5049. "mso.dll.#2114",
  5050. "user32.dll.GetClassNameA",
  5051. "user32.dll.IsWindowRedirectedForPrint",
  5052. "gdi32.dll.CreateRectRgnIndirect",
  5053. "user32.dll.GetUpdateRgn",
  5054. "gdi32.dll.GetRgnBox",
  5055. "user32.dll.GetUpdateRect",
  5056. "mso.dll.#3624",
  5057. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  5058. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  5059. "gdi32.dll.TranslateCharsetInfo",
  5060. "gdi32.dll.GetFontData",
  5061. "mso.dll.#3300",
  5062. "mso.dll.#7465",
  5063. "mso.dll.#6247",
  5064. "msptls.dll.?LsLwMultDivR@Ptls6@@YGJJJJ@Z",
  5065. "mso.dll.#1911",
  5066. "winmm.dll.timeGetTime",
  5067. "mso.dll.#8802",
  5068. "gdi32.dll.SetWindowOrgEx",
  5069. "user32.dll.AttachThreadInput",
  5070. "user32.dll.UnregisterClassW",
  5071. "mso.dll.#732",
  5072. "mso.dll.#5804",
  5073. "mso.dll.#2155",
  5074. "mso.dll.#434",
  5075. "user32.dll.GetMessageExtraInfo",
  5076. "user32.dll.TrackMouseEvent",
  5077. "user32.dll.GetInputState",
  5078. "mso.dll.#6960",
  5079. "mso.dll.#8705",
  5080. "mso.dll.#7892",
  5081. "msi.dll.#39",
  5082. "msi.dll.#111",
  5083. "mso.dll.#7931",
  5084. "mso.dll.#3837",
  5085. "mso.dll.#8574",
  5086. "mso.dll.#8398",
  5087. "mso.dll.#2477",
  5088. "msproof7.dll.DllGetClassObject",
  5089. "msproof7.dll.DllCanUnloadNow",
  5090. "mso.dll.#4172",
  5091. "mso.dll.#1439",
  5092. "user32.dll.GetWindowDC",
  5093. "gdi32.dll.SetLayout",
  5094. "gdi32.dll.RectVisible",
  5095. "gdi32.dll.GetClipRgn",
  5096. "gdi32.dll.ExcludeClipRect",
  5097. "user32.dll.GetCursorInfo",
  5098. "user32.dll.GetCapture",
  5099. "user32.dll.GetMessagePos",
  5100. "user32.dll.GetDesktopWindow",
  5101. "user32.dll.FindWindowExW",
  5102. "mso.dll.#4746",
  5103. "msptls.dll.?LsPointUV2FromPointUV1@Ptls6@@YGJKPBUtagLSPOINTUV@1@0KPAU21@@Z",
  5104. "msptls.dll.?LsQueryLinePointPcp@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINTUV@1@JPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  5105. "mso.dll.#9528",
  5106. "mso.dll.#5341",
  5107. "mso.dll.#3775",
  5108. "mso.dll.#3608",
  5109. "mso.dll.#8461",
  5110. "user32.dll.GetClipboardOwner",
  5111. "user32.dll.SendNotifyMessageW",
  5112. "mso.dll.#3544",
  5113. "mso.dll.#900",
  5114. "mso.dll.#1422",
  5115. "user32.dll.MsgWaitForMultipleObjectsEx",
  5116. "mso.dll.#8662",
  5117. "mso.dll.#4281",
  5118. "msptls.dll.?FsUpdateFinitePage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@PAUfsupdclient@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAU51@@Z",
  5119. "advapi32.dll.NotifyServiceStatusChangeW",
  5120. "shlwapi.dll.StrStrIW",
  5121. "mso.dll.#1957",
  5122. "gdiplus.dll.GdipCreateBitmapFromHBITMAP",
  5123. "gdiplus.dll.GdipGetImageHeight",
  5124. "gdiplus.dll.GdipGetImageWidth",
  5125. "gdiplus.dll.GdipBitmapGetPixel",
  5126. "gdi32.dll.SetRectRgn",
  5127. "gdi32.dll.CombineRgn",
  5128. "gdi32.dll.GetRegionData",
  5129. "gdiplus.dll.GdipDisposeImage",
  5130. "gdi32.dll.ExtCreateRegion",
  5131. "mso.dll.#4702",
  5132. "mso.dll.#6813",
  5133. "mso.dll.#8877",
  5134. "mso.dll.#5181",
  5135. "mso.dll.#9432",
  5136. "mso.dll.#975",
  5137. "mso.dll.#76",
  5138. "mso.dll.#3744",
  5139. "mso.dll.#8244",
  5140. "mso.dll.#6021",
  5141. "mso.dll.#628",
  5142. "mso.dll.#7316",
  5143. "mso.dll.#2825",
  5144. "mso.dll.#7242",
  5145. "mso.dll.#6656",
  5146. "mso.dll.#3234",
  5147. "mso.dll.#2323",
  5148. "mso.dll.#50",
  5149. "mso.dll.#8265",
  5150. "mso.dll.#9285",
  5151. "mso.dll.#6619",
  5152. "mso.dll.#1982",
  5153. "mso.dll.#5550",
  5154. "mso.dll.#8689",
  5155. "mso.dll.#3289",
  5156. "mso.dll.#2032",
  5157. "mso.dll.#5773",
  5158. "mso.dll.#9504",
  5159. "mso.dll.#586",
  5160. "mso.dll.#1425",
  5161. "mso.dll.#5732",
  5162. "mso.dll.#4625",
  5163. "mso.dll.#6109",
  5164. "mso.dll.#2992",
  5165. "oleaut32.dll.#193",
  5166. "mso.dll.#6454",
  5167. "mso.dll.#3427",
  5168. "mso.dll.#9161",
  5169. "mso.dll.#8497",
  5170. "mso.dll.#4718",
  5171. "mso.dll.#5016",
  5172. "mso.dll.#7452",
  5173. "mso.dll.#8525",
  5174. "mso.dll.#16",
  5175. "mso.dll.#7178",
  5176. "mso.dll.#2456",
  5177. "mso.dll.#6539",
  5178. "mso.dll.#5227",
  5179. "mso.dll.#9782",
  5180. "mso.dll.#6603",
  5181. "mso.dll.#4000",
  5182. "mso.dll.#2375",
  5183. "mso.dll.#1407",
  5184. "mso.dll.#3079",
  5185. "mso.dll.#4868",
  5186. "mso.dll.#7552",
  5187. "mso.dll.#468",
  5188. "mso.dll.#5492",
  5189. "mso.dll.#8972",
  5190. "mso.dll.#6710",
  5191. "mso.dll.#1062",
  5192. "mso.dll.#1729",
  5193. "mso.dll.#9174",
  5194. "mso.dll.#1202",
  5195. "mso.dll.#3409",
  5196. "mso.dll.#8391",
  5197. "mso.dll.#9713",
  5198. "mso.dll.#74",
  5199. "mso.dll.#5856",
  5200. "mso.dll.#4248",
  5201. "mso.dll.#878",
  5202. "mso.dll.#1555",
  5203. "mso.dll.#6803",
  5204. "mso.dll.#7658",
  5205. "mso.dll.#3704",
  5206. "mso.dll.#7510",
  5207. "mso.dll.#5588",
  5208. "mso.dll.#3771",
  5209. "mso.dll.#7388",
  5210. "mso.dll.#4831",
  5211. "mso.dll.#7537",
  5212. "mso.dll.#3223",
  5213. "mso.dll.#7602",
  5214. "mso.dll.#9057",
  5215. "mso.dll.#1490",
  5216. "mso.dll.#3584",
  5217. "mso.dll.#3081",
  5218. "mso.dll.#7659",
  5219. "mso.dll.#9570",
  5220. "mso.dll.#8707",
  5221. "mso.dll.#7814",
  5222. "mso.dll.#800",
  5223. "mso.dll.#7028",
  5224. "mso.dll.#2360",
  5225. "mso.dll.#4127",
  5226. "mso.dll.#5672",
  5227. "mso.dll.#3548",
  5228. "mso.dll.#4505",
  5229. "mso.dll.#4204",
  5230. "mso.dll.#6884",
  5231. "mso.dll.#8114",
  5232. "mso.dll.#1382",
  5233. "mso.dll.#1390",
  5234. "mso.dll.#4498",
  5235. "mso.dll.#5446",
  5236. "mso.dll.#6017",
  5237. "mso.dll.#3966",
  5238. "mso.dll.#671",
  5239. "mso.dll.#7913",
  5240. "mso.dll.#1672",
  5241. "mso.dll.#1017",
  5242. "mso.dll.#1673",
  5243. "user32.dll.MoveWindow",
  5244. "mso.dll.#2976",
  5245. "mso.dll.#6206",
  5246. "mso.dll.#7281",
  5247. "mso.dll.#9642",
  5248. "mso.dll.#7219",
  5249. "mso.dll.#2625",
  5250. "gdi32.dll.LPtoDP",
  5251. "gdi32.dll.DPtoLP",
  5252. "gdi32.dll.ExtSelectClipRgn",
  5253. "gdi32.dll.GetViewportExtEx",
  5254. "gdi32.dll.GetWindowExtEx",
  5255. "gdi32.dll.GetMapMode",
  5256. "mso.dll.#1205",
  5257. "mso.dll.#4627",
  5258. "mso.dll.#8940",
  5259. "mso.dll.#5171",
  5260. "mso.dll.#2769",
  5261. "mso.dll.#7467",
  5262. "mso.dll.#2020",
  5263. "gdi32.dll.SetStretchBltMode",
  5264. "advapi32.dll.RegDeleteTreeW",
  5265. "xmllite.dll.CreateXmlReader",
  5266. "msptls.dll.?FsDestroySubpage@Ptls6@@YGJPAUfscontext@1@PAUfssubpage@1@@Z",
  5267. "usp10.dll.ScriptFreeCache",
  5268. "cryptnet.dll.I_CryptNetGetConnectivity",
  5269. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  5270. "setupapi.dll.SetupIterateCabinetW",
  5271. "cabinet.dll.#20",
  5272. "cabinet.dll.#22",
  5273. "cryptsp.dll.CryptSetHashParam",
  5274. "sechost.dll.QueryServiceConfigA",
  5275. "sechost.dll.QueryServiceStatus",
  5276. "rpcrt4.dll.RpcStringBindingComposeA",
  5277. "rpcrt4.dll.RpcBindingFromStringBindingA",
  5278. "rpcrt4.dll.RpcEpResolveBinding",
  5279. "rpcrt4.dll.RpcStringFreeA",
  5280. "webservices.dll.WsResetHeap",
  5281. "webservices.dll.WsCloseServiceProxy",
  5282. "ws2_32.dll.#3",
  5283. "webservices.dll.WsFreeServiceProxy",
  5284. "ncrypt.dll.SslDecrementProviderReferenceCount",
  5285. "ncrypt.dll.SslFreeObject",
  5286. "mso.dll.#4314",
  5287. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  5288. "mso.dll.#6484",
  5289. "mso.dll.#8071",
  5290. "mso.dll.#9465",
  5291. "user32.dll.GetScrollPos",
  5292. "mso.dll.#629",
  5293. "mso.dll.#7531",
  5294. "mso.dll.#1725",
  5295. "user32.dll.RegisterPowerSettingNotification",
  5296. "powrprof.dll.PowerSettingRegisterNotification",
  5297. "ieawsdc.dll.HrExtractTemplateToPath",
  5298. "user32.dll.IsHungAppWindow",
  5299. "crypt32.dll.CryptQueryObject",
  5300. "wintrust.dll.CryptSIPPutSignedDataMsg",
  5301. "wintrust.dll.CryptSIPGetSignedDataMsg",
  5302. "cryptsp.dll.CryptGetDefaultProviderW",
  5303. "crypt32.dll.CertEnumCertificatesInStore",
  5304. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  5305. "wintrust.dll.WintrustCertificateTrust",
  5306. "wintrust.dll.SoftpubAuthenticode",
  5307. "wintrust.dll.SoftpubInitialize",
  5308. "wintrust.dll.SoftpubLoadMessage",
  5309. "wintrust.dll.SoftpubLoadSignature",
  5310. "wintrust.dll.SoftpubCheckCert",
  5311. "wintrust.dll.SoftpubCleanup",
  5312. "wintrust.dll.CryptSIPVerifyIndirectData",
  5313. "cryptsp.dll.CryptGetHashParam",
  5314. "advapi32.dll.CryptAcquireContextA",
  5315. "advapi32.dll.CryptGenKey",
  5316. "cryptsp.dll.CryptGenKey",
  5317. "advapi32.dll.CryptImportKey",
  5318. "cryptsp.dll.CryptImportKey",
  5319. "advapi32.dll.CryptExportKey",
  5320. "cryptsp.dll.CryptExportKey",
  5321. "advapi32.dll.CryptDestroyKey",
  5322. "advapi32.dll.SaferiSearchMatchingHashRules",
  5323. "wintrust.dll.WTHelperProvDataFromStateData",
  5324. "wintrust.dll.WTHelperGetProvSignerFromChain",
  5325. "crypt32.dll.CertCloseStore",
  5326. "advapi32.dll.RegDeleteValueW",
  5327. "advapi32.dll.CryptCreateHash",
  5328. "advapi32.dll.CryptSetHashParam",
  5329. "advapi32.dll.CryptHashData",
  5330. "advapi32.dll.CryptGetHashParam",
  5331. "advapi32.dll.CryptDestroyHash",
  5332. "msi.dll.#90",
  5333. "cabinet.dll.#23",
  5334. "mso.dll.#8837",
  5335. "advapi32.dll.ConvertSidToStringSidW",
  5336. "msi.dll.DllGetVersion",
  5337. "mso.dll.#5034",
  5338. "mso.dll.#1455",
  5339. "user32.dll.EnableScrollBar",
  5340. "user32.dll.ShowScrollBar",
  5341. "gdi32.dll.GetTextCharset",
  5342. "oleaut32.dll.SysAllocString",
  5343. "oleaut32.dll.SysStringLen",
  5344. "oleaut32.dll.SysAllocStringLen",
  5345. "uxtheme.dll.GetThemePartSize",
  5346. "user32.dll.GetMessageW",
  5347. "gdi32.dll.SetTextAlign",
  5348. "gdi32.dll.GetTextColor",
  5349. "user32.dll.WaitMessage",
  5350. "wininet.dll.InternetGetConnectedState",
  5351. "osppcext.dll.SLActivateProduct",
  5352. "osppcext.dll.SLGetTokenActivationGrants",
  5353. "osppcext.dll.SLGetTokenActivationCertificates",
  5354. "osppcext.dll.SLGenerateTokenActivationChallenge",
  5355. "osppcext.dll.SLSignTokenActivationChallenge",
  5356. "osppcext.dll.SLDepositTokenActivationResponse",
  5357. "osppcext.dll.SLFreeTokenActivationGrants",
  5358. "osppcext.dll.SLFreeTokenActivationCertificates",
  5359. "mso.dll.#1885",
  5360. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  5361. "mso.dll.#4029",
  5362. "mso.dll.#2001",
  5363. "mso.dll.#5170",
  5364. "mso.dll.#8833",
  5365. "mso.dll.#1977",
  5366. "mso.dll.#1912",
  5367. "mso.dll.#6535",
  5368. "mso.dll.#640",
  5369. "mso.dll.#9146",
  5370. "mso.dll.#4133",
  5371. "mso.dll.#8372",
  5372. "user32.dll.CopyRect",
  5373. "user32.dll.UpdateLayeredWindow",
  5374. "user32.dll.RemovePropW",
  5375. "advapi32.dll.CryptReleaseContext",
  5376. "msptls.dll.?FsTransformVector@Ptls6@@YGJKPBUtagFSVECTOR@1@KPAU21@@Z",
  5377. "mso.dll.#8165",
  5378. "mso.dll.#677",
  5379. "mso.dll.#3702",
  5380. "mso.dll.#3484",
  5381. "mso.dll.#1966",
  5382. "mso.dll.#9566",
  5383. "mso.dll.#111",
  5384. "mso.dll.#4191",
  5385. "mso.dll.#3802",
  5386. "mso.dll.#6982",
  5387. "mso.dll.#8800",
  5388. "mso.dll.#3572",
  5389. "mso.dll.#167",
  5390. "mso.dll.#5737",
  5391. "mso.dll.#590",
  5392. "mso.dll.#3758",
  5393. "msgr3en.dll.CheckVersion",
  5394. "msgr3en.dll.#29",
  5395. "msgr3en.dll.#30",
  5396. "msgr3en.dll.#31",
  5397. "msgr3en.dll.#32",
  5398. "msgr3en.dll.#33",
  5399. "msgr3en.dll.#34",
  5400. "msgr3en.dll.#35",
  5401. "msgr3en.dll.#45",
  5402. "msgr3en.dll.#46",
  5403. "msgr3en.dll.#47",
  5404. "msgr3en.dll.#48",
  5405. "msgr3en.dll.#51",
  5406. "msgr3en.dll.#50",
  5407. "msgr3en.dll.#49",
  5408. "msgr3en.dll.#43",
  5409. "msgr3en.dll.#41",
  5410. "msgr3en.dll.#42",
  5411. "msgr3en.dll.#44",
  5412. "msgr3en.dll.#39",
  5413. "msgr3en.dll.#40",
  5414. "msgr3en.dll.#36",
  5415. "msgr3en.dll.#38",
  5416. "msgr3en.dll.#37",
  5417. "msgr3en.dll.#56",
  5418. "msgr3en.dll.#52",
  5419. "msgr3en.dll.#53",
  5420. "msgr3en.dll.#57",
  5421. "msgr3en.dll.#58",
  5422. "msgr3en.dll.#59",
  5423. "user32.dll.LoadStringA",
  5424. "mso.dll.#1266",
  5425. "gdi32.dll.GetStockObject",
  5426. "mso.dll.#6501",
  5427. "mso.dll.#511",
  5428. "mso.dll.#8118",
  5429. "gdi32.dll.GetGlyphIndicesW",
  5430. "mso.dll.#8060",
  5431. "mso.dll.#844",
  5432. "mso.dll.#9080",
  5433. "mso.dll.#5154",
  5434. "mso.dll.#2907",
  5435. "msspell7.dll.SpellerVersion",
  5436. "msspell7.dll.SpellerInit",
  5437. "msspell7.dll.SpellerSetOptions",
  5438. "msspell7.dll.SpellerGetOptions",
  5439. "msspell7.dll.SpellerTerminate",
  5440. "msspell7.dll.SpellerOpenLex",
  5441. "msspell7.dll.SpellerCloseLex",
  5442. "msspell7.dll.SpellerCheck",
  5443. "msspell7.dll.SpellerAddUdr",
  5444. "msspell7.dll.SpellerAddChangeUdr",
  5445. "msspell7.dll.SpellerDelUdr",
  5446. "msspell7.dll.SpellerClearUdr",
  5447. "msspell7.dll.SpellerGetSizeUdr",
  5448. "msspell7.dll.SpellerGetListUdr",
  5449. "msspell7.dll.SpellerBuiltinUdr",
  5450. "mscss7en.dll.FreeGlobalObjects",
  5451. "mscss7en.dll.GetContextSpellingSession",
  5452. "css7data0009.dll.NlsLangDataCall",
  5453. "shell32.dll.SHGetFolderPathAndSubDirW",
  5454. "mso.dll.#6125",
  5455. "user32.dll.EnumThreadWindows",
  5456. "user32.dll.EnumWindows",
  5457. "mso.dll.#6420",
  5458. "mso.dll.#2100",
  5459. "user32.dll.GetLastInputInfo",
  5460. "ws2_32.dll.#116",
  5461. "ws2_32.dll.WSAGetOverlappedResult",
  5462. "mso.dll.#8606",
  5463. "mso.dll.#7673",
  5464. "mso.dll.#709",
  5465. "mso.dll.#5913",
  5466. "mso.dll.#8051",
  5467. "mso.dll.#8656",
  5468. "user32.dll.UnhookWindowsHookEx",
  5469. "mso.dll.#4355",
  5470. "oleaut32.dll.#10",
  5471. "mso.dll.#1541",
  5472. "gdi32.dll.GetBitmapBits",
  5473. "mso.dll.#1442",
  5474. "mso.dll.#4388",
  5475. "user32.dll.GetQueueStatus",
  5476. "advapi32.dll.InitiateSystemShutdownExW",
  5477. "advapi32.dll.EventEnabled",
  5478. "rpcrtremote.dll.I_RpcExtInitializeExtensionPoint",
  5479. "ntdll.dll.ZwQueryInformationProcess",
  5480. "osppobjs.dll.SppPluginInitialize",
  5481. "osppobjs.dll.SppPluginShutdown",
  5482. "osppobjs.dll.SppPluginCreateInstance",
  5483. "osppobjs.dll.SppPluginCanUnloadNow",
  5484. "sspicli.dll.GetUserNameExW",
  5485. "setupapi.dll.SetupDiEnumDeviceInfo",
  5486. "setupapi.dll.SetupDiGetDeviceRegistryPropertyW",
  5487. "kernel32.dll.GetSystemFirmwareTable",
  5488. "wersvc.dll.ServiceMain",
  5489. "wersvc.dll.SvchostPushServiceGlobals",
  5490. "kernel32.dll.GetCurrentProcessId",
  5491. "kernel32.dll.CreateToolhelp32Snapshot",
  5492. "kernel32.dll.Module32First",
  5493. "kernel32.dll.Module32Next",
  5494. "kernel32.dll.CloseHandle",
  5495. "kernel32.dll.WritePrivateProfileStringA",
  5496. "psapi.dll.EnumProcesses",
  5497. "psapi.dll.EnumProcessModules",
  5498. "psapi.dll.GetModuleBaseNameW",
  5499. "ntdll.dll.NtQuerySystemInformation",
  5500. "rpcrt4.dll.UuidFromStringW",
  5501. "radarrs.dll.WdiDiagnosticModuleMain",
  5502. "radarrs.dll.WdiHandleInstance",
  5503. "radarrs.dll.WdiGetDiagnosticModuleInterfaceVersion",
  5504. "advapi32.dll.DuplicateToken"
  5505. ]
  5506.  
  5507. [*] Static Analysis: {
  5508. "pe": {
  5509. "peid_signatures": null,
  5510. "imports": [
  5511. {
  5512. "imports": [
  5513. {
  5514. "name": "__vbaVarTstGt",
  5515. "address": "0x401000"
  5516. },
  5517. {
  5518. "name": "__vbaVarSub",
  5519. "address": "0x401004"
  5520. },
  5521. {
  5522. "name": "__vbaStrI2",
  5523. "address": "0x401008"
  5524. },
  5525. {
  5526. "name": null,
  5527. "address": "0x40100c"
  5528. },
  5529. {
  5530. "name": "_CIcos",
  5531. "address": "0x401010"
  5532. },
  5533. {
  5534. "name": "_adj_fptan",
  5535. "address": "0x401014"
  5536. },
  5537. {
  5538. "name": "__vbaStrI4",
  5539. "address": "0x401018"
  5540. },
  5541. {
  5542. "name": "__vbaHresultCheck",
  5543. "address": "0x40101c"
  5544. },
  5545. {
  5546. "name": "__vbaVarMove",
  5547. "address": "0x401020"
  5548. },
  5549. {
  5550. "name": "__vbaVarVargNofree",
  5551. "address": "0x401024"
  5552. },
  5553. {
  5554. "name": "__vbaAryMove",
  5555. "address": "0x401028"
  5556. },
  5557. {
  5558. "name": "__vbaFreeVar",
  5559. "address": "0x40102c"
  5560. },
  5561. {
  5562. "name": "__vbaLateIdCall",
  5563. "address": "0x401030"
  5564. },
  5565. {
  5566. "name": "__vbaStrVarMove",
  5567. "address": "0x401034"
  5568. },
  5569. {
  5570. "name": "__vbaLenBstr",
  5571. "address": "0x401038"
  5572. },
  5573. {
  5574. "name": null,
  5575. "address": "0x40103c"
  5576. },
  5577. {
  5578. "name": "__vbaPut3",
  5579. "address": "0x401040"
  5580. },
  5581. {
  5582. "name": "__vbaEnd",
  5583. "address": "0x401044"
  5584. },
  5585. {
  5586. "name": "__vbaFreeVarList",
  5587. "address": "0x401048"
  5588. },
  5589. {
  5590. "name": "_adj_fdiv_m64",
  5591. "address": "0x40104c"
  5592. },
  5593. {
  5594. "name": null,
  5595. "address": "0x401050"
  5596. },
  5597. {
  5598. "name": "__vbaNextEachVar",
  5599. "address": "0x401054"
  5600. },
  5601. {
  5602. "name": "__vbaFreeObjList",
  5603. "address": "0x401058"
  5604. },
  5605. {
  5606. "name": null,
  5607. "address": "0x40105c"
  5608. },
  5609. {
  5610. "name": "__vbaVarIndexLoadRef",
  5611. "address": "0x401060"
  5612. },
  5613. {
  5614. "name": "__vbaStrErrVarCopy",
  5615. "address": "0x401064"
  5616. },
  5617. {
  5618. "name": "_adj_fprem1",
  5619. "address": "0x401068"
  5620. },
  5621. {
  5622. "name": null,
  5623. "address": "0x40106c"
  5624. },
  5625. {
  5626. "name": "__vbaRecAnsiToUni",
  5627. "address": "0x401070"
  5628. },
  5629. {
  5630. "name": null,
  5631. "address": "0x401074"
  5632. },
  5633. {
  5634. "name": null,
  5635. "address": "0x401078"
  5636. },
  5637. {
  5638. "name": "__vbaForEachCollAd",
  5639. "address": "0x40107c"
  5640. },
  5641. {
  5642. "name": "__vbaVarCmpNe",
  5643. "address": "0x401080"
  5644. },
  5645. {
  5646. "name": "__vbaStrCat",
  5647. "address": "0x401084"
  5648. },
  5649. {
  5650. "name": "__vbaLsetFixstr",
  5651. "address": "0x401088"
  5652. },
  5653. {
  5654. "name": "__vbaSetSystemError",
  5655. "address": "0x40108c"
  5656. },
  5657. {
  5658. "name": "__vbaLenBstrB",
  5659. "address": "0x401090"
  5660. },
  5661. {
  5662. "name": "__vbaHresultCheckObj",
  5663. "address": "0x401094"
  5664. },
  5665. {
  5666. "name": "__vbaLenVar",
  5667. "address": "0x401098"
  5668. },
  5669. {
  5670. "name": "_adj_fdiv_m32",
  5671. "address": "0x40109c"
  5672. },
  5673. {
  5674. "name": null,
  5675. "address": "0x4010a0"
  5676. },
  5677. {
  5678. "name": "__vbaAryVar",
  5679. "address": "0x4010a4"
  5680. },
  5681. {
  5682. "name": null,
  5683. "address": "0x4010a8"
  5684. },
  5685. {
  5686. "name": "__vbaAryDestruct",
  5687. "address": "0x4010ac"
  5688. },
  5689. {
  5690. "name": null,
  5691. "address": "0x4010b0"
  5692. },
  5693. {
  5694. "name": "__vbaVarIndexLoadRefLock",
  5695. "address": "0x4010b4"
  5696. },
  5697. {
  5698. "name": null,
  5699. "address": "0x4010b8"
  5700. },
  5701. {
  5702. "name": "__vbaVarForInit",
  5703. "address": "0x4010bc"
  5704. },
  5705. {
  5706. "name": "__vbaExitProc",
  5707. "address": "0x4010c0"
  5708. },
  5709. {
  5710. "name": null,
  5711. "address": "0x4010c4"
  5712. },
  5713. {
  5714. "name": "__vbaStrLike",
  5715. "address": "0x4010c8"
  5716. },
  5717. {
  5718. "name": null,
  5719. "address": "0x4010cc"
  5720. },
  5721. {
  5722. "name": "__vbaObjSet",
  5723. "address": "0x4010d0"
  5724. },
  5725. {
  5726. "name": "__vbaOnError",
  5727. "address": "0x4010d4"
  5728. },
  5729. {
  5730. "name": null,
  5731. "address": "0x4010d8"
  5732. },
  5733. {
  5734. "name": "_adj_fdiv_m16i",
  5735. "address": "0x4010dc"
  5736. },
  5737. {
  5738. "name": "__vbaObjSetAddref",
  5739. "address": "0x4010e0"
  5740. },
  5741. {
  5742. "name": "_adj_fdivr_m16i",
  5743. "address": "0x4010e4"
  5744. },
  5745. {
  5746. "name": "__vbaVarIndexLoad",
  5747. "address": "0x4010e8"
  5748. },
  5749. {
  5750. "name": null,
  5751. "address": "0x4010ec"
  5752. },
  5753. {
  5754. "name": "__vbaForEachCollVar",
  5755. "address": "0x4010f0"
  5756. },
  5757. {
  5758. "name": "__vbaStrFixstr",
  5759. "address": "0x4010f4"
  5760. },
  5761. {
  5762. "name": null,
  5763. "address": "0x4010f8"
  5764. },
  5765. {
  5766. "name": "__vbaRefVarAry",
  5767. "address": "0x4010fc"
  5768. },
  5769. {
  5770. "name": "__vbaFpR8",
  5771. "address": "0x401100"
  5772. },
  5773. {
  5774. "name": "__vbaBoolVarNull",
  5775. "address": "0x401104"
  5776. },
  5777. {
  5778. "name": "_CIsin",
  5779. "address": "0x401108"
  5780. },
  5781. {
  5782. "name": "__vbaErase",
  5783. "address": "0x40110c"
  5784. },
  5785. {
  5786. "name": null,
  5787. "address": "0x401110"
  5788. },
  5789. {
  5790. "name": "__vbaVarCmpGt",
  5791. "address": "0x401114"
  5792. },
  5793. {
  5794. "name": "__vbaVargVarMove",
  5795. "address": "0x401118"
  5796. },
  5797. {
  5798. "name": null,
  5799. "address": "0x40111c"
  5800. },
  5801. {
  5802. "name": null,
  5803. "address": "0x401120"
  5804. },
  5805. {
  5806. "name": "__vbaChkstk",
  5807. "address": "0x401124"
  5808. },
  5809. {
  5810. "name": null,
  5811. "address": "0x401128"
  5812. },
  5813. {
  5814. "name": "__vbaFileClose",
  5815. "address": "0x40112c"
  5816. },
  5817. {
  5818. "name": "EVENT_SINK_AddRef",
  5819. "address": "0x401130"
  5820. },
  5821. {
  5822. "name": null,
  5823. "address": "0x401134"
  5824. },
  5825. {
  5826. "name": "__vbaGenerateBoundsError",
  5827. "address": "0x401138"
  5828. },
  5829. {
  5830. "name": "__vbaGet3",
  5831. "address": "0x40113c"
  5832. },
  5833. {
  5834. "name": null,
  5835. "address": "0x401140"
  5836. },
  5837. {
  5838. "name": "__vbaStrCmp",
  5839. "address": "0x401144"
  5840. },
  5841. {
  5842. "name": "__vbaAryConstruct2",
  5843. "address": "0x401148"
  5844. },
  5845. {
  5846. "name": "__vbaVarTstEq",
  5847. "address": "0x40114c"
  5848. },
  5849. {
  5850. "name": "__vbaPutOwner4",
  5851. "address": "0x401150"
  5852. },
  5853. {
  5854. "name": "__vbaNextEachCollVar",
  5855. "address": "0x401154"
  5856. },
  5857. {
  5858. "name": null,
  5859. "address": "0x401158"
  5860. },
  5861. {
  5862. "name": "__vbaPrintObj",
  5863. "address": "0x40115c"
  5864. },
  5865. {
  5866. "name": "__vbaI2I4",
  5867. "address": "0x401160"
  5868. },
  5869. {
  5870. "name": "__vbaObjVar",
  5871. "address": "0x401164"
  5872. },
  5873. {
  5874. "name": "DllFunctionCall",
  5875. "address": "0x401168"
  5876. },
  5877. {
  5878. "name": null,
  5879. "address": "0x40116c"
  5880. },
  5881. {
  5882. "name": "__vbaVarOr",
  5883. "address": "0x401170"
  5884. },
  5885. {
  5886. "name": null,
  5887. "address": "0x401174"
  5888. },
  5889. {
  5890. "name": "__vbaVarLateMemSt",
  5891. "address": "0x401178"
  5892. },
  5893. {
  5894. "name": null,
  5895. "address": "0x40117c"
  5896. },
  5897. {
  5898. "name": "__vbaLbound",
  5899. "address": "0x401180"
  5900. },
  5901. {
  5902. "name": "_adj_fpatan",
  5903. "address": "0x401184"
  5904. },
  5905. {
  5906. "name": "__vbaR4Var",
  5907. "address": "0x401188"
  5908. },
  5909. {
  5910. "name": "__vbaFixstrConstruct",
  5911. "address": "0x40118c"
  5912. },
  5913. {
  5914. "name": "__vbaLateIdCallLd",
  5915. "address": "0x401190"
  5916. },
  5917. {
  5918. "name": "__vbaR8Cy",
  5919. "address": "0x401194"
  5920. },
  5921. {
  5922. "name": "__vbaRedim",
  5923. "address": "0x401198"
  5924. },
  5925. {
  5926. "name": "__vbaStrR8",
  5927. "address": "0x40119c"
  5928. },
  5929. {
  5930. "name": "__vbaRecUniToAnsi",
  5931. "address": "0x4011a0"
  5932. },
  5933. {
  5934. "name": "EVENT_SINK_Release",
  5935. "address": "0x4011a4"
  5936. },
  5937. {
  5938. "name": "__vbaNew",
  5939. "address": "0x4011a8"
  5940. },
  5941. {
  5942. "name": null,
  5943. "address": "0x4011ac"
  5944. },
  5945. {
  5946. "name": null,
  5947. "address": "0x4011b0"
  5948. },
  5949. {
  5950. "name": "__vbaUI1I2",
  5951. "address": "0x4011b4"
  5952. },
  5953. {
  5954. "name": "_CIsqrt",
  5955. "address": "0x4011b8"
  5956. },
  5957. {
  5958. "name": "__vbaObjIs",
  5959. "address": "0x4011bc"
  5960. },
  5961. {
  5962. "name": "__vbaVarAnd",
  5963. "address": "0x4011c0"
  5964. },
  5965. {
  5966. "name": "EVENT_SINK_QueryInterface",
  5967. "address": "0x4011c4"
  5968. },
  5969. {
  5970. "name": "__vbaStr2Vec",
  5971. "address": "0x4011c8"
  5972. },
  5973. {
  5974. "name": "__vbaUI1I4",
  5975. "address": "0x4011cc"
  5976. },
  5977. {
  5978. "name": "__vbaExceptHandler",
  5979. "address": "0x4011d0"
  5980. },
  5981. {
  5982. "name": null,
  5983. "address": "0x4011d4"
  5984. },
  5985. {
  5986. "name": null,
  5987. "address": "0x4011d8"
  5988. },
  5989. {
  5990. "name": "__vbaPrintFile",
  5991. "address": "0x4011dc"
  5992. },
  5993. {
  5994. "name": "__vbaStrToUnicode",
  5995. "address": "0x4011e0"
  5996. },
  5997. {
  5998. "name": null,
  5999. "address": "0x4011e4"
  6000. },
  6001. {
  6002. "name": "_adj_fprem",
  6003. "address": "0x4011e8"
  6004. },
  6005. {
  6006. "name": "_adj_fdivr_m64",
  6007. "address": "0x4011ec"
  6008. },
  6009. {
  6010. "name": null,
  6011. "address": "0x4011f0"
  6012. },
  6013. {
  6014. "name": null,
  6015. "address": "0x4011f4"
  6016. },
  6017. {
  6018. "name": null,
  6019. "address": "0x4011f8"
  6020. },
  6021. {
  6022. "name": null,
  6023. "address": "0x4011fc"
  6024. },
  6025. {
  6026. "name": "__vbaFPException",
  6027. "address": "0x401200"
  6028. },
  6029. {
  6030. "name": "__vbaInStrVar",
  6031. "address": "0x401204"
  6032. },
  6033. {
  6034. "name": null,
  6035. "address": "0x401208"
  6036. },
  6037. {
  6038. "name": "__vbaUbound",
  6039. "address": "0x40120c"
  6040. },
  6041. {
  6042. "name": "__vbaStrVarVal",
  6043. "address": "0x401210"
  6044. },
  6045. {
  6046. "name": "__vbaVarCat",
  6047. "address": "0x401214"
  6048. },
  6049. {
  6050. "name": null,
  6051. "address": "0x401218"
  6052. },
  6053. {
  6054. "name": "__vbaI2Var",
  6055. "address": "0x40121c"
  6056. },
  6057. {
  6058. "name": null,
  6059. "address": "0x401220"
  6060. },
  6061. {
  6062. "name": null,
  6063. "address": "0x401224"
  6064. },
  6065. {
  6066. "name": null,
  6067. "address": "0x401228"
  6068. },
  6069. {
  6070. "name": "_CIlog",
  6071. "address": "0x40122c"
  6072. },
  6073. {
  6074. "name": "__vbaErrorOverflow",
  6075. "address": "0x401230"
  6076. },
  6077. {
  6078. "name": "__vbaFileOpen",
  6079. "address": "0x401234"
  6080. },
  6081. {
  6082. "name": "__vbaVarLateMemCallLdRf",
  6083. "address": "0x401238"
  6084. },
  6085. {
  6086. "name": "__vbaVar2Vec",
  6087. "address": "0x40123c"
  6088. },
  6089. {
  6090. "name": "__vbaInStr",
  6091. "address": "0x401240"
  6092. },
  6093. {
  6094. "name": null,
  6095. "address": "0x401244"
  6096. },
  6097. {
  6098. "name": null,
  6099. "address": "0x401248"
  6100. },
  6101. {
  6102. "name": "__vbaR8Str",
  6103. "address": "0x40124c"
  6104. },
  6105. {
  6106. "name": "__vbaNew2",
  6107. "address": "0x401250"
  6108. },
  6109. {
  6110. "name": "_adj_fdiv_m32i",
  6111. "address": "0x401254"
  6112. },
  6113. {
  6114. "name": "_adj_fdivr_m32i",
  6115. "address": "0x401258"
  6116. },
  6117. {
  6118. "name": "__vbaVarSetObj",
  6119. "address": "0x40125c"
  6120. },
  6121. {
  6122. "name": null,
  6123. "address": "0x401260"
  6124. },
  6125. {
  6126. "name": "__vbaStrCopy",
  6127. "address": "0x401264"
  6128. },
  6129. {
  6130. "name": "__vbaI4Str",
  6131. "address": "0x401268"
  6132. },
  6133. {
  6134. "name": null,
  6135. "address": "0x40126c"
  6136. },
  6137. {
  6138. "name": "__vbaVarCmpLt",
  6139. "address": "0x401270"
  6140. },
  6141. {
  6142. "name": "__vbaFreeStrList",
  6143. "address": "0x401274"
  6144. },
  6145. {
  6146. "name": null,
  6147. "address": "0x401278"
  6148. },
  6149. {
  6150. "name": "_adj_fdivr_m32",
  6151. "address": "0x40127c"
  6152. },
  6153. {
  6154. "name": "__vbaPowerR8",
  6155. "address": "0x401280"
  6156. },
  6157. {
  6158. "name": "_adj_fdiv_r",
  6159. "address": "0x401284"
  6160. },
  6161. {
  6162. "name": null,
  6163. "address": "0x401288"
  6164. },
  6165. {
  6166. "name": null,
  6167. "address": "0x40128c"
  6168. },
  6169. {
  6170. "name": "__vbaVarTstNe",
  6171. "address": "0x401290"
  6172. },
  6173. {
  6174. "name": "__vbaVarSetVar",
  6175. "address": "0x401294"
  6176. },
  6177. {
  6178. "name": "__vbaI4Var",
  6179. "address": "0x401298"
  6180. },
  6181. {
  6182. "name": null,
  6183. "address": "0x40129c"
  6184. },
  6185. {
  6186. "name": "__vbaVarCmpEq",
  6187. "address": "0x4012a0"
  6188. },
  6189. {
  6190. "name": "__vbaFpCy",
  6191. "address": "0x4012a4"
  6192. },
  6193. {
  6194. "name": "__vbaAryLock",
  6195. "address": "0x4012a8"
  6196. },
  6197. {
  6198. "name": "__vbaVarAdd",
  6199. "address": "0x4012ac"
  6200. },
  6201. {
  6202. "name": "__vbaLateMemCall",
  6203. "address": "0x4012b0"
  6204. },
  6205. {
  6206. "name": null,
  6207. "address": "0x4012b4"
  6208. },
  6209. {
  6210. "name": "__vbaStrComp",
  6211. "address": "0x4012b8"
  6212. },
  6213. {
  6214. "name": "__vbaVarDup",
  6215. "address": "0x4012bc"
  6216. },
  6217. {
  6218. "name": "__vbaStrToAnsi",
  6219. "address": "0x4012c0"
  6220. },
  6221. {
  6222. "name": null,
  6223. "address": "0x4012c4"
  6224. },
  6225. {
  6226. "name": "__vbaVarLateMemCallLd",
  6227. "address": "0x4012c8"
  6228. },
  6229. {
  6230. "name": "__vbaFpI4",
  6231. "address": "0x4012cc"
  6232. },
  6233. {
  6234. "name": null,
  6235. "address": "0x4012d0"
  6236. },
  6237. {
  6238. "name": "__vbaLateMemCallLd",
  6239. "address": "0x4012d4"
  6240. },
  6241. {
  6242. "name": "_CIatan",
  6243. "address": "0x4012d8"
  6244. },
  6245. {
  6246. "name": null,
  6247. "address": "0x4012dc"
  6248. },
  6249. {
  6250. "name": "__vbaAryCopy",
  6251. "address": "0x4012e0"
  6252. },
  6253. {
  6254. "name": "__vbaCastObj",
  6255. "address": "0x4012e4"
  6256. },
  6257. {
  6258. "name": "__vbaStrMove",
  6259. "address": "0x4012e8"
  6260. },
  6261. {
  6262. "name": "__vbaForEachVar",
  6263. "address": "0x4012ec"
  6264. },
  6265. {
  6266. "name": null,
  6267. "address": "0x4012f0"
  6268. },
  6269. {
  6270. "name": "__vbaStrVarCopy",
  6271. "address": "0x4012f4"
  6272. },
  6273. {
  6274. "name": "__vbaR8IntI4",
  6275. "address": "0x4012f8"
  6276. },
  6277. {
  6278. "name": "_allmul",
  6279. "address": "0x4012fc"
  6280. },
  6281. {
  6282. "name": "_CItan",
  6283. "address": "0x401300"
  6284. },
  6285. {
  6286. "name": "__vbaNextEachCollAd",
  6287. "address": "0x401304"
  6288. },
  6289. {
  6290. "name": "__vbaAryUnlock",
  6291. "address": "0x401308"
  6292. },
  6293. {
  6294. "name": "__vbaUI1Var",
  6295. "address": "0x40130c"
  6296. },
  6297. {
  6298. "name": "__vbaVarForNext",
  6299. "address": "0x401310"
  6300. },
  6301. {
  6302. "name": "_CIexp",
  6303. "address": "0x401314"
  6304. },
  6305. {
  6306. "name": "__vbaFreeObj",
  6307. "address": "0x401318"
  6308. },
  6309. {
  6310. "name": "__vbaFreeStr",
  6311. "address": "0x40131c"
  6312. },
  6313. {
  6314. "name": null,
  6315. "address": "0x401320"
  6316. }
  6317. ],
  6318. "dll": "MSVBVM60.DLL"
  6319. }
  6320. ],
  6321. "digital_signers": null,
  6322. "exported_dll_name": null,
  6323. "actual_checksum": "0x00117f3c",
  6324. "overlay": null,
  6325. "imagebase": "0x00400000",
  6326. "reported_checksum": "0x000dcb33",
  6327. "icon_hash": null,
  6328. "entrypoint": "0x00403a58",
  6329. "timestamp": "2019-06-18 07:13:09",
  6330. "osversion": "4.0",
  6331. "sections": [
  6332. {
  6333. "name": ".text",
  6334. "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
  6335. "virtual_address": "0x00001000",
  6336. "size_of_data": "0x0008a000",
  6337. "entropy": "5.27",
  6338. "raw_address": "0x00001000",
  6339. "virtual_size": "0x00089844",
  6340. "characteristics_raw": "0x60000020"
  6341. },
  6342. {
  6343. "name": ".data",
  6344. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE",
  6345. "virtual_address": "0x0008b000",
  6346. "size_of_data": "0x00001000",
  6347. "entropy": "0.00",
  6348. "raw_address": "0x0008b000",
  6349. "virtual_size": "0x00005174",
  6350. "characteristics_raw": "0xc0000040"
  6351. },
  6352. {
  6353. "name": ".rsrc",
  6354. "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ",
  6355. "virtual_address": "0x00091000",
  6356. "size_of_data": "0x00081000",
  6357. "entropy": "7.98",
  6358. "raw_address": "0x0008c000",
  6359. "virtual_size": "0x00080f18",
  6360. "characteristics_raw": "0x40000040"
  6361. }
  6362. ],
  6363. "resources": [],
  6364. "dirents": [
  6365. {
  6366. "virtual_address": "0x00000000",
  6367. "name": "IMAGE_DIRECTORY_ENTRY_EXPORT",
  6368. "size": "0x00000000"
  6369. },
  6370. {
  6371. "virtual_address": "0x00089b44",
  6372. "name": "IMAGE_DIRECTORY_ENTRY_IMPORT",
  6373. "size": "0x00000028"
  6374. },
  6375. {
  6376. "virtual_address": "0x00091000",
  6377. "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE",
  6378. "size": "0x00080f18"
  6379. },
  6380. {
  6381. "virtual_address": "0x00000000",
  6382. "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION",
  6383. "size": "0x00000000"
  6384. },
  6385. {
  6386. "virtual_address": "0x00000000",
  6387. "name": "IMAGE_DIRECTORY_ENTRY_SECURITY",
  6388. "size": "0x00000000"
  6389. },
  6390. {
  6391. "virtual_address": "0x00000000",
  6392. "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC",
  6393. "size": "0x00000000"
  6394. },
  6395. {
  6396. "virtual_address": "0x00000000",
  6397. "name": "IMAGE_DIRECTORY_ENTRY_DEBUG",
  6398. "size": "0x00000000"
  6399. },
  6400. {
  6401. "virtual_address": "0x00000000",
  6402. "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT",
  6403. "size": "0x00000000"
  6404. },
  6405. {
  6406. "virtual_address": "0x00000000",
  6407. "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR",
  6408. "size": "0x00000000"
  6409. },
  6410. {
  6411. "virtual_address": "0x00000000",
  6412. "name": "IMAGE_DIRECTORY_ENTRY_TLS",
  6413. "size": "0x00000000"
  6414. },
  6415. {
  6416. "virtual_address": "0x00000000",
  6417. "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG",
  6418. "size": "0x00000000"
  6419. },
  6420. {
  6421. "virtual_address": "0x00000238",
  6422. "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT",
  6423. "size": "0x00000020"
  6424. },
  6425. {
  6426. "virtual_address": "0x00001000",
  6427. "name": "IMAGE_DIRECTORY_ENTRY_IAT",
  6428. "size": "0x00000328"
  6429. },
  6430. {
  6431. "virtual_address": "0x00000000",
  6432. "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT",
  6433. "size": "0x00000000"
  6434. },
  6435. {
  6436. "virtual_address": "0x00000000",
  6437. "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR",
  6438. "size": "0x00000000"
  6439. },
  6440. {
  6441. "virtual_address": "0x00000000",
  6442. "name": "IMAGE_DIRECTORY_ENTRY_RESERVED",
  6443. "size": "0x00000000"
  6444. }
  6445. ],
  6446. "exports": [],
  6447. "guest_signers": {},
  6448. "imphash": "23028877b3ded4155a8cd065c88d1374",
  6449. "icon_fuzzy": null,
  6450. "icon": null,
  6451. "pdbpath": null,
  6452. "imported_dll_count": 1,
  6453. "versioninfo": []
  6454. }
  6455. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!